Privacy Policy

Last updated: October 19, 2026

This policy covers the multiroomaudioplayer.com website, the Multi Zone Audio Player (MZAP) desktop application, and the MZAP Remote mobile app for Android and iOS (published on Google Play as “Multi Zone Audio Player Remote”). All three are operated by SaaS s. r. o., Sukennícka 19058/1, 821 09 Bratislava, Slovakia (the “data controller”), registered in Slovakia under IČO 54145970, VAT SK2121582837.

The website is a static informational site: it requires no account, sets no advertising cookies, and does not profile visitors. The desktop application requires no account either, and sends data to us only for licensing and, if you use it, the Sound Machine integration — described in detail below.

The website

What we collect

Contact form. If you use the contact form, we receive the name, email address, and message you submit. The form is protected by Cloudflare Turnstile (a privacy-preserving spam check by Cloudflare, Inc.), and your message is delivered to our mailbox through the Brevo email service. We use this data solely to answer your enquiry and keep it no longer than needed for that correspondence.

Technical data. The site is served by Cloudflare Pages. Cloudflare may process technical connection data (such as IP addresses) as necessary to deliver and secure the site. We do not receive or store server access logs ourselves.

Visit statistics. We use Google Analytics in a cookieless mode: it is configured to store nothing in your browser, so it sets no cookies, stores no identifiers on your device, and does not profile visitors. Google (Google Ireland Ltd.) receives only aggregated, cookieless pings used to count page visits.

Theme preference. Your day/night theme choice is stored in your browser’s localStorage on your device only. It never leaves your browser and is not a tracking mechanism.

The desktop application

MZAP runs on your computer. Your audio files, playlists, zones, schedules, and settings stay on your machine — we never receive them. The application contacts our licensing server only for the purposes below. When you play Sound Machine music, the application also connects directly to Sound Machine, whose own privacy policy applies to that service.

Licence activation and validation

To issue and verify a licence, the application sends:

A device identifier — a SHA-256 hash derived from your motherboard serial number and CPU identifier. It is not reversible into your hardware details, but it is stable and unique to your computer, so we treat it as personal data.
Your licence key, the application version, and the product name.
The country your request comes from, derived from your IP address.

Your IP address is used to determine the country and to apply rate limits, and is then discarded — we do not store it. We also do not collect your computer’s name, your Windows user name, or any file or media information.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). Licensing is required to provide the software you purchased, so this data cannot be opted out of while you use a licensed copy.

Free trial

Starting a trial registers the same device identifier, application version, and country, so that a trial runs once per computer per version. No name, email address, or payment details are required for a trial.

Sound Machine integration — optional

If you add a Sound Machine account to play Sound Machine music, the application sends the Sound Machine username and password to our licensing server, together with your licence (or trial) details and device identifier, whenever it needs to sign in to Sound Machine. Our server checks that your licence includes Sound Machine, signs in to Sound Machine on your behalf, and returns the session to the application. The password is passed through to Sound Machine and is never stored by us. We record the Sound Machine username, the time, and whether the sign-in succeeded, so we can investigate failed sign-ins and misuse.

On your computer, the password is stored encrypted with Windows Data Protection (DPAPI) for your Windows user. It is never written to workspace files or logs.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR), when you choose to use the Sound Machine integration.

Usage data — not collected

The application does not collect usage data. If that ever changes, it will ask for your consent first, and nothing will be collected without it.

Uninstall survey — optional

If you uninstall MZAP, the uninstaller offers a short optional survey asking why. You may select “Don’t send any data” to send nothing at all. If you answer, we receive your chosen reason, any comment you type, the application version, the device identifier, and the country. If you select “too expensive” you may optionally leave an email address so we can contact you about a discount; this is used for nothing else.

Legal basis: your consent (Art. 6(1)(a) GDPR).

How long we keep it

Licence records (key, device identifier, activation dates, order reference) are kept for as long as your licence is valid, and afterwards as required by Slovak accounting and tax law.
Trial records are kept so a trial is not repeated on the same computer.
Sound Machine sign-in records (username, time, result) are kept with your licence’s activation history.
Survey responses are kept while they remain useful for improving the product.
Licence tokens cached on your computer are short-lived (a few days) and are refreshed automatically while your licence is valid.

The MZAP Remote mobile app

MZAP Remote is a remote control for an MZAP desktop application that you run yourself. The app talks only to your own MZAP computer on your local network. It sends nothing to us or to any third party: it has no account with us, no advertising, no analytics, and no crash-reporting or tracking services.

What the app handles

Your MZAP computer’s details — its name, network address, and instance identifier — so the app can reconnect to it.
Your MZAP credentials. When you pair by QR code, the app receives an API key for the MZAP user shown in that code. When you sign in with a username and password, the password is sent only to your MZAP computer, which returns a session token; the app does not store your password. The API key or session token is stored on your phone in the operating system’s encrypted secure storage (Android Keystore or iOS Keychain).
Your preferences, such as language, light or dark theme, meter rate, filters and favorites, stored on your phone.
Information from your MZAP computer that the app displays — players, zones, track titles and cover art, and level meters. It is fetched live from your computer and is not sent anywhere else.

Permissions

Camera — used only to scan the pairing QR code shown in the MZAP desktop app. The image is processed on your phone; no photo or video is stored or sent anywhere.
Local network and Wi-Fi state — used to find MZAP computers on your network and to connect to the one you choose.

Deleting your data

Choose More → Forget host in the app to delete the stored address and credentials, or uninstall the app to remove everything it stored. To cut off a phone remotely, regenerate that user’s API key, or disable the user, in the MZAP desktop application.

Because the app does not send data to us, we hold no personal data from it. If you also use the desktop application, its section above applies to it.

Purchases

Orders are processed by our e-commerce partner PayPro Global, which acts as the merchant of record. Payment details are handled entirely by PayPro Global under its own privacy policy — we never receive or store your card number, and we do not keep your billing address or phone number.

From each order we retain only what is needed to issue and support your licence, and to meet our accounting obligations:

your name and email address, so we can issue the licence key, deliver it, and answer support requests;
the order reference, product, amount, currency, and any coupon used;
the country of the order, which we are required to record for VAT purposes.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) for issuing and supporting the licence, and our legal obligation (Art. 6(1)(c) GDPR) for invoicing records. PayPro Global holds the complete order record under its own privacy policy.

Your rights

Under the GDPR you may request access to, correction of, or deletion of personal data we hold about you; you may object to or restrict its processing; and you may ask for a copy of it in a portable format. Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out beforehand.

To exercise these rights, contact us or write to the mailing address above. For licence or trial data, quote your licence key or order number so we can find the right records — without one of these we may be unable to identify you, since the device identifier is a hash we cannot trace back to a person on its own.

Note that deleting an active licence record will deactivate the software on the associated computers, and that we must retain invoicing data for the period required by Slovak law even after a deletion request.

If you believe we have not handled your data lawfully, you may lodge a complaint with your local supervisory authority — in Slovakia, the Office for Personal Data Protection (Úrad na ochranu osobných údajov Slovenskej republiky).

Changes

We will update this page if our data practices change and adjust the date above.