Privacy policy
Last updated: [DATE]
This policy explains what we collect, why, and what you can do about it. The short version: your music is not uploaded, we collect very little, and we do not sell anything about you.
1. Who is responsible
The data controller is [YOUR FULL NAME OR COMPANY], [ADDRESS], [COUNTRY]. For any privacy question, write to [CONTACT EMAIL].
2. Your audio stays on your device
This is the most important point. When you use the studio, your audio file, cover art and background image are read and processed by your own browser. They are never transmitted to us, never stored on our servers, and never seen by anyone else. The video is produced on your machine and downloaded directly to it.
The exception is a release page you deliberately create: those files are uploaded and stored, because the page has to serve them to visitors.
3. What we collect
If you create an account
- Your email address, used for signing in and for messages about the service.
- Your artist name and the address of your public page.
- A cryptographic hash of your password. We never store the password itself and cannot recover it.
- Your plan and, if you buy one, the record of that purchase.
If you publish a release
- The audio file, cover art, title and any streaming links you supply.
- A count of page views for that release.
When anyone uses the studio
We record anonymous usage events: that a studio session was opened, that a track was loaded, that an export started, finished or failed, and which template was used. These carry no information about the file itself — not its name, not its contents, not its length. They exist so we know which templates are worth improving and where the tool is failing.
Technical data
Like any website, our servers process IP addresses and browser information in order to serve pages, apply rate limits and prevent abuse. Server logs are kept for a limited period and then discarded.
4. Cookies
We set one essential cookie to keep you signed in and to protect forms against cross-site request forgery. It is required for the service to function and carries no advertising identifier.
If analytics or advertising are enabled on this site, those services set their own cookies under their own policies; where the law requires consent, we will ask before they load.
5. Why we process this data, and on what basis
| Purpose | Legal basis |
|---|---|
| Providing your account and release pages | Performance of a contract |
| Processing payments for paid plans | Performance of a contract |
| Keeping the service secure and preventing abuse | Legitimate interests |
| Understanding which features are used | Legitimate interests |
| Service emails about your account | Performance of a contract |
| Optional marketing emails | Consent, withdrawable at any time |
6. Who else sees it
We do not sell personal data and we do not share it for anyone else's marketing. We use a small number of service providers who process data on our behalf:
- Our hosting provider, which stores the database and uploaded files.
- Our email provider, which delivers messages to you.
- Our payment provider, which handles purchases. Card details go to them directly and never reach us.
- Analytics or advertising services, where enabled.
We may also disclose data where legally required.
7. Where data is stored
Data is stored on servers in [COUNTRY OR REGION]. Where a provider processes data outside your region, appropriate safeguards such as standard contractual clauses apply.
8. How long we keep it
- Account data: for as long as your account exists, and deleted after you close it.
- Published releases: until you delete them or close your account.
- Anonymous usage events: retained in aggregate; they are not linked to an identifiable person after your account is deleted.
- Payment records: as long as tax and accounting law requires.
9. Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its processing, receive a portable copy, and withdraw consent. Write to [CONTACT EMAIL] and we will respond within the period the law allows, normally one month.
If you are in the EU, UK or a country with a comparable regime and you are unhappy with our response, you may complain to your national data protection authority.
10. Security
Passwords are hashed with bcrypt. Traffic is encrypted with HTTPS. Forms are protected against cross-site request forgery, sign-in attempts are rate limited, and a content security policy restricts what code may run on our pages. No system is perfectly secure, but we take this seriously and fix problems quickly. If you find a vulnerability, please tell us at [CONTACT EMAIL] before disclosing it publicly.
11. Children
PulSound is not directed at children under 16. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes
If we change this policy materially, we will notify account holders before the change takes effect. The date at the top always shows the current version.
13. Contact
[YOUR FULL NAME OR COMPANY]
[ADDRESS]
[CONTACT EMAIL]