Privacy Policy

a) Account & Authentication
When you create an account, we store your email address and authentication credentials via Supabase Auth. This data is required to identify you, manage your account, and secure access to your analyses.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

b) Uploaded Audio Files
When you submit a song for analysis, your audio file is temporarily stored on our servers for processing. The file passes through our analysis pipeline (tempo, key, genre, lyrics, instruments, virality, etc.) and the resulting analysis data is stored as a JSON report linked to your account.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

c) Analysis Results
The results of each analysis (tempo, key, loudness, genre classification, lyrics transcription, instrument detection, virality prediction, etc.) are stored and linked to your account so you can access them at any time.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

d) Credits & Payment Data
We track your credit balance (credits purchased and credits used). Payment transactions are processed by LemonSqueezy. We do not store credit card numbers or full payment details on our servers — only the transaction reference, purchased credit amount, and timestamp received via webhook.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

e) Waitlist
If you sign up for our waitlist, we collect your email address solely to notify you when Songbrain becomes available.
Legal basis: Art. 6(1)(a) GDPR — your consent.

f) Server Logs
Our hosting providers (Vercel for the landing page, our own server for the application) may collect technical data such as IP addresses, browser type, and access timestamps. This data is used for security and debugging purposes only.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in security and stability.

• We do not use tracking cookies or analytics tools (no Google Analytics, no Facebook Pixel).
• We do not build advertising profiles or share data with ad networks.
• We do not store your full payment details (handled entirely by LemonSqueezy).
• We do not retain uploaded audio files longer than necessary for analysis.

We use the following third-party services:

• Supabase (US/EU) — Authentication and user management.
• LemonSqueezy (US) — Payment processing and credit purchases.
• Vercel (US) — Hosting of the landing page.

These providers act as data processors on our behalf. Where data is transferred to the US, it is protected by EU Standard Contractual Clauses (SCCs) or equivalent safeguards.

• Account data: Stored as long as your account is active. Deleted upon account deletion request.
• Uploaded audio files: Automatically deleted after analysis is complete (cleanup worker runs based on TTL).
• Analysis results: Stored as long as your account is active.
• Payment records: Retained for the legally required period (10 years under German tax law, § 147 AO).
• Waitlist emails: Stored until you unsubscribe or request deletion.
• Server logs: Deleted after 30 days.

Under the General Data Protection Regulation, you have the following rights:

• Right of access (Art. 15) — Request a copy of all personal data we hold about you.
• Right to rectification (Art. 16) — Correct inaccurate or incomplete data.
• Right to erasure(Art. 17) — Request deletion of your personal data ("right to be forgotten").
• Right to restrict processing (Art. 18) — Limit how we use your data.
• Right to data portability (Art. 20) — Receive your data in a machine-readable format.
• Right to object (Art. 21) — Object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)) — Withdraw any previously given consent at any time.

To exercise any of these rights, contact us at info [at] songbrain [dot] ai. We will respond within 30 days.