Demo store terms and privacy

1. Provider and purpose

This demo store is provided by Webglobe Webdesign & Development, enterprise number BE 1023.233.303, established in Landen, Belgium.

Its primary purpose is to show prospective customers, including SMEs, a working ecommerce solution with accounts, a catalogue, cart and checkout flow. The guitar plugins and downloadable files are demonstration material only and incidental to that presentation.

2. Demo, prices and payments

All products, prices, orders and payments are fictitious. No real payment is collected, no purchase contract is formed, and there is no entitlement to availability, support, updates or a commercial service level.

Amounts, discounts, VAT and totals are simulated demo values only. A test order does not produce an invoice or payment receipt. The 'Start test payment' button opens a test flow only and creates no obligation to pay.

The amounts actually due, actually received and actually refundable are each EUR 0.00. A fictional amount creates no refund claim; this is without prejudice to mandatory statutory rights.

The test flow requires a separate acknowledgement that you understand its demo nature. That acknowledgement is not consent to immediate performance against payment, is not a waiver of a withdrawal right and does not waive any other mandatory right.

Do not enter real card, bank or other sensitive payment details. If the demo makes an audio product downloadable, its use is governed by the separate Webglobe audio product licence.

3. Account and security

• Provide accurate information and keep your password confidential.
• Registration, account activation, login and MFA require technically necessary session, CSRF and security cookies and a reliable client IP for account security. This is separate from the voluntary statistics choice.
• Use only your own account and report suspected security incidents to info@webglobe.be.
• If you are under 18, use the demo only with permission from a parent or legal guardian.

4. Prohibited use

You must not misuse the demo. Prohibited conduct includes:

• spam, phishing, harassment, deception or other unsolicited communication;
• hacking, bypassing security, exploiting vulnerabilities or attempting unauthorised access;
• malware, harmful code, automated attacks, scraping that burdens the service, or attempts to circumvent rate limits;
• misusing accounts, systems, data, intellectual property or the rights of others;
• any other unlawful, fraudulent, harmful or disruptive use.

5. Availability, suspension and changes

This is a demonstration environment. Features, content and availability may change or be discontinued without prior notice.

Webglobe may temporarily restrict or block an account or session in the event of abuse, a security risk or breach of these terms.

6. Intellectual property and liability

The design, code, marks, text, images and demo products remain protected by applicable intellectual-property rights. Downloadable VST3, amp/cab-sim and IR products are governed solely by the separate Webglobe audio product licence; ownership is never transferred.

The demo is provided as available and without a commercial product warranty. To the extent permitted by law, Webglobe is not liable for loss caused by demo content, fictitious transactions or temporary unavailability. Mandatory statutory rights remain unaffected.

7. Governing law and contact

Belgian law applies, without prejudice to mandatory rights available to you under applicable law.

Questions or comments can be sent to info@webglobe.be.

1. Controller

Webglobe Webdesign & Development, enterprise number BE 1023.233.303, established in Landen, Belgium. Privacy questions and requests: info@webglobe.be.

2. Data, purposes and legal bases

• Account and demo: username, name and email are required for login, addressing, verification and account messages. A telephone number is voluntary and used only when you want telephone contact; it is not a login or unique identifier. We do not request age or birth year. The password hash, account status and last login support authentication and security. Legal basis: performance of the terms and steps taken at your request.
• Signature: your signed name, time, language, document versions, hashes and an exact text snapshot of the accepted terms to make acceptance demonstrable and auditable. A material new terms version produces a separate evidence record. Legal basis: performance of the agreement and our legitimate interest in evidence and dispute management.
• Security: session and device characteristics, IP address, user-agent, route, time and security events for authentication, rate limiting and abuse prevention. When external session location is enabled, IPinfo may receive the login IP once per authentication session to provide an approximate country, region and city. Webglobe retains the original login IP and this bounded result with the active session until it expires or is revoked. Provider failure does not block account access and location never controls device identity, risk or authentication. Legal basis: our legitimate interest in protecting users and systems.
• Recognized devices: after successful authentication we separately retain a hash of the random device code, bounded browser and operating-system labels, and the latest approximate country, region and city. No IP address or full user-agent is retained in this history. It helps you recognize a device, but is not an active session, never grants access and never skips MFA. You can forget a device yourself; the record is also erased with the account and otherwise no later than 365 days after it was last recognized. Legal basis: our legitimate interest in transparent account security.
• Abuse prevention after account deletion: after an explicit self-service deletion, we temporarily retain only a secret-keyed HMAC fingerprint of the normalised email address, deletion and cooldown times, and a limited cycle counter. We do not retain the email address itself, a user ID or an IP address for this purpose. A first re-registration is possible after 3 days; a second deletion within 90 days causes a 7-day wait, a third 30 days, and a fourth cycle waits until the 90-day window has ended. The record is then erased automatically. Legal basis: our legitimate interest in preventing automated account abuse.
• Administration notice on activation: when a store account is fully activated, authorised Webglobe administration receives an internal inbox message and a transactional email containing the username and email address. This enables operational follow-up of new registrations. The internal message is retained for no more than 90 days; if the account is deleted sooner, identifying fields in that message are anonymised immediately and unsent attempts are stopped. Legal basis: our legitimate interest in secure account and service administration.
• Cart: your browser stores selected fictitious products locally to provide the requested shopping experience. For signed-in users, the cart is also synchronised in a limited server-side record so a requested reminder can be performed. We intentionally process no real payment details.
• Cart reminder: only when you activate the separate, unticked checkbox do we use your email address, language and current fictitious cart to send no more than one reminder after the displayed delay. Legal basis: your consent. You can disable it in the cart before sending and unsubscribe through every reminder email.
• Wishlist: when you save a product for later while signed in, we link the product and saved time to your account. This is necessary to keep the wishlist you requested available across your devices. A purchased product is removed automatically. Legal basis: performance of the account feature you requested.
• Newsletter: visitors and users may voluntarily provide their email address and language; first and last names are optional. The address becomes active only after the one-time confirmation link is used (double opt-in). We retain request, confirmation and unsubscribe times to manage consent. When unsubscribing, you may voluntarily provide one or more fixed reasons and a short explanation; this feedback helps improve the newsletter and is retained with the limited unsubscribe record. Personal open and click measurement only takes place after separate optional consent. We then record per delivered campaign whether and when the email was opened, counts and which Webglobe link was clicked; the newsletter statistics do not store an IP address or device data for this. You can disable measurement through every newsletter without unsubscribing. Open data may be inaccurate because of mail privacy and image proxies. Legal basis: your consent.
• Optional usage analytics: only after you allow analytics do we measure page views and visible time on a page. For approximate location, the IP address may be sent to IPinfo in a bounded request; Webglobe does not retain the raw IP in analytics. For signed-in accounts, we link login frequency, active days, visited dashboard pages and PWA installation/open events to the account. Installations use a pseudonymised random installation ID; we do not store the local token itself. Purpose: learning from and improving this demo project. Legal basis: your consent, which you can withdraw through cookie preferences.

3. Recipients and transfers

Only authorised Webglobe administration and necessary, contractually bound service providers may obtain access. Hosting, database, backup and security providers support the service. Brevo processes transactional account, invitation, newsletter and explicitly requested cart email. IPinfo may receive an IP address for separate session-location enrichment and, after consent, for analytics location.

We do not sell personal data. If a provider processes outside the European Economic Area, we use a valid transfer mechanism where required, such as an adequacy decision or Standard Contractual Clauses, with additional safeguards where necessary.

4. Retention

Unactivated demo accounts are automatically erased after 7 days. An active, non-privileged demo account without an order, product entitlement or ownership adjustment is automatically erased after 24 months without a login. Accounts with such contractual or audit records are excluded from that blind TTL: after deletion, only records with a demonstrable valid retention reason and without direct account identifiers remain. You can remove wishlist items earlier yourself. Unconfirmed guest newsletter requests without an account link or previous delivery history are removed by daily maintenance after 7 days without a new request or change. A newsletter confirmation link expires after 48 hours; unsubscribed addresses are retained in a limited form to honour the opt-out and can be fully erased. Individual newsletter opens and clicks, optional usage and page analytics are kept for no more than 180 days. An app installation is shown as active when it was installed or opened during the last 90 days; browsers provide no reliable uninstall signal. Invitation tokens expire after 72 hours. With 'stay signed in on my own device', customer sessions last at most 7 days. This choice is initially selected and can be unchecked on a shared device. After email verification, the browser profile can be trusted for at most 30 days; a later visit does not extend that deadline. For administrators and powerusers, a device-bound session verified by TOTP or recovery lasts at most 7 days and ends after 48 hours of inactivity. Without persistent sign-in, the inactivity limit is 30 minutes with an 8-hour absolute limit. New privileged sign-ins and critical actions require the applicable additional verification. Sign-out, account security changes and revocation can end access earlier. A cart reminder is rescheduled after a cart change, cancelled after checkout and sent no more than once per 30 days. Security logs are normally kept for no more than 90 days, except where an incident requires limited longer retention.

Recognized-device records are erased no later than 365 days after the device was last recognized. You can forget a store device earlier yourself; this also revokes any email-MFA trust for that device. You must sign out an active session separately.

In Account Privacy you can download your data as JSON and erase your demo account yourself. The action erases account features and account-linked newsletter and analytics data. Only a demonstrated retention obligation or legal-claims basis can justify retaining a minimised pseudonymised record. Pseudonymised records may still be personal data. This notice concerns Freq Forge; Kook & Ko has a separate customer environment and privacy procedure.

5. Your rights

You can exercise access, rectification and erasure directly through your dashboard. For restriction, objection, additional access or portability where applicable, email info@webglobe.be; we may ask for proportionate proof of identity and normally respond within one month.

You may also lodge a complaint with the Belgian Data Protection Authority at dataprotectionauthority.be. Acknowledging this notice does not waive any privacy right.

6. Cookies, security and changes

Necessary session, CSRF and security cookies are technically required for registration, account activation, login and MFA. For those account actions Webglobe must also be able to determine a valid client IP through the trusted proxy chain for authentication, rate limiting and abuse prevention. Without those necessary cookies or a reliable client IP, the account action is not processed.

This is a mandatory technical condition and acknowledgement, not consent to optional analytics. A previous refusal of statistics remains unchanged and does not prevent access to public pages.

Optional statistics are separately controlled through Cookie preferences in the shop. This choice covers the main website and both shops, including the described account-linked usage measurements for Freq Forge and management accounts. Personal newsletter measurement requires a separate choice. We pass no consent for personal provider open tracking per Brevo recipient. Delivery diagnostics and any non-personal provider statistics remain separate and depend on the actual provider settings.

You enable push notifications separately. We associate the push address, protected technical delivery keys and limited browser/device labels with your account to deliver requested service messages through your browser’s push service. This is not marketing permission. The subscription remains active until you disable it, the provider reports it permanently invalid, or you erase your account. Revoke it through your account and browser settings. Notifications may be visible on a shared lock screen.

Webglobe uses measures including access control, password hashing, transport encryption, CSRF protection, rate limiting and security logging. Material changes are communicated clearly. When the terms of use change materially, we separately request renewed acceptance; this is not consent to optional data processing.

7. Retention and local storage clarification — 11 October 2026

Withdrawing newsletter measurement or unsubscribing immediately removes personal counts and open/click dates. Click details are removed in bounded batches; the existing periodic cleanup completes any remainder. Minimal consent, unsubscribe and delivery evidence is separate from measurement details.

Account erasure removes the profile and access. Completed transactions retain only necessary pseudonymous records; free ownership and financial notes are minimized. Unresolved financial cases require a separately reviewed rights request. A minimized residual account is not automatically anonymous.

Separately from the temporary 90-day cooldown, we keep an email HMAC to recognize a deleted account when restoring an old backup and prevent reactivation. This remains personal data. The limited list serves only recovery; we review it monthly and remove an entry once all recoverable copies that could contain the old account have expired and no separately justified incident or claim hold remains. The actual backup cycle determines its expiry, not the cooldown.

The local cart and related reminder/synchronization preferences expire after 30 days without cart changes and are cleaned up on subsequent use. Existing carts receive a single bounded migration period. The optional PWA installation identifier rotates after at most 180 days and is removed earlier on withdrawal. The cookie policy contains the full inventory.

Undelivered security exports are retained locally for at most 90 days. For a batch with an unknown receipt outcome, expired personal data is removed and only a limited integrity commitment remains; export recovery then requires review. No receipt acknowledgement is invented. Separate incident preservation needs a limited case file and a reviewed expiry.