Last updated: June 12, 2026
1. Who we are
Fractal Forge is operated by R&D STREAMS ("R&D STREAMS", "we", "us"). R&D STREAMS is the data controller responsible for personal data processed through this service. For privacy questions or to exercise your rights, contact us via the support channel in the app.
2. Data we collect
- Account data: email address, display name, authentication identifiers.
- Content you upload: audio clips submitted to generate fractals, generated fractal images, presets, likes, and community submissions.
- Usage and device data: log data, IP address (hashed for rate-limiting), browser/user-agent, and basic analytics events.
- Support and communications: messages you send us and email delivery metadata.
- Payment records: transaction confirmations, subscription status, and customer identifiers returned by our payment processor. We do not store full card numbers.
3. Why we process it (purposes & legal basis)
- Providing the service (account creation, generating and storing fractals, sending requested clips) — performance of a contract.
- Security, fraud and abuse prevention (rate-limiting, hashed IP fingerprints, audit logs) — legitimate interests.
- Service improvement and analytics — legitimate interests.
- Transactional emails (account, submission notifications, receipts) — performance of a contract.
- Legal and tax compliance (invoicing, record-keeping) — legal obligation.
4. How we share your data
We share personal data only with the categories of recipients below, and only as needed for the purposes above:
- Paddle.com Market Ltd. ("Paddle") — Merchant of Record. All purchases on Fractal Forge are sold and invoiced by Paddle, our reseller and Merchant of Record. When you check out, your name, email, billing address, payment details, IP address and transaction data are collected and processed by Paddle to take payment, calculate tax, handle invoicing, manage subscriptions, prevent fraud, and process refunds. Paddle acts as an independent controller for that payment processing activity. See Paddle's privacy notice at paddle.com/legal/privacy.
- Infrastructure and service providers (processors) — hosting, database, file storage, email delivery, and analytics providers that operate the platform on our behalf under written data-processing terms.
- Professional advisers — accountants and legal advisers, where necessary.
- Authorities — where required by law, court order or to protect our rights or the safety of users.
We do not sell your personal data and we do not share it for third-party advertising.
5. International transfers
Our providers (including Paddle) may process data outside your country, including in the EEA, the UK, and the United States. Where required, transfers are protected by appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.
6. Retention
- Account data: kept while your account is active, deleted within 30 days of account closure.
- Uploaded audio and generated fractals: kept until you delete them or close your account.
- Email delivery logs: up to 12 months for deliverability and abuse handling.
- Payment and invoice records (held by us and by Paddle): retained for the period required by applicable tax and accounting law (typically 6–10 years).
- Security logs and hashed IP fingerprints: up to 90 days.
7. Security
We apply appropriate technical and organisational measures including TLS in transit, encryption at rest for stored files, role-based access controls, row-level security on our database, secret management for credentials, and regular security scanning. No system is perfectly secure; we work to address issues promptly when identified.
8. Your rights
Subject to your local law (including the GDPR / UK GDPR where applicable), you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent. EEA/UK users also have the right to lodge a complaint with their local supervisory authority. We aim to respond within one month. To exercise your rights, contact us via the in-app support channel.
9. Cookies
We use strictly necessary cookies and local storage for authentication and session management, and limited analytics to understand usage. Paddle may set cookies during checkout to operate the payment flow. You can manage cookies in your browser settings; disabling essential cookies may break sign-in and checkout.
10. Changes to this notice
We may update this notice to reflect changes to the service or the law. Material changes will be communicated in-app or by email.