Privacy Policy

Who is responsible for your information

Enoch is written, published and sold by an individual. The responsible party (called a data controller under European law) for the personal information described in this policy is:

Responsible party

Sipumzo Trueman Lucwaba, an individual trading as Enoch, in the Republic of South Africa

Business address

222 Smit Street, Braamfontein, Johannesburg, 2001, Gauteng, South Africa

Information Officer

Sipumzo Trueman Lucwaba, reachable at [email protected]

General enquiries

[email protected]

Website

enochmusic.co.za

Where this policy says we, us or our, it means that person. Because Enoch is published by an individual rather than a company, the responsible party and the Information Officer are the same person, registered with the Information Regulator (South Africa) as the Protection of Personal Information Act 4 of 2013 (POPIA) requires. If you have a question, a request about your information, or a complaint, write to the address above.

What this policy covers

This policy applies to:

• the Enoch application for macOS and for Windows, however you obtained it — from the Mac App Store, through Apple's TestFlight beta programme, or from the Microsoft Store, including a test release we share with a private audience;
• the Enoch website and any pages from which Enoch is described, distributed or sold; and
• support, sales and beta correspondence between you and us.

It does not cover the practices of Apple or Microsoft, of any third-party plug-in or sound library you choose to load into Enoch, or of any other website we link to. Those are governed by their own privacy policies, and clauses 8, 10 and 11 explain where the line falls.

In this policy, personal information means personal information as defined in POPIA and, where it applies to you, personal data as defined in the EU and UK General Data Protection Regulations (GDPR).

How Enoch works

Enoch is a desktop application, not a cloud service. When you write music in Enoch, everything — the notation engine, the layout engine, playback, the mixer and the assistant — runs on your own computer. Your scores are ordinary files saved wherever you put them.

No server is involved in using Enoch. Your scores do not reach us, and we do not measure which features you use.

The Enoch application contains no analytics or telemetry software, no advertising or marketing technology, and no third-party tracking components of any kind.

What we never collect

• The musical content of your work. Your scores, parts, lyrics, arrangements, recordings and exports are yours. Enoch does not upload them, index them, analyse them on our servers, or use them to train any model.
• Your keystrokes, your editing history or your feature usage. Enoch does not report how you use it.
• Your card number or payment details. Enoch is sold only through app stores — the Mac App Store and, for the Windows version, the Microsoft Store — and the store takes every payment. We never see your card or your store account.
• Special personal information in the POPIA sense — your health, race, religion, political persuasion, sexual orientation, trade-union membership, biometrics or criminal record. We do not ask for it.
• Information about children — see clause 17.

We also do not sell personal information, and we do not share it for cross-context behavioural advertising.

Personal information we collect

What we hold depends entirely on how you interact with us. Most Enoch users appear in category (a) only — which is to say, we hold nothing about them at all.

(a) When you simply use the app

Nothing reaches us. Enoch stores several things locally on your computer so that it can behave like a normal application: your preferences and workspace settings, the list of recently opened scores, the paths of any soundfonts or plug-ins you have chosen, any articulation maps you import or capture for a plug-in, your licence or trial status, and — if Enoch has crashed — diagnostic reports written to a folder inside Application Support on a Mac, or inside your local application-data folder on Windows. All of this stays on your device, under your control, and is deleted when you remove Enoch and its support files. We have no access to any of it unless you deliberately send it to us with a support request.

The Enoch application makes no network connections of its own. Checking a purchase is done by the store's own software on your computer — Apple's StoreKit, or the Microsoft Store on Windows. The links in Enoch — to this policy, to support, or to Apple's or Microsoft's subscription settings — open in your web browser or in the store.

(b) When you install from the Mac App Store or TestFlight

Apple, not us, distributes the app and processes the transaction. In doing so Apple collects information under Apple's own privacy policy, and gives us a limited amount of it:

• Sales and download reports — aggregate, non-identifying figures such as units, territory, and app version.
• App analytics — aggregate, anonymised measurements Apple derives only from users who have consented to share analytics with developers. We cannot identify anyone from these.
• Crash reports — where you have enabled Share with App Developers, Apple gives us crash logs containing device model, macOS version and a technical stack trace. These describe the software's failure, not you, and they contain no part of your scores.
• TestFlight only — if you join a beta, Apple gives us the email address you used to accept the invitation, together with your installation status and any feedback, screenshots or comments you choose to submit through TestFlight. We use this solely to run the beta and to contact you about it, and we delete it when the beta programme closes.

(c) When you install from the Microsoft Store

Microsoft, not us, distributes Enoch for Windows and processes the transaction. In doing so Microsoft collects information under Microsoft's own privacy statement, and shows us a limited amount of it in Partner Center, its dashboard for app publishers:

• Acquisition and usage reports — aggregate figures such as downloads, purchases, market, Windows version and device type. We cannot identify anyone from these.
• Health reports — where your Windows diagnostic-data settings allow it, Microsoft tells us about Enoch's crashes and hangs: when they happened, the device type and model, the Windows build, the Enoch version and a technical stack trace, and occasionally a crash file from a Windows Insider build. These describe the software's failure, not you, and we use them only to find and fix the fault.
• Ratings and reviews — reviews you choose to post in the Store are public, under the name your Store profile shows. We may reply to them publicly.
• Test releases only — if we invite you to try a release before it is public, we add the email address of your Microsoft account to a private test group in Partner Center. We use it solely to run the test and to contact you about it, and we delete it when the test closes.

(d) When you buy Enoch Composer

Enoch Composer is sold only as an in-app purchase through the Mac App Store (and, for the Windows version, the Microsoft Store). The store takes the payment and keeps the purchase record, and the app confirms the purchase with the store directly. The store reports sales to us in aggregate, without identifying the buyer. We do not take payments or sell Enoch directly.

(e) When you visit our website

Our website is a set of static pages hosted by Cloudflare, Inc. (Cloudflare Pages). Like nearly all websites, the host records ordinary technical information in its server logs — your IP address, browser and device type, the pages you viewed, the referring page, and the date and time — under its own privacy terms and retention period.

The website uses Google Analytics 4 to measure visits, pages viewed, engagement time, referring websites, approximate geographic location, score-preview plays, score-download clicks and clicks leading to the App Store. Google Analytics uses cookies to distinguish browsers and visits. Our custom events contain the public score title and identifier, the page path and the button location; they do not contain the contents of scores you create in Enoch. Google Signals and advertising personalisation are disabled in our website tag. This website analytics is separate from the Enoch application, which contains no analytics SDK.

See Google’s privacy policy and how Google uses data from partner sites. You can manage cookies in your browser or use Google’s Analytics opt-out browser add-on. There is no website account or sign-up form.

(f) When you contact us

If you email us — for support, or to report a bug — we receive whatever you send: your name and email address, the content of your message, and any files, logs, screenshots or scores you choose to attach. Attachments are used solely to reproduce and fix the problem you reported.

Why we process it, and on what legal basis

We process personal information only where the law permits. Under POPIA that means section 11; where the GDPR applies to you, it means Article 6.

Where we rely on legitimate interests, we have weighed our interest in running and improving Enoch against your right to privacy, and we use the least amount of information that achieves the purpose. Where we rely on your consent, you may withdraw it at any time — see clause 14.

Permissions Enoch asks your computer for

Enoch asks your computer for very little. In every case the data stays on your computer, and refusing simply disables that feature.

• MIDI devices — so you can enter and record notes from a keyboard or controller and send playback to external instruments.
• Files and folders — Enoch reads and writes only the files you choose through the standard macOS or Windows open and save dialogs, plus its own settings and support folder. When you attach a video or audio file to a score, Enoch remembers where that one file is (on a Mac, by keeping the access macOS gave it), so the score can find it again next time.
• Printing — through the standard macOS or Windows print dialog.

Enoch does not ask for access to your microphone, camera, contacts, photos or location, and it does not record audio from any input: recording in Enoch captures the notes you play over MIDI.

On a Mac, you can review or revoke any of these at any time in System Settings → Privacy & Security. On Windows, Enoch runs as an ordinary desktop application, which Windows does not ask you to approve feature by feature; the microphone, camera and location settings in Settings → Privacy & security are ones Enoch never uses.

Plug-ins and sound libraries you add yourself

Enoch can host third-party instruments and effects — Audio Units on a Mac, VST3 plug-ins on Windows — and can load sound banks you supply. Those products are not ours. Their handling of information is governed by their own vendors' privacy policies, not this one.

Some commercial sample libraries and plug-ins contact their vendor's servers — to check a licence, register an activation, or download content. When that happens it is the plug-in doing it, using its own network connection and its own terms, and we neither see nor control what is sent. If this concerns you, read the privacy policy of each plug-in you install.

The Enoch assistant and on-device processing

The first release of Enoch does not include the assistant; it arrives in a later update. When it does, it will answer questions about the score you have open — its harmony, voicing and instrumentation included — and prepare changes to it, applied only when you confirm them. Its language model already ships inside the application, unused until then. The following applies to the assistant:

• Every musical conclusion is reached by Enoch's own notation and theory engines, running on your computer.
• The language model that phrases the answers is bundled inside the application and runs entirely on your device. It is not a hosted service.
• No question you ask, and no part of your score, is sent to us, to Apple, to Microsoft, or to any AI provider. The assistant works with no network connection at all.
• Your conversation with the assistant is held in memory for the session and is not written to our systems.
• Nothing you write in Enoch is used to train any model, ours or anyone else's.

Who we share information with

We do not sell personal information, and we do not disclose it to anyone for their own marketing. We share it only with operators (called processors under the GDPR) who perform a service for us under contract, and only to the extent they need it:

• Apple Inc. and its affiliates — distribution, payment and beta testing through the Mac App Store and TestFlight.
• Microsoft Corporation and its affiliates — distribution, payment and test releases of Enoch for Windows through the Microsoft Store and Partner Center.
• Cloudflare, Inc. (Cloudflare Pages) — serving our website's static pages, and keeping its own server logs.
• Google (Google Workspace) — carrying and storing our email and support correspondence.
• Google (Google Analytics) — website usage measurement described in clause 5(e).
• Our professional advisers — accountants, auditors and lawyers, where they need it to advise us.

We also disclose information where the law requires it — to a court, a regulator, or a law-enforcement authority acting under proper legal authority — or where it is necessary to establish, exercise or defend a legal claim, or to protect someone's safety. If our business or its assets are ever sold or transferred, personal information may transfer with it; we would tell you before that happened, and this policy would continue to apply until you were told otherwise.

Every operator we use is bound by a written contract to process personal information only on our instructions, to keep it confidential, and to protect it with appropriate security measures, as POPIA sections 20 and 21 require.

Sending information outside South Africa

Some of the providers in clause 10 are based outside South Africa, or store information on servers outside it — commonly in the United States, the European Union, the United Kingdom or Ireland. Personal information you give us may therefore be processed in those countries.

Where that happens, we transfer it only on a basis permitted by POPIA section 72 — because the recipient is subject to a law, binding corporate rules or a binding agreement that gives an adequate level of protection, because the transfer is necessary to perform our contract with you, or because you have consented. Where the GDPR applies, we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses, together with any additional safeguards those require.

You may ask our Information Officer for details of the safeguards applying to a particular transfer.

How long we keep it

We keep personal information only for as long as we have a reason to, and no longer:

• Invoices and transaction records — for at least five years, as South African tax and companies legislation requires.
• Purchase records — Apple and Microsoft keep these. The sales reports they give us are kept with our accounting records.
• Support correspondence — for up to 24 months after the matter is closed, so we can follow up on a recurring fault.
• Beta and test-release records (TestFlight, and Microsoft Store test groups) — deleted when the beta or test closes.
• Website server logs — kept by our host, not by us, for the period its own privacy policy sets. We do not copy or analyse them.

When information is no longer needed for any of these purposes, and no law requires us to keep it, we delete it or de-identify it so that it can no longer be linked to you.

Security, and what happens after a breach

We take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, and unauthorised access or processing, as POPIA section 19 requires. In practice that means encryption in transit, access limited to the people who need it, multi-factor authentication on the accounts that hold personal information, reputable providers chosen for their own security posture, and keeping as little personal information as possible.

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and every affected person as soon as reasonably possible after discovering it, as POPIA section 22 requires, and we will tell you what happened, what it means for you, and what we recommend you do. Where the GDPR applies, we will also meet its 72-hour notification requirement.

Your rights

You have rights over your personal information, and exercising them is free in most cases. Under POPIA you may:

• Ask what we hold — request confirmation, free of charge, that we hold personal information about you, and a copy of it (sections 23 and 24).
• Have it corrected or deleted — require us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or to destroy a record we are no longer authorised to keep (section 24).
• Object to processing — object, on reasonable grounds, to processing we carry out on the legitimate-interest basis (section 11(3)).
• Withdraw consent — at any time, where we relied on your consent. Withdrawing does not affect what we lawfully did before you withdrew.
• Object to direct marketing — at any time, unconditionally (section 11(3) and section 69).
• Complain — to us, and to the Information Regulator (clause 15).

If the GDPR or UK GDPR applies to you, you additionally have the rights of access, rectification, erasure, restriction of processing, data portability, and objection under Articles 15 to 22, and the right to lodge a complaint with your own supervisory authority.

If you are a California resident, you have the rights to know, delete, and correct personal information, and to opt out of its sale or sharing, under the California Consumer Privacy Act. As stated in clause 4, we do not sell or share personal information, so there is nothing to opt out of; the other rights are available to you on the same terms as everyone else's, and we will not discriminate against you for exercising them.

To exercise any right, email our Information Officer at [email protected]. We may need to verify who you are before we act, so that we do not disclose your information to someone else. We will respond as soon as reasonably possible and in any event within 30 days, or within one month where the GDPR applies. POPIA requires certain access requests to be made on the prescribed Form 2, and we will send you that form if it applies.

How to complain

You may raise a concern with us first. You may also complain to the Information Regulator at any time.

Regulator

The Information Regulator (South Africa)

Address

Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Telephone

+27 10 023 5200 (toll-free 0800 017 160)

POPIA complaints

[email protected], or online at eservices.inforegulator.org.za

General enquiries

[email protected]

Website

inforegulator.org.za

If you are in the European Economic Area or the United Kingdom, you may instead complain to the data protection supervisory authority in the country where you live or work, or where you believe a breach occurred.

Direct marketing

We do not send marketing email, and we keep no mailing list. If we ever start one, we will ask for your consent first, as POPIA section 69 requires, and update this policy before we do.

Any marketing email we send would carry an unsubscribe link that works, and you could also ask us to stop by writing to [email protected]. We would act on it promptly and at no cost to you. Service messages — a reply to your support request, a security notice, or notice of a change that affects you — are not marketing.

Children

Enoch is a professional tool intended for adults, and our website and sales channels are not directed at children. We do not knowingly collect personal information from a child under 18 without the consent of a competent person, as POPIA section 34 requires, nor from a child under 13 in the United States without verifiable parental consent.

The Enoch application collects no personal information from anyone who uses it (clause 5(a)). This clause concerns our other dealings: joining a beta, contacting support, or subscribing to email. If you believe a child has given us personal information in one of those ways, write to our Information Officer and we will delete it.

Automated decision-making

We do not make any decision about you that produces legal effects or similarly significantly affects you, based solely on automated processing, including profiling. Enoch's assistant makes musical suggestions about your score; it makes no decisions about you.

Changes to this policy

We will update this policy when Enoch changes or the law does. The version number and the last updated date at the top of this page always show the current edition.

If a change materially affects your rights or how we handle your information, we will do more than change the date — we will say so on our website and, where we hold your email address and the change warrants it, tell you directly before it takes effect. Where a change requires your consent, we will ask for it rather than assume it.

Contact us

Questions about this policy, requests about your information, and complaints all go to the same place:

Information Officer

Sipumzo Trueman Lucwaba

Privacy email

[email protected]

Support email

[email protected]

Post

222 Smit Street, Braamfontein, Johannesburg, 2001, Gauteng, South Africa

Telephone

+27 76 605 9137

We aim to acknowledge every privacy enquiry within five business days.