Privacy Policy - Vesari Stylus

Last updated: 17 October 2026

This policy explains what personal data we handle in two situations: when you join the Vesari Stylus pre-launch waitlist on this website, and when you use the Vesari Stylus desktop app. We may update it from time to time; the "Last updated" date above always shows the current version.

Who we are

The Vesari Stylus website (vesaristylus.com) and waitlist are run by DANIELZ LTD, a company registered in England & Wales (company no. 15860663). We are the "data controller" for the personal data described here.

Registered office: Unit A, James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE.

For anything to do with your data - questions, requests, or complaints - email [email protected].

What we collect

When you sign up to the waitlist, we collect:

• Your email address - the one you type into the form.
• Optional answers you choose to give - the two optional dropdowns, "how did you hear about us?" and "what are you most excited about?" You can leave both blank; they just help us understand our early audience.
• A timestamp - when you signed up.
• The page path you signed up from (e.g. /).
• Your IP address - kept for about an hour so the form can limit repeated submissions, and sent to Cloudflare for the human check described under "Cookies".
• Your macOS notification preference - whether you ticked "also tell me when the macOS version ships". Unticked is stored as "no" - though if you ticked it on an earlier sign-up, we keep that earlier "yes"; email us to change it.

That's it. We don't ask for your name, we don't take any payment details, and there are no accounts.

Joining the waitlist is entirely optional. If you don't give us your email, the only consequence is that we won't be able to send you launch updates.

Why we collect it, and our lawful basis

We use your email address to contact you about the Vesari Stylus launch: launch news, founder / early-adopter pricing, and product updates. These are marketing emails about our own product only. The optional dropdown answers are stored with your signup but used only in aggregate, to understand where our early audience comes from and what they care about. The macOS preference is different: if you tick it, we record that choice against your email address so we can tell you specifically when the macOS version ships, and we may mirror it as a tag on your subscriber record in our email platform (see below) so that email goes only to the people who asked for it.

• Our lawful basis under UK GDPR is your consent (Article 6(1)(a)).
• We send the marketing emails under PECR on the basis of that same consent.

You can withdraw your consent at any time - see "Your choices and rights" below. Withdrawing doesn't affect anything we sent before you withdrew.

We do not use your waitlist data (your email address and optional answers) for any automated decision-making or profiling.

Who handles your data

We use a small number of trusted providers ("processors") to run the waitlist and the app's support features:

• Cloudflare, Inc. - hosts the website and stores your email in Cloudflare KV storage, provides CDN and security services, and sits in front of our domain, so the app's connections to it, including bug reports sent there, pass through its infrastructure. Cloudflare may set strictly-necessary security cookies (for example, bot protection).
• Hetzner - hosts the servers that run the app's trial, licence, update, bug-report and metadata-cache services.
• Google (Workspace) - handles the mailboxes for [email protected] and [email protected], so emails you send us pass through it.
• Kit (ConvertKit) - when you join the waitlist your email is also sent to Kit, which holds the list, sends the confirmation email when you sign up, and will send the launch emails.
• Anthropic - if you send a bug report, screens attached images and helps analyse your description and a short log excerpt (see "Bug reports").
• GitHub - holds our issue tracker, where a bug report's summary is filed.
• Telegram - delivers our internal alert when a bug report arrives (screenshots are not forwarded by default); it also delivers alerts about unusual licence use, which carry the licence ID.

Your waitlist email is stored in Cloudflare KV and in Kit; Kit sends the confirmation and launch emails.

We do not share it with third parties for their own marketing.

International transfers

Our providers - Cloudflare, Kit, Anthropic, GitHub and Google in the United States, and Telegram outside the UK - may mean your data is transferred outside the UK and EEA. Our own servers are hosted by Hetzner in Germany. Where it is, we rely on appropriate safeguards - such as the UK International Data Transfer Agreement (IDTA), EU Standard Contractual Clauses (SCCs), or the applicable Data Privacy Framework - to keep it protected to UK standards. You can ask us for more information about these safeguards, or for a copy, by emailing [email protected].

The Vesari Stylus app

Vesari Stylus is a desktop application that runs on your own computer. Your music files, your library database, your play history and your ratings stay on your machine. We do not upload them; the ways details from them can reach us or other services are described below, for example library file paths and recent playback in a bug report you send, and the title, artist, album, length or an acoustic fingerprint of a track in music lookups and with the metadata cache. The trial, licence and update requests do not include them. The app connects to servers in these situations, each described below: to start a free trial, to activate or check a licence, to check for updates, to look up music information (when you ask, automatically for a CD in the drive and after a CD rip, and, if you save a Last.fm key, for the artists and albums in your library), when you press send on a bug report, and when it uses the metadata cache. If you switch on remote listening (it is off by default), your computer serves your library to your own devices.

Your free trial

Vesari Stylus comes with a time-limited free trial. So that the trial can't simply be reset by reinstalling the app or clearing its data, the app contacts our licence server shortly after it starts and, if no trial or paid licence exists yet for your computer, records that a trial has started (it retries about every 30 minutes until that works). For this we store three things:

• A short machine fingerprint - a single value computed from the Windows installation ID (the MachineGuid); no hardware details are read to make it. If that ID cannot be read, the app makes a random identifier and keeps it in its data folder instead. It does not contain your name, your email, or anything about your music. But because it's stable and - if you later buy a licence - can be linked to your purchase, we treat it as personal data about you: it is pseudonymous, not anonymous.
• The date your trial started.
• A count of how many times a trial has been issued for that computer.

We use this only to run the free trial fairly and to stop it being abused - for example, reset over and over to avoid buying a licence. The trial record does not include what you listen to, what's in your library, or how you use the app.

• Our lawful basis under UK GDPR is our legitimate interests (Article 6(1)(f)) in offering a free trial and protecting it from abuse. We've weighed that against your rights: the data is minimal, it holds none of your content or identity, and it's used only for this purpose. You have the right to object - see "Your choices and rights".

We keep the trial record for as long as we need it to enforce the one-trial-per-computer limit; there is no automatic deletion of trial records. If you go on to buy a licence, the fingerprint is also kept as part of your licence and activation record. Activation records are not deleted when you deactivate (deactivating in the app sends nothing to our server), and our licence audit log is append-only. Backups of the licence server's database are kept for about 7 days on the server and about 30 days on a second machine we operate. Reinstalling Windows can give a computer a new installation ID, and with it a new trial; an identifier the app generated itself is cleared if you clear the app's data.

Licensing and updates

If you buy a licence, the app uses the same machine fingerprint to activate it on your computer and to check from time to time that it's still valid. The app may also check whether a newer version is available. None of these checks tell us what's in your library or how you use the app.

The purchase itself is handled by our payment provider, which processes your payment and billing details under its own terms. When that provider goes live, this policy will be updated to name it and set out what it processes and where.

Music lookups

When you use Super-Tag or ask for cover art, artist images, lyrics or an edition lookup, the app sends a request to public music services, including MusicBrainz, AcoustID, the Cover Art Archive, Deezer, Discogs, LRCLIB, Wikidata and Wikimedia Commons. A request carries what identifies the one track, album or artist involved, such as its title, artist, album and length, or an acoustic fingerprint with the length; the audio file itself is not sent. When a CD is in the drive, the app also looks up the disc's table of contents on MusicBrainz and the CUETools database (CTDB) automatically, without a button press, and when a CD rip finishes it runs Super-Tag, cover art and lyrics lookups for the ripped tracks automatically. If you save a Last.fm key in Settings, the app also sends the names of the artists and albums in your library to Last.fm to fetch information about them, after a full library scan and when it serves remote listening. If you set your own MusicBrainz mirror in Settings, the app sends some of these MusicBrainz lookups to it, and some still go to musicbrainz.org. These are third-party services: they receive the request, including your IP address, and handle it under their own terms.

Metadata cache

The app can use a shared metadata cache server; the one built into a build is run by us. Depending on the build, the address and token are built in or empty. In a build with them built in, clearing them in Settings brings the built-in values back; in a build without them, the cache stays off until you enter your own. When a cache is configured, Super-Tag checks it before the public music databases, and the app can send it the MusicBrainz recording and release IDs, a lookup key and the resolved title, artist, album and year of a track; in the Hosted AcoustID mode the track's acoustic fingerprint and length go to it as well, and when the cache has no answer its server can pass them on to AcoustID. The cache server stores the sending IP address and the time against each track it accepts, and we have not set a deletion schedule for those records. The Seed cache from this library button sends those details for tracks you have already matched, when you press it.

Bug reports (only if you send one)

The app has a "Report a bug" option. Nothing about a problem ever leaves your machine unless you press send. If you do, the report contains:

• Your description of the problem, when you said it happened, the app version and your operating system, and - if you type it - your name.
• Roughly the last three days of the app's logs. These are technical events, and they include file paths from your library - folder and file names can reveal artists, albums, or other personal details - and a record of which tracks played and when.
• Up to six screenshots you choose to attach.

Where it goes, in order:

• It is sent to the report address built into your copy of the app or, in a build with none built in, to the metadata cache server set in your copy. Where that address is on our domain, Cloudflare fronts it, so the report passes through Cloudflare's infrastructure on the way.
• We use Anthropic (an AI provider) to screen attached images and to help analyse your description together with a short excerpt of the logs. The content of your report - including any library file paths in that excerpt - is processed by Anthropic for this purpose and no other.
• A summary - your description plus the analysis, never the log files or screenshots themselves, though the analysis may quote a line from them - is filed in our issue tracker on GitHub.
• A short alert - your description and when you said it happened, a one-line summary and suspected cause (which may quote a log line), the app version, your platform, and your name if you gave one - reaches us via Telegram. Screenshots are not part of that alert by default; an option to forward them exists and is off unless we switch it on.

How long we keep it: the raw logs and screenshots are deleted from our server after 90 days. The filed summary stays in our systems so we can follow the fix through; an internal copy of your description is redacted by the same 90-day clean-up.

Our lawful basis is our legitimate interests (Article 6(1)(f)) in diagnosing and fixing the faults you choose to report to us. A report is only ever sent on your explicit action, and a name is never required.

Server logs

Like any online service, when the app contacts our servers those servers may record standard technical information about the request - such as an IP address, the type of request, and the time - to keep the service secure and reliable and to investigate faults. We don't use them to build a profile of you.

Cookies

This site uses no analytics or advertising cookies and no third-party trackers. This site loads its fonts from Google Fonts, so your browser contacts Google to fetch them, which shares your IP address with Google. The waitlist forms use Cloudflare Turnstile to check that a signup comes from a person. It loads a Cloudflare script when the home page opens, which checks signals from your browser, and your IP address goes to Cloudflare when the page opens and again when you submit. Cloudflare may set strictly-necessary cookies for security (such as bot management); these are required for the site to work safely.

How long we keep it

We keep your email until launch plus up to 12 months afterwards to send launch communications - or until you ask us to delete it, whichever comes first. The unsubscribe link in our emails stops the emails; to have your address removed from our own storage as well, ask us to delete it.

Your choices and rights

You can unsubscribe at any time - use the one-click unsubscribe link in our emails, or just email [email protected] and we'll remove you.

Under UK GDPR you also have the right to:

• access the personal data we hold about you;
• ask us to correct it (rectification);
• ask us to delete it (erasure);
• ask us to restrict how we use it;
• receive it in a portable format (portability);
• object to our use of it; and
• withdraw your consent at any time.

To exercise any of these, email [email protected]. For data tied only to your machine fingerprint (your trial record), we may need extra information from you - such as details of your purchase - to locate it, because on its own the fingerprint doesn't tell us who you are.

If you're unhappy with how we've handled your data, you can complain to the UK's supervisory authority, the Information Commissioner's Office (ICO) at ico.org.uk. We'd appreciate the chance to put things right first, so do contact us too.