Privacy policy
Last updated 23 October 2026
This policy explains what personal data we collect when you visit tomalab.app, contact us, create an account, buy or use our software, and what rights you have under the EU General Data Protection Regulation (GDPR).
1. Controller
Falus Tamás, sole trader trading as TomaLab, 1133 Budapest, Pannónia utca 64. B ép. 5. em. 25., Hungary. Email: hello@tomalab.app. We have not appointed a data protection officer, as we are not required to.
2. What we collect and why
| When | Data | Purpose | Legal basis | Kept for |
|---|---|---|---|---|
| Visiting the site | IP address, browser, pages requested, time (server logs) | Delivering the site, security, fixing errors | Legitimate interest (Art. 6(1)(f)) | Up to 30 days |
| Analytics (only if you accept) | Pages viewed, device and browser type, approximate location (country and city, worked out by Google from your IP address, which Google Analytics does not store), referring site and campaign, a random identifier stored in a cookie, and what you do on the site: sections you scroll to, tabs you open, sound examples and videos you play, links and downloads you click, and whether you sign up, sign in, start a trial, activate a licence, start a checkout or complete a purchase (product and price). Never your name, email address, password or payment details. | Understanding how the site is used so we can improve it, and which pages lead to trials and sales | Consent (Art. 6(1)(a)) | 14 months |
| Contact form | Name, email address, your message, spam-check data from hCaptcha | Answering your message, preventing spam | Legitimate interest; steps before a contract (Art. 6(1)(b)) | Up to 2 years after our last exchange |
| Account and licences | Name, email, password (stored hashed), licences, activations (computer name and a hardware identifier), download history | Running your account, issuing and checking licences, delivering downloads and updates | Contract (Art. 6(1)(b)) | As long as your account exists, then up to 1 year |
| Purchases | Name, email, billing country and address, VAT ID if given, order details. Card or PayPal details are handled by the payment providers, never by us. | Selling the product, invoicing, tax, refunds, fraud prevention | Contract; legal obligation (Art. 6(1)(c)) | 8 years for accounting records, as required by Hungarian law |
| Product updates (only if you opt in) | Email address | Sending news about updates and new products | Consent | Until you unsubscribe |
The software checks its licence with Moonbase when you activate it and from time to time afterwards. It does not send us your audio, projects or usage data.
3. Who we share data with
- Moonbase AS, Norway (Moonbase LLC, USA, for some payments). Runs our shop, accounts and licensing. For accounts and licences Moonbase processes data on our behalf. For checkout, payment, tax and invoicing it acts as an independent controller under its own privacy policy for buyers, together with its payment providers.
- Google Ireland Limited (Google Analytics 4), only if you accept analytics cookies. Google processes this data on our behalf. Google signals and ad personalisation are switched off, and the data is not linked to Google Ads. See Google’s privacy policy and how Google uses data from sites that use its services.
- Web3Forms, which delivers contact-form messages to our inbox.
- hCaptcha (Intuition Machines, Inc., USA), which checks contact-form submissions for spam and may collect device and interaction data. See the hCaptcha privacy policy.
- DigitalOcean, LLC (USA), which hosts this website. See the DigitalOcean privacy policy.
- Our email provider, which stores messages sent to hello@tomalab.app.
- Our accountant and tax authorities, where the law requires it.
We do not sell your personal data.
4. Transfers outside the EEA
Some providers, such as DigitalOcean, Google, hCaptcha and Moonbase LLC, may process data in the United States. These transfers rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission’s standard contractual clauses.
5. Your rights
You can ask us for access to your data, to correct it, delete it, restrict or object to its use, or receive it in a portable format. Where we rely on consent, you can withdraw it at any time, for analytics through Cookie settings. Write to hello@tomalab.app; we answer within one month.
You can also complain to a data protection authority. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11., naih.hu. You may also contact the authority where you live or work.
6. Security
The site is served only over HTTPS. Passwords are stored hashed by Moonbase. Access to our inbox and accounts is protected with strong passwords and two-factor authentication.
7. Children
Our products are not aimed at children under 16, and we do not knowingly collect their data.
8. Changes
We will update this page when our services or providers change, and show the date at the top.