Version 2026-10-17, in force from 17 October 2026.
The short version
- Your music never leaves your computer. BeatAtlas analyses songs on your own computer. We never receive your audio, song names, file names, projects or beat maps.
- To sell and license BeatAtlas we hold your name, e-mail address, country, order details and scrambled codes for each computer your key is activated on.
- Card payments are handled by Stripe. We never see your card number.
- Our website sets no tracking or advertising cookies, and we do not sell or share your data for marketing.
- You can ask to see, correct or delete your data, and you can complain to us or to the Information Commissioner's Office.
1. Who we are
1.1 ArcSeven Ltd ("we", "us") is responsible for your personal data as the controller. We are a company registered in England and Wales, company number 17277571, registered office 307 Cotton Exchange, Old Hall Street, Liverpool, L3 9LQ, England. We are registered with the Information Commissioner's Office under number ZC178598.
1.2 For anything about your data, e-mail Privacy@arcsevenlabs.co.uk or write to us at the address above.
1.3 This policy covers our website beatatlas.co.uk, buying a BeatAtlas licence, your account on our website, the BeatAtlas software's contact with our servers, and messages you send us.
2. What we collect, why, and our lawful basis
The law requires a lawful basis for each use of personal data (UK GDPR Article 6). The bases we use are: contract (we need the data to sell you a licence and let you use it), legal obligation (we must keep it by law), legitimate interests (we have a good reason that does not override your rights; see section 3), and consent (you chose to give it and can withdraw).
| What | Where it comes from | Why we use it | Lawful basis |
|---|---|---|---|
| Your name, e-mail address and country | You, at checkout | To send your licence key and order confirmation, run your account, help you with support, and reissue or move your key | Contract |
| Order details: what you bought, the price, any discount code, the date and time, the Stripe payment and customer references, refunds and disputes, and the versions of the terms you accepted | Our website and Stripe | To keep company and tax records | Legal obligation |
| To deal with refunds, chargebacks and disputes | Legitimate interests | ||
| Your consent to immediate supply: the wording you agreed to, its version and the time, and that you ticked Stripe's box accepting our terms | Our website and Stripe | To show that you asked for your key straight away and accepted the loss of the right to cancel | Legal obligation and legitimate interests |
| Country evidence: the country you chose on our website, your billing country (we copy only the country; the rest of the address stays with Stripe), the country that issued your card (not the card number), and the country of your IP address when you ordered | You, Stripe and our server | To sell only to the countries we can sell to, and as tax evidence | Legal obligation and legitimate interests |
| Card fingerprint: a code Stripe makes from your card so that the same card can be recognised. It is not your card number and cannot be turned back into it | Stripe | To spot a card that was used for an earlier chargeback | Legitimate interests |
| Licence and activation data: your licence key (we keep it only in a scrambled form, plus its last five characters), Your Licence Terms, and for each computer: scrambled codes made from five hardware details, whether it is a virtual machine, the name shown for it (for example "PC 1, added 16 Oct"), the dates of activation, each check-in and freeing it, the number of moves, the BeatAtlas version, the Windows build number, and a random identifier and public key for each Windows user's installation | The BeatAtlas software | To enforce the number of computers your key allows, run the periodic check-in, count moves, and switch keys off after a refund | Contract |
| Demo data: the same scrambled hardware codes, whether it is a virtual machine, when the demo started and ends, and a random identifier and public key for the installation | The BeatAtlas software | To give each computer one demo | Legitimate interests |
| Account sign-in: single-use sign-in links sent by e-mail (we store only a scrambled copy of each link) and a session cookie | You and our website | To let you sign in to your account | Contract |
| Account activity: a record of when your key was shown or sent again from your account page, and when you signed out everywhere, with the session it came from | Our website | To protect your key, and to see what happened if it is misused | Legitimate interests |
| IP addresses: the address your computer or browser connects from | Our server, automatically | To keep our website and licence server secure, limit abuse, and find the country of an order | Legitimate interests |
| Feedback sent from the app: your message, the e-mail address you give for a reply (if any), the BeatAtlas version and Windows build number, and (only if you tick the box) your licence state and the number of processor cores. It is linked to your licence or demo so that we can help you. Feedback has no attachments | You, from inside BeatAtlas | To answer you and improve BeatAtlas | Legitimate interests |
| Messages from our contact form or by e-mail, including privacy complaints: your name, e-mail address, topic and message, and our replies | You | To answer you | Legitimate interests |
| "Tell me when BeatAtlas is available in my country": your e-mail address, your country and the time you agreed | You | To send you that one e-mail | Consent |
| E-mails we send you: a record of each one (its kind, the address, and when it was sent and delivered) | Our server | To show that we sent your key and other messages, for example in a dispute | Legitimate interests |
| Privacy requests: what you asked us under section 9 and what we did | You | To show that we handled your request | Legal obligation |
2.1 What the BeatAtlas software sends to us. When you activate a key, the software sends the key, scrambled codes made from five details of the computer's hardware and Windows installation, whether it is a virtual machine, a random identifier and public key for the installation, the name for the computer (which you can edit), the BeatAtlas version and the Windows build number. Checking in, and starting or renewing the demo, send the same details without the key. Freeing a computer sends the identifier of that computer's activation (and, when you free one from the activation window, your key). The connection also shows us your IP address. If update checks are switched on, the software asks about once a day whether a newer version exists, sending only its version number; we keep only a daily count of these checks per version, with nothing that identifies you. The software sends nothing else on its own. It does not send your audio, song names, file names, projects, beat maps or usage statistics.
2.2 The scrambled hardware codes are worked out on your computer from details of the computer and its Windows installation, then passed through a keyed one-way function on your computer, so that the details themselves are never sent to us and are not stored on our server. The software never sends your Windows user name or your computer's name. We treat the codes as personal data, because they are linked to your licence.
2.3 What stays on your computer. BeatAtlas stores your licence and demo status on your computer so that it can work offline. This is strictly necessary for the software you asked for. It is not sent to us except as described in 2.1.
2.4 IP addresses. Our programs use your IP address while handling your request, to limit abuse and to find the country of an order, and do not write it to their logs. We keep only the network part of it (the first three of its four numbers, or the first part of a newer address) with your computer's activation, and, to limit the number of new demos from one network, a scrambled code made from it with a secret key. We find the country of an address with a database file on our own server; the address is never sent to anyone to look it up.
2.5 You need to give us your e-mail address and country to buy a licence, because we cannot sell to you or send your key without them. Everything else in the table is either collected automatically as described or optional.
2.6 We do not collect more than this. We do not buy data about you from others, and we do not use your data for advertising.
3. Our legitimate interests
Where we rely on legitimate interests, they are: keeping records to handle refunds and disputes; making sure demos and licences are not misused; keeping our systems secure; answering your messages; and improving BeatAtlas from the feedback you choose to send. You can object to these uses (section 9).
4. Decisions made automatically
4.1 When you buy, our system checks your billing country, your card's country and the country of your internet connection against the countries we sell to and the countries under United Kingdom sanctions. It refunds your payment automatically, and sends no key, when both your billing country and your card's country are outside the countries we sell to, or when either of them is a country under United Kingdom sanctions.
4.2 Our system holds an order for a person at ArcSeven to review, instead of sending the key, when the checks disagree (for example a UK billing address with a card from another country and a connection from outside the UK, or a connection from a country under sanctions), or when our payment provider's fraud checks flag the payment. A held order that nobody has decided within our checking period (7 days at present) is refunded automatically.
4.3 You can ask for a person to review any automatic refund, and give us your point of view, by e-mailing Privacy@arcsevenlabs.co.uk. We make no other decisions about you by automated means alone.
5. Cookies
5.1 Our website uses only cookies that are strictly necessary: a session cookie (ba_sess) that keeps you signed in to your account for up to 30 days, and a checkout cookie (ba_checkout) that lets the browser you paid with show your key on the thank-you page (it lasts 48 hours, and the key is shown only within 24 hours of payment). Our administrator's sign-in uses its own session cookie on the admin panel. These cookies do not need your consent, and we do not use them to track you.
5.2 We use no analytics, advertising or social media cookies, and no third-party tracking scripts. The spam check on our contact form is a small puzzle your browser solves by itself, with no cookie and no outside service. So we do not show a cookie banner.
5.3 When you pay, you are taken to Stripe's checkout page. Stripe sets its own cookies there, for example to prevent fraud. Stripe's cookie policy explains them: https://stripe.com/gb/legal/cookies-policy.
6. Who we share your data with
We share personal data only with these service providers, and only as far as they need it:
| Who | What they do | Where |
|---|---|---|
| Stripe (Stripe Payments UK Ltd) | Takes payments and refunds, and checks for fraud. Stripe is also a controller for its own legal and fraud-prevention purposes; see stripe.com/gb/privacy | United Kingdom, European Union and United States |
| Our e-mail delivery provider (a transactional e-mail service) | Sends our e-mails: order confirmations, keys, sign-in links and replies | United Kingdom or European Economic Area |
| Our business e-mail service (Hostinger, which hosts our arcsevenlabs.co.uk mailboxes) | Receives and stores the e-mails you send us and our replies, and the copies of contact-form and feedback messages our website sends us as notifications | European Union or United States, depending on Hostinger's data centre (see section 8) |
| OVH Ltd | Provides the server in London that runs our website, licence server and database | United Kingdom |
| Scaleway SAS (Object Storage) | Stores copies (backups) of our database | Paris, France |
| Our accountant | Prepares our accounts and tax returns from our order records | United Kingdom |
6.1 We may also share data if the law requires it, for example with HMRC, or to defend a legal claim.
6.2 If ArcSeven or BeatAtlas is sold to another organisation, your data may pass to it so that it can keep supporting your licence. We would tell you.
6.3 We never sell your personal data.
7. How long we keep it
| What | How long |
|---|---|
| Name, e-mail address and country | As long as you have a licence or an open account, then until the order records below are anonymised |
| Order details, consent records and country evidence | 6 years after the end of the financial year of the order, because company and tax law requires it. Then we delete your name and e-mail address and keep only anonymous totals |
| Card fingerprint | 13 months after the order, or 6 years if a chargeback on it was lost |
| Activation data for a computer | 12 months after the computer was freed or last checked in |
| Activation history (activations, moves and freed computers) | 2 years |
| Demo data | 2 years after the demo ends |
| The network part of an IP address, and the scrambled demo code made from an IP address | 30 days |
| Technical logs | Normally no more than 30 days: they are deleted as they rotate and whenever our programs are updated. Our programs' logs never contain your IP address or licence key, and show e-mail addresses only in a shortened form |
| Sign-in links and sessions | 1 day after they expire or you sign out |
| Account activity | 2 years |
| Feedback and contact messages, including privacy complaints, and the e-mails you send us | 2 years after the last message in the conversation, in our database and in our mailboxes |
| "Tell me when available" requests | Until we send the e-mail, or 12 months, whichever comes first |
| Records of the e-mails we send you | 13 months |
| Stripe's notifications about your payment | 90 days |
| Records of privacy requests | 6 years |
| Our log of administrative actions on customer records | 2 years |
Our systems delete or anonymise the data in our database automatically when these periods end, and we delete e-mails in our mailboxes on the same schedule. Copies of our database are kept as backups for up to 45 days, so deleted data disappears from the backups within that time.
8. Transfers outside the UK
8.1 Our own server is in the United Kingdom. Some providers in section 6 process data in other countries. Where they do, there is a legal safeguard: the country has UK "adequacy regulations" (as France and the other countries of the European Economic Area do), or the provider is certified under the UK-US data bridge, or the provider uses the UK's approved contract clauses (the International Data Transfer Agreement or Addendum). Stripe describes the safeguards it uses for the United States in its privacy policy.
8.2 You can ask us for details of the safeguard for any provider.
9. Your rights
9.1 You have the right to:
- access: ask for a copy of the personal data we hold about you;
- correction: ask us to correct data that is wrong or incomplete;
- erasure: ask us to delete your data. We will, except what the law requires us to keep (such as order records for tax);
- restriction: ask us to limit how we use your data while a question about it is sorted out;
- portability: ask for the data you gave us, in a common machine-readable format;
- withdraw consent at any time, where we rely on consent (the "tell me when available" e-mail). This does not affect what we did before.
9.2 You have the right to object to any use of your data based on legitimate interests (section 3). We will stop unless we have compelling reasons that override your interests, or we need the data for a legal claim.
9.3 To use any of these rights, e-mail Privacy@arcsevenlabs.co.uk. It is free. We may ask you to confirm your identity, usually by replying from the e-mail address on your order. We will reply within one month.
9.4 If you ask us to delete your data while you still have a licence, we will no longer be able to reissue or move your key, and we will tell you before we go ahead.
10. Complaints
10.1 If you are unhappy with how we have used your data, please tell us first at Privacy@arcsevenlabs.co.uk, or use the "privacy complaint" option on our contact form. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome.
10.2 You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint, helpline 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
11. Security
11.1 Our website and licence server use encrypted connections (HTTPS). Our database is on our own server in London and cannot be reached from the internet. Its backups are sent over encrypted connections to a private store that only we can open. Licence keys and sign-in links are stored only in scrambled form. Signing in to our admin panel needs a passkey (a sign-in tied to the administrator's device, which cannot be phished), and the panel has a further layer of access control. We keep a log of administrative actions on customer records for 2 years.
11.2 If a breach of security puts your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay where the law requires it.
12. Children
12.1 BeatAtlas is not aimed at children. You must be 18 or over to buy a licence. We do not knowingly collect data from children under 13.
13. Changes to this policy
13.1 The version and date are at the top. If we make an important change, we will tell customers by e-mail before it takes effect. Earlier versions are listed on our website.