Privacy Policy — StemDesk

STEMDESK PRIVACY POLICY

Version 1.0 — Effective [LAUNCH DATE]

This Privacy Policy describes how Fulks, Inc. ("Fulks," "we," "us," or "our") collects, uses, shares, and protects personal information in connection with:

the StemDesk software (the desktop application and audio plug-in suite, collectively the "Software");
the StemDesk website at [https://stemdesk.ai] (the "Website"); and
related services we provide (collectively with the Software and Website, the "Services").

This Privacy Policy applies to all users of the Services, including Free Tier users of the Software and purchasers of Pro or Studio Tier licenses.

A summary first. We've designed StemDesk to be unusually private for paid software in 2026:

The Software does not contact our servers at runtime. It does not phone home, send telemetry, check for updates automatically, or transmit crash reports.
The StemDesk plug-ins, when running inside Your DAW, make no external network connections. They communicate only with the StemDesk desktop application over Your computer's local loopback interface (127.0.0.1), and only when the desktop application is running.
License validation is performed locally. We sign License Keys cryptographically (Ed25519); Your computer verifies the signature against a public key bundled with the Software. We do not need to be contacted to verify Your license.
We do not require You to create an account. Your License Key alone authenticates Your purchase.
The only personal information we routinely process is what is necessary to sell You a license and deliver it to You by email. That information is detailed in Section 2.

The remainder of this Privacy Policy describes these and related practices in detail.

1. WHO WE ARE

Fulks, Inc. is a California corporation. Our mailing address for privacy inquiries is:

Fulks, Inc. — Privacy

c/o OC Recording Company

24433 Citrus Hill Rd

Wildomar, CA 92595

United States

Email: [privacy@stemdesk.ai]

We are the "business" with respect to personal information of California residents under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), and the "controller" with respect to personal data of individuals in jurisdictions where similar concepts apply.

2. INFORMATION WE COLLECT

2.1. Information You provide when You purchase a license

When You purchase a Pro or Studio Tier license, You provide the following information directly to Stripe, Inc. at checkout. Fulks receives only the email address and (where You provide it) the country and postal code. Fulks does not receive Your full payment card number, CVC, or expiration date.

Email address. Used to deliver Your License Key and any necessary transactional communications.
Country and (where applicable) postal code. Used by Stripe for fraud screening, tax calculation, and currency conversion.
Payment information (card number, CVC, expiration, billing details). Collected and processed exclusively by Stripe under Stripe's own Privacy Policy. Fulks does not store or have direct access to this information.

2.2. Information generated by issuing Your License Key

When we issue a License Key for Your purchase, the following information is generated and stored in our backend infrastructure (AWS Lambda + Amazon S3):

Your email address (as provided at Stripe checkout);
Your purchased Tier (Pro or Studio);
The License Key issued to You;
The Stripe transaction identifier for Your purchase;
The date and time of License Key issuance.

This information is retained for thirty-six (36) months following Your purchase, after which it is deleted, unless You request earlier deletion (see Section 6) or unless we are required by law to retain it longer (for example, for tax recordkeeping).

2.3. Information You may provide voluntarily

If You contact us by email (for customer support, refund requests, legal inquiries, etc.), we receive the contents of Your email, Your email address, and any attachments You include. We use this information solely to respond to You and to maintain support records.

If You subscribe to our newsletter or mailing list, we receive Your email address. You may unsubscribe at any time via the unsubscribe link in each email.

2.4. Information automatically collected by the Website

Our Website may use cookies, server logs, or third-party analytics services to collect technical information about Website visits. The Website's specific cookie and analytics practices are described in our Cookie Notice at [https://stemdesk.ai/cookies]. Where applicable law requires cookie consent (for example, in the European Economic Area and the United Kingdom), we present a cookie consent banner before non-essential cookies are set.

2.5. Information stored on Your device by the Software

The Software stores certain information on Your own device only. This information is not transmitted to Fulks. It includes:

Your acceptance of the EULA and this Privacy Policy (in %APPDATA%\stemdesk\legal-acceptance.json or equivalent), so the Software does not re-prompt You at each launch;
Your License Key (in %APPDATA%\stemdesk\license.json or equivalent), stored in plain-text JSON format along with the email address You provided at checkout, Your purchased Tier, the License Key issuance date, and the date of activation on Your device. We chose plain-text storage intentionally: the License Key's cryptographic signature is the authoritative verification mechanism, and on-disk encryption would not meaningfully protect against any realistic attacker who already has access to Your device. You are responsible for the security of files stored on Your own device;
Application settings, preferences, plug-in configurations, project state, presets, and rendered output that You create using the Software.

2.6. Information NOT collected by the Software

For clarity, the Software does not collect:

Usage telemetry, analytics, or feature-use metrics;
Crash reports or error reports (no crash reporter is installed by the Software);
Audio content You process with the Software (Your mixes, masters, source audio, etc.);
IP addresses (the Software does not send IP-revealing requests to Fulks servers in normal operation);
Machine identifiers, hardware fingerprints, or device serial numbers;
Information about other software installed on Your device;
Location data;
Microphone or camera input outside of audio You explicitly load into the Software for processing.

2.7. Information collected by user-initiated network features

The Software includes one feature that, when invoked by You, contacts a third-party host: the StemDesk model manager, which allows You to download AI models from the public Hugging Face repository. When You initiate a model download, Your computer connects directly to huggingface.co to retrieve the model file. This connection is between Your computer and Hugging Face; Fulks does not act as an intermediary and does not receive information about Your downloads. Hugging Face's privacy practices govern any data they collect about visitors to their service.

3. HOW WE USE INFORMATION

We use the information described in Section 2 for the following purposes:

To deliver Your purchase. We use Your email address to send You a License Key, order confirmation, and refund confirmation when applicable.
To provide customer support. We use the contents of Your email correspondence to answer Your questions, troubleshoot issues, and process refund requests.
To prevent fraud and abuse. We use Your purchase information, country, and email address to screen for fraudulent activity, chargeback abuse, and violations of our EULA and Terms of Service.
To comply with legal obligations. We retain transaction records as required by tax law, anti-money-laundering rules, sanctions screening, and other applicable laws.
To communicate material changes. We may use Your email address to notify You of material changes to the EULA, Terms of Service, or Privacy Policy.
To send You a newsletter or marketing emails, but only if You separately opt in. You may unsubscribe at any time.

We do not use Your personal information for advertising profiling, sell it to data brokers, or share it for cross-context behavioral advertising. (We do not "sell" or "share" personal information as those terms are defined under the CCPA/CPRA.)

4. WHEN WE SHARE INFORMATION

We share personal information only as described in this Section. We do not sell personal information.

4.1. Service providers (subprocessors)

We share personal information with the following third-party service providers, which act as "service providers" under the CCPA/CPRA and "processors" under similar laws. Each is contractually obligated to use Your information only to provide services to us and not for their own purposes:

Subprocessor	Purpose	Information Shared
Stripe, Inc.	Payment processing	Your payment information (You provide this directly to Stripe), purchase amount, email, country
Amazon Web Services, Inc. (AWS) — Lambda	Backend compute for License Key issuance	Your email, purchased Tier, License Key, transaction identifier
Amazon Web Services, Inc. (AWS) — Amazon S3	Storage of License Key issuance records	Same as Lambda
Amazon Web Services, Inc. (AWS) — Simple Email Service (SES)	Transactional email delivery (License Key delivery, refund confirmation)	Your email, message contents
[Website hosting provider — to be confirmed]	Hosting and delivery of the Website	Server log information (IP address, request paths, user-agent)

For details on the StemDesk website's analytics and cookie practices, see the Cookie Notice at [https://stemdesk.ai/cookies].

4.2. Legal compliance

We may disclose personal information when we reasonably believe disclosure is required to:

comply with applicable law, regulation, legal process, or government request;
enforce our EULA, Terms of Service, or this Privacy Policy;
protect the rights, property, or safety of Fulks, our users, or others;
detect, prevent, or address fraud, security, or technical issues; or
comply with subpoenas, court orders, or similar legal demands. Where consistent with applicable law and our judgment, we will notify You of such disclosure.

4.3. Business transfers

If Fulks is involved in a merger, acquisition, asset sale, financing, or similar corporate transaction, personal information may be transferred as part of that transaction. We will provide notice of any such transfer (for example, by email or a notice on the Website) and any new owner will be bound by the commitments in this Privacy Policy unless You consent otherwise.

4.4. With Your consent

We may share personal information for purposes not described in this Privacy Policy if You provide Your specific consent.

5. RETENTION

We retain personal information only as long as necessary for the purposes described in Section 3, or as required by law:

License Key issuance records (Section 2.2): retained for thirty-six (36) months from the date of purchase, after which they are deleted.
Email correspondence (Section 2.3): retained for as long as reasonably necessary to maintain support records, typically not more than five (5) years.
Newsletter subscriptions (Section 2.3): retained until You unsubscribe.
Transaction records required by tax law: retained for the period required by applicable tax law (typically seven (7) years in the United States).
Information on Your device (Section 2.5): retained until You delete it. Fulks does not have access to information stored on Your device.

You may request earlier deletion of Your information as described in Section 6, subject to legal retention requirements.

6. YOUR RIGHTS

Depending on Your location, You may have the following rights with respect to personal information we hold about You:

6.1. Rights of California residents (CCPA / CPRA)

If You are a California resident, You have the right to:

Know what personal information we have collected about You, including the categories, sources, purposes, and third parties to whom we have disclosed it.
Access Your personal information in a portable format.
Delete Your personal information, subject to legal exceptions (we cannot delete tax records we are required to keep, for example).
Correct inaccurate personal information.
Limit the use of sensitive personal information. (Fulks does not collect or use information categorized as "sensitive personal information" under the CPRA in the ordinary course of business.)
Opt out of "sale" or "sharing" of personal information. (Fulks does not sell or share personal information for cross-context behavioral advertising.)
Non-discrimination. We will not discriminate against You for exercising Your CCPA/CPRA rights.

6.2. Rights of residents of the European Economic Area, United Kingdom, and other jurisdictions

If You are located in the EEA, UK, or a jurisdiction with similar laws, You have rights similar to the above, including the right to:

access Your personal data;
rectify inaccurate data;
erase Your data (the "right to be forgotten"), subject to legal exceptions;
restrict processing in certain circumstances;
object to processing in certain circumstances;
data portability, where applicable; and
withdraw consent at any time, where processing is based on Your consent.

You also have the right to lodge a complaint with Your local data protection authority.

6.3. How to exercise Your rights

To exercise any of the above rights, contact us at [privacy@stemdesk.ai] with:

a description of the right You wish to exercise;
the email address associated with Your purchase (so we can locate Your records); and
sufficient information for us to reasonably verify Your identity. For most requests, this will be a confirmation email sent to the address on file for Your purchase.

We will respond within forty-five (45) days, or sooner where required by applicable law. We may extend this period by an additional forty-five (45) days where reasonably necessary, in which case we will notify You of the extension within the initial response period.

6.4. Authorized agents

You may use an authorized agent to submit a request on Your behalf. The agent must provide written proof of Your authorization, and we may request that You verify Your identity directly with us.

7. SECURITY

We implement reasonable administrative, technical, and physical safeguards to protect personal information against unauthorized access, disclosure, alteration, or destruction. These safeguards include encryption in transit (TLS) for communications with our backend, access controls on our AWS infrastructure, and minimization of personal information we collect.

No system is perfectly secure. We cannot guarantee absolute security. You are responsible for protecting Your License Key and any files stored on Your device.

In the event of a security incident affecting personal information, we will provide notice as required by applicable law.

8. CHILDREN

The Services are not directed to children under the age of thirteen (13), and we do not knowingly collect personal information from children under thirteen (13). Pro and Studio Tier purchases require purchasers to be at least eighteen (18) years of age (or the age of majority in their jurisdiction). If we learn that we have collected personal information from a child under thirteen (13), we will delete it promptly. Parents and guardians who believe their child has provided personal information to us may contact us at [privacy@stemdesk.ai].

9. INTERNATIONAL TRANSFERS

Fulks is based in the United States, and our service providers (including AWS, Stripe, and our website hosting provider) operate primarily in the United States. If You access the Services from outside the United States, Your personal information will be transferred to, stored in, and processed in the United States, which may have different data protection laws than Your jurisdiction.

Where required by applicable law, we rely on appropriate transfer mechanisms (such as Standard Contractual Clauses) to protect personal information transferred to the United States.

10. THIRD-PARTY LINKS AND SERVICES

The Website and Software may contain links to, or integrations with, third-party websites and services (for example, Hugging Face for AI model downloads, Stripe for payment processing). This Privacy Policy does not apply to those third parties. We encourage You to review their privacy policies before providing information to them.

11. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. When we do, we will update the "Effective" date at the top of this Privacy Policy. Material changes will be communicated by:

email to the address associated with Your purchase, where we have one on file;
a prominent notice on the Website; and
where Your continued use of the Services involves an in-Software acceptance step, an in-Software prompt requiring You to acknowledge the updated Privacy Policy before continued use.

Your continued use of the Services following the effective date of an update constitutes Your acceptance of the updated Privacy Policy. If You do not agree to an update, You may exercise the rights described in Section 6 to delete Your information and discontinue use of the Services.

12. CONTACT

If You have questions, concerns, or requests regarding this Privacy Policy or our handling of personal information, contact us at:

Fulks, Inc. — Privacy

c/o OC Recording Company

24433 Citrus Hill Rd

Wildomar, CA 92595

United States

[privacy@stemdesk.ai]