Privacy Policy

1. Controller

The data controller for the personal data processed via the SoundAssist platform is SoundAssist, a sole proprietorship (eenmanszaak) established in the Netherlands and registered with the Dutch Chamber of Commerce (KvK) under number 96380241.

Business

SoundAssist (eenmanszaak)

KvK number

96380241

Address

Gedempte Nieuwesloot 50A, Alkmaar, the Netherlands

Contact

info@soundassist.online (A. Schrama, founder)

2. What we collect

Account data

Email address, display name, optional avatar/banner image, optional bio, and your birth year. Most of this is used to identify your account, show your profile to collaborators, and send you transactional email. Your birth year is collected once at signup solely to verify the 16+ minimum age (GDPR Art. 8); it is stored on your account, is not shown on your profile, and is used only for that age check.

Audio + files you upload

Audio masters, mixes, references, artwork, and any other files you add to your library or shared folders. Stored in our object storage subprocessor (Cloudflare R2, EU region pool for EU originators) and accessible to you and any collaborators you share with.

Collaboration metadata

Folder memberships, comments, activity stream entries (e.g. “a collaborator uploaded a track to a shared folder”), session presence (who is currently in a live room).

Feedback and support messages

When you send us feedback, a bug report, or a feature request through the in-app form, we keep the message (with your account) so we can follow up and track that every report gets an answer. Deleted immediately when you delete your account; resolved reports are also cleaned up about thirteen months after they are answered.

Active days

When you are signed in, we record the calendar days on which you used the platform (one entry per day; just the date, nothing else: no pages visited, no actions, no IP address). We use this on a legitimate-interest basis to see whether the platform is worth returning to. Automatically deleted after 90 days (the cleanup runs weekly), and immediately when you delete your account.

Play events

When a track is played, we record the track, the time, the country your network location resolves to (never your IP address), and which part of the site the play came from. If you are signed in, the play is also linked to your account so the track’s owner can see who their listeners are; if you are not signed in, the play stays anonymous. See section 3 for why, and for your listening visibility choice.

Email delivery events

For each transactional email we send (signup confirm, password reset, magic link, invite, weekly digest), we store the recipient (hashed), email type, delivery status (sent / delivered / bounced / complained / opened / clicked), and timestamp. See section 5 for retention.

Server + access logs

Vercel (our hosting provider) records request URLs, IP addresses, and response codes for operational and security purposes. These logs are retained per Vercel’s policy and are not joined with your account profile by us.

Bot / abuse protection

Anonymous forms (signup, project intake, mastering intake, and public feedback) are protected by Cloudflare Turnstile, which receives your IP address and browser challenge signals to score whether the request is automated. This runs on a legitimate-interest basis (keeping the platform free of bots and abuse); we do not store your IP address for this purpose.

Usage analytics (consent-based)

If, and only if, you opt in via the cookie-consent banner, we collect cookieless, aggregate usage analytics (page views and a small set of product funnel events such as “intake submitted”) via Vercel Analytics, plus sampled performance traces via Sentry. No advertising identifiers, no cross-site tracking, no personal profile. You can withdraw consent any time on the Cookies page.

Crash + error reports

When the application throws an unexpected error, we collect a stack trace, route path, browser version, and build commit SHA via Sentry. This crash reporting runs on a legitimate-interest basis (keeping the product working) independently of analytics consent. Personally identifying information is scrubbed before transmission (sendDefaultPii: false); additional categories (email addresses, IP addresses, JWT tokens, API keys) are stripped by our server-side redactor before any log line leaves the process.

Payment data (when applicable)

If you subscribe to a paid plan, billing details (email, last 4 of card, billing address, transaction history) are processed by Stripe. We never see or store your full card number.

3. Why we process it

We only process your personal data where the GDPR gives us a lawful basis to do so. Each purpose below maps to a basis under Article 6(1):

• Contract performance (GDPR Art 6(1)(b)): delivering the platform you signed up for: account management, file storage, collaboration features, transactional email.
• Legitimate interests (Art 6(1)(f)): operating, securing, and improving the platform: error monitoring, abuse prevention, deliverability monitoring (bounce/complaint rates), DNS authentication checks.
• Legal obligation (Art 6(1)(c)): retaining bounce/complaint records to demonstrate compliance with email-provider anti-abuse requirements (Yahoo, Google bulk-sender requirements).
• Consent (Art 6(1)(a)): cookieless usage analytics + performance tracing, optional cookies, marketing communications if you sign up for them, and any optional features we may offer in future (for example, audio transcription), which will be opt-in if and when we enable them. Withdrawable at any time.

Play events (see section 2) let a track’s owner see how their work is listened to on a legitimate-interest basis: totals over time, the countries plays come from, and a top-listeners list of signed-in listeners. You appear in that list only while you keep “Show me as a listener” on. You can turn it off at any time on your Privacy settings page, which removes you from every owner’s list right away. Your plays then still count in the track’s totals, just without your name shown; the stored play records themselves stay linked to your account until they expire or you delete your account. We keep play events for 400 days, then delete them automatically.

4. Who we share it with

We share personal data only with the subprocessors listed on our Subprocessors page, each under a written Data Processing Agreement (GDPR Art 28). We do not sell personal data. We do not share it with advertisers.

Collaborators you explicitly invite to a shared folder, session, or track will see the data you share with them (audio files, comments, your display name). Removing a collaborator stops further access but does not retroactively remove copies they may have downloaded before removal.

Platform operations, safety and moderation. SoundAssist’s platform operator (today: our founding mastering engineer) can access content on the platform, including tracks shared to a private circle, when that is needed to give you support you asked for, to review reports of abuse or illegal content, or to handle legal obligations such as copyright (DMCA) complaints. This access exists so there is always a human who can reach the work and assist; it is never used for advertising or shared with anyone else. Every time the operator uses this access on circle-private content, the platform records it (which track, when), so that access is accountable rather than invisible.

5. How long we keep it

Account data

Retained for as long as your account is active. After account deletion, account-identifying data is removed within 30 days, with the exception of records we are legally required to retain (e.g. billing records).

Audio + files

Retained while your account is active. Deleted within 30 days of account closure. Files explicitly removed by you are deleted from active storage immediately and from backup storage within 35 days.

Email delivery events

90 days for routine events (sent, delivered, opened, clicked, failed). 13 months for bounce and complaint events — required by email-provider compliance policies (Yahoo + Google bulk-sender). Raw webhook payloads are nulled after 30 days to minimise stored metadata.

Play events

400 days, then deleted automatically (a daily cleanup). If you delete your account, your listening link is removed from the stored plays immediately.

Crash + error reports

90 days in Sentry (subprocessor default), then deleted.

Server + access logs

Retained per Vercel’s policy (currently 30 days for function logs).

Billing records

Invoices and payment records are retained for 7 years to meet the Dutch fiscal retention obligation (bewaarplicht). Under the Algemene wet inzake rijksbelastingen (Art 52 AWR) read with the General Data Protection Regulation Implementation Act, businesses must keep their administration; including invoices and records that bear on VAT and income tax; for 7 years. We keep this data for that period even after you close your account, then delete it. Once billing goes live, the exact VAT-records period (and whether any records carry a longer statutory period) is being confirmed. (draft wording; under legal review)

6. Your rights

Under the GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”) — request deletion of your account and associated personal data.
• Restriction — ask us to limit how we process your data while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
• Lodge a complaint — with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.

To exercise any of these rights, email info@soundassist.online. We respond without undue delay and in any event within one month of receiving your request, in line with Article 12(3) GDPR. Where a request is complex or you have made a number of requests, we may extend this by up to two further months; if we do, we will tell you within the first month and explain why. Acting on a verified rights request is free; if a request is manifestly unfounded or excessive we may charge a reasonable fee or decline to act, and we will tell you why and how to complain.

7. International transfers

Some of our subprocessors are based outside the European Economic Area. Transfers to those subprocessors are governed by the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework. See the Subprocessors page for per-subprocessor location and certificate details.

8. Cookies + similar technologies

See our Cookies page for the list of cookies + storage keys we use and how to opt out where applicable.

9. Security

We apply industry-standard technical and organisational measures: encrypted transport (HTTPS), encryption at rest where supported by the subprocessor, row-level access control on the database, secret rotation, dependency scanning (Dependabot), static analysis (Semgrep) in CI, and a server-side log redactor that strips secrets and PII before any log line leaves the process. Security disclosures: info@soundassist.online.

10. Children

The platform is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data to us, please contact info@soundassist.online so we can delete it.

11. Changes to this policy

We may update this policy from time to time. The current version always lives on this page, with the “Last updated” date at the top and a short summary in the Changes list below. For changes that materially affect how we handle your personal data; for example a new purpose, a new category of data, a new subprocessor in a new country, or a longer retention period; we will give you advance notice by email to your registered address at least 30 days before the change takes effect, so you have time to review it and, if you disagree, exercise your rights (including closing your account). Where a change introduces or alters processing that relies on your consent, we will ask for fresh consent rather than relying on notice alone. Minor edits such as typo fixes, clearer wording or updated links take effect when posted.