Privacy policy

01Data we process

We process the minimum data needed to run the service and to be able to improve it.

• —Identity and access: email, name and picture if your identity provider supplies them. Authentication is handled by Firebase Authentication (Google).
• —Agency data: name, billing email and country, members and roles.
• —Work content: briefs, editorial decisions, brand sonic profiles, generated pieces, provided lyrics and purchased licences. Lyrics you upload remain yours: they are not reused for other accounts and do not enter any sonic profile as reusable material.
• —Usage and billing: product events, economic records of purchases and licences, and Stripe payment identifiers (never the card number, which never reaches our systems).
• —Anti-fraud: hashes of IP and device at sign-up, to detect abusive multi-accounting. We store the hash, not the original value.
• —Public engine contact details: if you try the engine without an account and leave us your email to receive the full decision, we store that email alongside the brief and the campaign you arrived through, so we can write to you and measure the funnel.

02What we do not keep

Two platform features handle material that never reaches our servers or is discarded immediately:

• —The track you upload for diagnosis is analyzed in memory and discarded: it is not stored, it never enters any production, and we acquire no rights over it. We only record its measurements (duration, pulse, dynamics).
• —The video you load to hear the pieces against the picture never leaves your browser: it is not uploaded or stored.

03What we use them for

To provide the service and perform the contract: creating your account, producing decisions and music, charging for and delivering briefs and licences.

To comply with legal obligations, in particular accounting and tax duties arising from invoicing.

On legitimate interest grounds: security, abuse prevention and product improvement.

04Improving the service with usage data

We use briefs, decisions and outcomes — which take you pick, what you iterate, what you end up licensing — to improve the quality of the platform's editorial decisions.

One agency's content is never shared raw with another or shown to third parties. Learnings drawn from your account that affect other agencies are always aggregated and anonymised.

If you would rather your content were not used to improve the service, write to us and we will exclude it from those processes without affecting your use of the platform.

05Providers

We share data only with the providers needed to operate, and only what is strictly necessary in each case.

• —Firebase (Google) — authentication.
• —Language model providers — receive the brief text and brand profile to produce the editorial decision.
• —Audio generation providers — receive the musical specifications derived from the decision.
• —Stripe — payments and billing.
• —Object storage provider (S3) — audio, bundles and licence PDFs.
• —Transactional email provider — deliveries, invitations and account notices.

06Retention

We keep your account data for as long as the account stays active. You can close the agency or your account yourself from Settings, in the danger zone, without asking us.

On closure, work content — briefs, decisions, takes, brands and projects, audio files included — is deleted immediately, and the agency name and your personal details are replaced with anonymous values. Closing your account also deletes your identity at the authentication provider.

Economic records and billing data are retained for as long as accounting and tax rules require, even after the account is closed. They survive with no personal data attached.

07Your rights

You may access, rectify, erase, restrict or object to processing, and request portability of your data, by writing to hello@musicsupervaisor.com.

You may also complain to the Spanish Data Protection Agency if you believe your request was not handled properly.

08International transfers

Some providers are located outside the European Economic Area. In those cases the transfer relies on the European Commission's standard contractual clauses or on an adequacy decision.

09Cookies

We use strictly necessary first-party cookies: the session, the active agency, the chosen language and the temporary identifier that lets you recover a brief created before signing up.

We do not use advertising or third-party tracking cookies.