Privacy Policy

StudioPilot is a product of DCD development, a sole proprietorship registered in the Netherlands (Chamber of Commerce / KvK no. 84599774, Jacques Tatilaan 42, 1325 RK Almere), which is the data controller for the personal data processed through the Service. Contact: privacy@studiopilot.tech.

• Account data: username, email address (required; verified at sign-up), hashed password.
• Payment data: processed by Stripe. We store your Stripe customer ID and subscription status. We never store full card numbers. For tax calculation and invoicing, Stripe also collects your billing country/address and, for business customers, your VAT identification number.
• Usage data: generation prompts, style tags, credit balance, generation history, timestamps, IP addresses.
• Technical data: browser type, device fingerprint (for demo rate limiting), operating system, referral URLs, your browser's user agent string.
• Advertising identifiers: the ids that let us tell which ad brought you here, held in cookies: _fbp and _fbc (set by Meta), _ttp (set by TikTok), and ttclid and sp_fbclid (set by us, from the link you arrived on). Our Cookie Policy lists these and the rest that Meta and TikTok set, with how long each one lasts.
• Audio data: audio files you upload for analysis or transformation. Generated audio is stored on our servers for as long as your account exists, and may be cached on third-party CDNs.

• To provide and operate the Service (contract performance).
• To process payments and manage subscriptions.
• To enforce rate limits and prevent abuse (legitimate interest).
• To improve the Service, fix bugs, and develop new features (legitimate interest).
• To send transactional emails (password reset, billing); no marketing without consent.
• To measure our advertising, so we know which ads bring people here (legitimate interest). This runs by default, both in your browser and from our own servers. Turning it off in the cookie banner stops the browser side; the events our servers send to Meta and TikTok carry on. Section 4 sets out exactly what is sent, and you can object to it at any time.
• To comply with legal obligations.

We share data with:

• Music and audio processing providers: generation prompts and uploaded audio are sent to third-party services that generate music and transform audio. Our current provider for music generation and for the project timeline is Suno, Inc. Audio you upload and audio generated for you is stored on that provider's infrastructure for as long as your project exists there, and removing a project inside StudioPilot removes it from your list here without deleting the underlying audio at the provider. These providers may process data outside the EU/EEA. This data is shared only to perform the processing you request; we do not use your uploaded audio or generated content to train models.
• Stripe: payment and billing data.
• Hosting providers: server infrastructure and CDN services.
• Advertising partners: TikTok Technologies and Meta Platforms Ireland receive events about what you do here, so we can measure our ads: the pages you open, clicks on our download and app links, sending us a message, creating an account, starting a checkout, and completing a purchase, with the plan and the amount on the last two. Your email address is hashed with SHA-256 before it leaves us, and the same hash serves as your account id. That happens when you register or buy, and also as soon as you type an address into the installer email box or the contact form. The rest travels as it is, because these networks can only match on the exact value: the Meta ids _fbp, _fbc and our own sp_fbclid, the TikTok ids _ttp and ttclid, your IP address, your browser's user agent string and the address of the page you were on.
• Google: we load Google Tag Manager, the container that fires the tags above in your browser. It runs on the page, so Google sees the request that loads it and the browser events we put on its data layer.

Those events leave by two separate routes, and the cookie banner only reaches one of them. Declining in the banner, or via "Cookie settings" in the footer, stops the pixels running from that moment on, stops new advertising cookies being set, and stops your browser handing us the cookie ids above. Two limits on that. The pixels load as soon as the page is ready, which can be before you have answered the banner, so declining stops what follows rather than what already happened. And nothing we do deletes a cookie already on your device; your browser settings do that. Separately, it does not stop our servers: when you register, start a checkout or complete a purchase, our own servers send that event straight to Meta and TikTok whether you accepted or declined. What goes with it in that case is your hashed email address and, for the account and checkout events, your IP address, your user agent and the page address. An ad blocker does not stop this either, because it is not sent from your device. If you want it stopped for you, email privacy@studiopilot.tech and we will treat it as an objection under section 6.

We do not sell your personal data. We may disclose data if required by law or to protect our rights.

• Account data is retained until you delete your account.
• Generation history stays in your account until you delete it or we do. There is no automatic expiry.
• A copy of the audio you upload is kept in a per-account archive so we can check what was sent. It is not deleted on a schedule.
• Server logs are rotated daily and kept for seven days. Analytics events are kept for 90 days.
• Payment records are retained as required by tax law (typically 7 years).
• The advertising click ids we set ourselves sit in your browser for 90 days (sp_fbclid) and 30 days (ttclid). Our Cookie Policy lists every advertising cookie with its lifetime, including the ones Meta and TikTok set.
• Events we have already sent to Meta and TikTok are kept by them, under their own retention rules, which we do not control.

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data ("right to be forgotten").
• Restrict or object to processing.
• Data portability.
• Withdraw consent at any time (where processing is based on consent).
• Lodge a complaint with a supervisory authority (Autoriteit Persoonsgegevens in the Netherlands).

To exercise these rights, email privacy@studiopilot.tech. We will respond within 30 days.

Your data may be transferred to and processed in countries outside the EU/EEA, including the United States. Three things go there: the prompts and audio our music and audio providers process, the servers and CDNs that host the Service, and our advertising measurement. To be exact about that last one: the events in section 4 are sent to graph.facebook.com and business-api.tiktok.com, both United States endpoints, even though the Meta company named in section 4 is an Irish one. We rely on Standard Contractual Clauses (SCCs) and adequacy decisions where applicable to safeguard these transfers.

We implement reasonable technical and organizational measures to protect your data, including encryption in transit (TLS), hashed passwords (bcrypt), and access controls. However, no system is 100% secure, and we cannot guarantee absolute security.

The Service is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy at any time. The updated version will be posted on this page with a new "Last updated" date. Continued use of the Service constitutes acceptance of the updated policy.