Privacy: the app

This notice says what Arietto, the program, and its licence service do with personal data, and what stays on your Mac. The website has its own privacy notice: arietto.com/privacy/. The licence terms are at arietto.com/licence-terms/.

In short

• Your music stays on your Mac. Arietto never sends your scores, your audio or what you type or say into its AI features anywhere.
• Arietto goes online for three things only:
  • at each start, it fetches a small signed licence list from arietto.com. That request carries nothing about you or your licence;
  • when you activate a licence, it sends your licence key, which contains the name and email address given at purchase, a machine code worked out from your Mac's hardware identifier, and the Mac's model name, such as "MacBook Pro";
  • when you choose "Deactivate This Mac", it sends your key and the machine code.
• No analytics, no advertising, no crash upload, no account. A check for keys shared beyond the licence is built in but switched off.
• When you buy, Paddle, which sells Arietto for us, passes us your name and email address, so that we can make your key and email it to you.
• No automatic updates. This version of Arietto never checks for updates by itself; you download new versions yourself.
• You can ask what we hold, and have it corrected or deleted: privacy@arietto.com.

1. Who is responsible

Kammerwerk Technologies GmbH, Dr. Rasper-Straße 17a/11, 4802 Ebensee am Traunsee, Austria (FN 686275 d, Landesgericht Wels), the company that makes Arietto ("we"). We are the controller for everything in this notice except what Paddle does as the seller (section 6).

Write to privacy@arietto.com about anything in this notice. A person reads every message and answers it.

2. What stays on your Mac

• Your work. Scores, parts, audio, house styles and exports are kept where you save them. Arietto sends none of them anywhere.
• The AI features. Ask Arietto, the Layout Assistant and voice input run entirely on your Mac, with language and speech models that come with Arietto (EULA §8). What you type or say stays on your Mac. On a Mac with an Intel processor these features are switched off.
• The microphone. Voice input for Ask Arietto records only while you hold the key down, turns your speech into text on your Mac and keeps no recording. macOS asks for your permission the first time. Nothing else in Arietto uses the microphone.
• Crash reports. If Arietto crashes, it writes a report on your Mac: the version, the macOS version, the error and where in the program it happened. Nothing is sent. If you send us a report with a bug, we use it only to fix the error.
• Playback runs on your Mac.
• Software you add yourself. Audio Unit plug-ins are other people's software. Arietto runs plug-ins in a separate helper program; whether a plug-in goes online is up to its maker and its own terms.

3. What Arietto keeps on your Mac

Almost all of this is in ~/Library/Application Support/com.arietto.app/. Crash reports are in ~/Library/Logs/com.arietto.app/. Language models and samples you add yourself go into ~/Library/Application Support/com.arietto.app/.

To lock the trial and activation records to this Mac, Arietto reads the Mac's hardware identifier (its hardware UUID) from macOS. For the model name it reads the "Model Name" line of macOS's hardware report, and nothing else from that report: not the serial number, and never the name you gave your computer.

Storing these records, and reading the hardware identifier for them, is strictly necessary to provide the program and the licence you asked for, so it needs no consent (§ 165 (3) TKG 2021).

4. What Arietto sends, and when

Every connection is encrypted (HTTPS). Like any connection over the internet, each one shows your IP address and the time to the server. Arietto adds nothing to these requests beyond what the table says.

If you disconnect a Mac on your licence page but leave your key on it, that Mac tries to activate again the next time Arietto starts on it, and takes a free slot back (EULA §3). Choose "Deactivate This Mac" on a Mac before you hand it on.

Nothing else is sent. Arietto has no analytics, no usage statistics, no advertising, no crash upload and no account.

The sharing check is switched off. Arietto contains a check that could send, at each start of an activated copy, the licence number, the machine code and the version of Arietto, to spot one key running on many Macs. It is switched off and sends nothing. If we ever want to switch it on, we will first change this notice and ask for your permission in the app.

No update checks. This version of Arietto cannot update itself and never asks for updates; you download new versions from arietto.com (EULA §6).

5. Your licence key, and the machine code

Your key contains the name and email address given at purchase (or in your beta application, or in your request for a licence), a licence number, the type of licence and the date it was issued. It is signed, so nobody can forge or change it. It is not encrypted: anyone who has your key can read what is in it. Your key is also the only login for your licence page (section 9). Keep it like a password, and don't publish it.

The licence window shows the email address and licence number from your key.

The machine code is a code of 16 letters and digits that Arietto works out from your Mac's hardware identifier by a one-way calculation. The same Mac always gives the same code, so the licence service can tell your Macs apart. The code does not contain the hardware identifier. But the calculation is always the same, so anyone who knows your Mac's hardware identifier can work out its code. Because we keep the code with your licence, we treat it as personal data: it does not name you, but it is linked to you.

The model name is the kind of Mac, such as "MacBook Pro" or "Mac mini". Arietto never sends the name you gave your computer, which often contains your own name.

6. Buying Arietto: Paddle, and what we receive

You buy Arietto from Paddle (Paddle.com Market Ltd, London, United Kingdom; in the United States, Paddle.com Inc.), which sells it for us. Paddle takes the payment, issues the invoice, deals with sales tax and makes refunds. Paddle is responsible for that data itself, as a separate controller, under its own privacy notice: paddle.com/legal/privacy. We never see your full card details.

For each purchase Paddle passes us your name and email address, what you bought and the order's reference. The buy page asks for your email address before the checkout and passes it to Paddle with your order, so that your key reaches you. We use them to make your key, to keep the purchase record (section 7) and to email you the key. This data comes from Paddle, not from you directly.

In Paddle's dashboard we can also see the details of your order that Paddle shows the companies it sells for, such as your country, the price and the kind of payment method. We use them only for support, refunds and our accounts.

Licences that nobody pays for. For a beta tester, the name and email address in the key come from the beta application. For a licence we give someone who takes over your Arietto (EULA §5), they come from the request.

7. The licence service: what it keeps

The licence service runs at Hetzner Online GmbH, Germany, on servers in the European Union, and is reached through arietto.com. It keeps:

• for each purchase: your name and email address, the licence number, the key, when it was issued, and Paddle's reference for the order;
• for each activated Mac: its machine code, its model name (or the name you typed on the licence page), the activation number and the time of the last activation. When you disconnect or deactivate a Mac, this entry is deleted. Only its activation number stays, on the licence list (section 8);
• the licence numbers of blocked keys, for the licence list;
• a technical log: a line for each purchase, activation and disconnection, with the time, the licence number, the machine code and the activation number. The log is deleted after 14 days.

None of these records contains your IP address. Cloudflare and Hetzner see it when they pass requests on (section 13).

8. The licence list is public

The licence list is a small signed file at arietto.com that anyone can fetch. It contains only the licence numbers of blocked licences, the activation numbers of disconnected Macs, and the date of the list. It contains no names, email addresses or machine codes. Nobody can tell from the list whose licence a number belongs to, except someone who has that key, because the key contains its own licence number. A number stays on the list for as long as the block or disconnection must keep working.

9. Your licence page

On arietto.com/license you paste your key to see which Macs it is activated on (their model name, machine code and the date of activation), to disconnect one, or to download an activation file for a Mac without internet. For that you type the Mac's machine code and, if you like, a name for it. Choose a name that does not identify you, such as "Studio iMac", because it is kept with your licence and shown wherever your key is used.

The page has no account, sets no cookies and runs no scripts. Your key travels encrypted. Anyone who has your key can use the page.

10. Emails about your licence

• Your key, right after a purchase. We send it through Postmark (section 13).
• Security fixes and updates you are entitled to, at the address on your licence, until five years after Arietto 1 is released (EULA §6). If a weakness in Arietto is being exploited, or a security incident affects it, the law also requires us to tell you and to say what you can do (Art. 14(8) Cyber Resilience Act).
• No advertising. We don't email you about new paid versions or other offers. Our emails contain no tracking pixels and no tracked links.

The key email comes from our licence service; if you reply to it, your reply goes to contact@arietto.com.

Beta testers get their key from our own mailbox, in Google Workspace.

11. Support, money back, and keys found in public

• When you write to us at contact@arietto.com, we keep the conversation so that we can answer and remember it later.
• Money back. Paddle makes the refund. Your licence then ends, and we add its licence number to the licence list (EULA §5, §7).
• A key found in public. We block it and send a new key, free of charge, to the email address on your licence (EULA §5).

12. Why we use the data, and on what legal basis

13. Who receives data

We never sell your data or pass it to anyone else, except where the law obliges us to, for example under a court order.

14. How long we keep it

15. Do you have to give us this data?

No law requires you to. But a licence works on a Mac only after that Mac has been activated, and activation sends your key and the machine code. Without activation Arietto works as a full trial for 30 days and is then read-only: it still opens, plays, prints and exports everything (EULA §4). To buy, Paddle needs your details. Nothing else is required.

16. Removing Arietto's data from your Mac

• First choose "Deactivate This Mac" (License & Activation). That frees the Mac's slot and deletes the key and the activation from it.
• Dragging Arietto to the Trash removes the program, but not its data.
• To remove all its data, open Terminal and run /Applications/Arietto.app/Contents/MacOS/Arietto --uninstall. It lists everything it would delete. Run it again with --yes at the end to delete it: the folders named in section 3, Arietto's caches, logs and crash reports, the folder an earlier test version used, ~/.lyra, if there is one, and Arietto's entries in macOS's settings, the copy of the trial record among them. It does not touch the scores you saved yourself. Then drag Arietto to the Trash.

17. No automated decisions about you

We make no decisions about you by automated means in the sense of Art. 22 GDPR. The licence rules apply automatically, as the EULA sets them out (§§3–5): a key works on two Macs; a third Mac is told that the key is already active on two; a blocked key, or a disconnected Mac, makes Arietto read-only. If you think something has gone wrong, write to us. A person will look at it and put it right.

18. Your rights

You can ask us:

• what data we hold about you, and for a copy of it (Art. 15 GDPR);
• to correct it (Art. 16). Your key cannot be changed, so to correct the name or email address in it, we give you a new key and block the old one;
• to delete it (Art. 17). If we delete your purchase record, we can no longer send you your key again or tell you about security fixes. The key itself keeps working on your Macs, because it doesn't need us. The places for your Macs stay counted as taken, with nothing left that identifies them or you;
• to restrict its use (Art. 18);
• for your data in a common, machine-readable format (Art. 20);
• to withdraw a consent you gave, with effect for the future (Art. 7(3)).

Write to privacy@arietto.com. We answer within a month.

Your right to object (Art. 21 GDPR). Where we rely on our legitimate interests (section 12: fetching the licence list, the technical logs, keeping support conversations), you can object at any time, on grounds relating to your particular situation. We then stop, unless we can show compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims.

You can also complain to a data protection authority: in Austria the Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at, or the authority in the EU country where you live or work.

19. Children

Arietto is not made for children, and we do not knowingly collect personal data from children under 14. A young musician who wants Arietto should have a parent or guardian buy and activate it. If you think a child has given us personal data, write to us and we delete it.

20. Security

Every connection is encrypted. Keys, activations and the licence list are signed, so they cannot be forged. The licence service asks for no password and keeps no IP addresses in its records. To limit how often anyone can call it, it holds a scrambled form of the caller's IP address in memory for a few minutes, and never writes it down. Only the managing director has access to the licence service, to Paddle, Postmark, Cloudflare and our email, each protected by a second factor. The licence service's records are backed up once a day, encrypted with a key only we hold, to a storage box at Hetzner in Germany; each backup is deleted after 30 days. If you find a security problem in Arietto, please tell us: arietto.com/security/, security@arietto.com.

21. Changes to this notice

When what Arietto does with data changes, we change this notice first, and the date at the top. If a change means that Arietto sends more, we tell you in the app or by email before it takes effect.