privacy policy

1. what information do we collect?

personal information you disclose to us

in short: we collect information that you provide to us.

we collect personal information that you voluntarily provide to us when you register on the website, express an interest in obtaining information about us or our products and services, when you participate in activities on the website or otherwise when you contact us.

the personal information that we collect depends on the context of your interactions with us and the website, the choices you make and the products and features you use. the personal information we collect may include the following:

personal information provided by you. we collect names; phone numbers; email addresses; job titles; and other similar information.

personal information provided through social media login. when you choose to log in through facebook or other social media platforms, we may collect your name, email address, profile picture and other information you've made available on these platforms.

all personal information that you provide to us must be true, complete and accurate, and you must notify us of any changes to such personal information.

information automatically collected

in short: some information, such as your internet protocol (ip) address and/or browser and device characteristics, is collected automatically when you visit our website.

we automatically collect certain information when you visit, use or navigate the website. this information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your ip address, browser and device characteristics, operating system, language preferences, referring urls, device name, country, location, information about who and when you use our website and other technical information. this information is primarily needed to maintain the security and operation of our website, and for our internal analytics and reporting purposes.

like many businesses, we also collect information through cookies and similar technologies.

the information we collect includes:

• log and usage data. log and usage data is service-related, diagnostic usage and performance information our servers automatically collect when you access or use our website and which we record in log files. depending on how you interact with us, this log data may include your ip address, device information, browser type and settings and information about your activity in the website (such as the date/time stamps associated with your usage, pages and files viewed, searches and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called 'crash dumps') and hardware settings).
• device data. we collect device data such as information about your computer, phone, tablet or other device you use to access the website. depending on the device used, this device data may include information such as your ip address (or proxy server), device application identification numbers, location, browser type, hardware model internet service provider and/or mobile carrier, operating system configuration information.
• location data. we collect information data such as information about your device's location, which can be either precise or imprecise. how much information we collect depends on the type of settings of the device you use to access the website. for example, we may use gps and other technologies to collect geolocation data that tells us your current location (based on your ip address). you can opt out of allowing us to collect this information either by refusing access to the information or by disabling your locations settings on your device. note however, if you choose to opt out, you may not be able to use certain aspects of the services.

2. how do we use your information?

in short: we use your information to run songcleaner, to take payment for it, to support you and to keep the service safe.

we use the information we collect for these purposes:

• to provide the service: storing the audio you upload, transcribing it, finding the words you asked us to remove, separating the stems and building the cleaned track you download
• to manage your account, including sign-in through email, google or facebook, and to send the emails the service needs, such as sign-in and security messages
• to take payment for subscriptions and credit purchases, and to give you receipts and, where we issue them, invoices
• when you cancel a subscription: to record the reasons you give and any discount we offered you, so we do not offer it twice and can improve the service
• to answer your support messages
• to keep the service working and safe: error reports, logs, performance monitoring, abuse and fraud prevention, and rate limiting
• to understand how the site is used, in aggregate, so we can improve it
• to meet our legal obligations, including keeping records of the payments we receive

where the law requires a basis for using your information, we rely on: performing our contract with you (providing the service and taking payment), our legitimate interests (keeping the service secure and improving it), complying with a legal obligation (accounting and tax records), and your consent where we ask for it.

3. will your information be shared with anyone?

in short: with the companies that help us run the service, with anyone who has the link to a track you created without an account, and where the law requires it. we do not sell your information.

we share information with the providers listed in the next section, who process it to provide their services to us. a track you create without an account can be opened by anyone who has its link, and downloaded by them for five days. if you use our corporate api, we send updates about your tracks to the web address you register. we also share information when the law requires it, for example in response to a valid legal request, or to establish or defend legal claims. if the business is ever sold or reorganised, information may transfer as part of that, and this policy would continue to apply to it.

we do not sell your personal information. if you accept advertising cookies, meta receives information about your visits so we can measure and improve our ads, as section 5 explains.

4. who will your information be shared with?

in short: payment, sign-in, email, audio processing, storage, hosting, support, analytics and monitoring providers, and meta for advertising if you accept its cookies.

• stripe: payments, subscriptions, credit purchases, invoices and receipts. you enter your card number and security code on stripe's pages, so we never receive them; stripe sends us limited card details, such as the card brand, its last four digits and its expiry date
• google: sign-in with google, recaptcha on some of our forms, and sending the emails the service needs
• meta (facebook): sign-in with facebook, if you use it, and, only if you accept advertising cookies, the meta pixel. it tells meta which pages of our site you visit, when you sign up, and what you buy and for how much, so we can measure and improve our ads. meta can combine this with what it knows about you from its own services, under its own privacy policy
• audio processing providers: the speech recognition, language models and gpu machines that transcribe the audio you upload, find the words you asked us to remove and separate your track into stems
• amazon web services (aws): temporary storage of the separated stems while your track is processed, deleted automatically within about a week
• backblaze b2: our backups, and the files of tracks submitted through our corporate api
• simple analytics: website analytics, without cookies and without tracking you across sites
• help scout: our support inbox and chat widget. when you are signed in, the widget receives your name, email address, account id and plan, so we can help you faster
• sentry and grafana: error reports, performance traces, logs and metrics that tell us when something breaks. these can include details of the request and your account id or email address
• healthchecks.io: confirmation that our scheduled jobs, such as backups, ran; a failure report can include technical error details
• jsdelivr and product hunt: our pages load a script library from jsdelivr, and our upload page shows a product hunt badge, so your browser requests them from those services
• our hosting provider: running the servers the service runs on, including the storage where your audio is kept

some of these providers are outside the united kingdom, so your information may be processed abroad. we choose established providers and rely on the data protection terms in their contracts for those transfers.

5. do we use cookies and other tracking technologies?

in short: we use the cookies the site needs to work, and our payment, security and support providers use their own. we use advertising cookies only if you accept them, and our analytics does not use cookies.

• cookies we need: a session cookie that keeps you signed in, a cookie that protects our forms against cross-site request forgery, and a short-lived cookie that carries one-time messages such as confirmations
• your cookie choice: a cookie that remembers whether you accepted or rejected advertising cookies, so we do not ask on every page
• advertising cookies, only if you accept them: the meta pixel sets a cookie and sends meta the pages you visit, and when you sign up or buy something, what you bought and its price. it is never loaded before you accept, and you can change your choice at any time with the cookie settings link at the bottom of every page
• browser storage we need: your browser's session storage keeps recent page states, so the back button works
• stripe may use cookies or similar technologies on its payment pages, and google recaptcha may do so when you open a page with a protected form, both to prevent fraud and abuse
• our support widget may use cookies or browser storage, so a conversation you start stays with you
• simple analytics, which we use for site statistics, states that it uses no cookies and builds no profile of you

you can block or delete cookies in your browser settings. if you block the cookies the site needs, signing in and paying can stop working.

6. how long do we keep your information?

in short: audio is deleted on a schedule. deleting your account deletes your account details and your tracks. invoices and payment records are kept for six years, because the law requires it.

• audio you upload and the cleaned tracks we make: deleted on a schedule: 30 days after upload as standard, or 90 days on pro and unlimited plans. buying a lossless (flac) download keeps the track for at least 30 more days, and never shortens a longer plan window. our backups keep audio for a limited period after that, normally about two weeks
• tracks submitted through our corporate api: deleted 180 days after completion. we aim to complete a deletion request within 30 days; a track whose stored copies we cannot yet confirm deleted stays marked as pending until we can
• your account details: kept while your account exists. when we delete your account at your request, we also delete the tracks and audio files you created, and a daily cleanup keeps checking for, and removing, anything still written for them afterwards. our database backups, which include account details, are kept for about 90 days, and reasons you gave when cancelling a subscription are kept with the subscription reference, without a direct link to your account
• invoices and payment records, including the billing name, address, email and tax reference printed on an invoice and the amount and date: kept for six years after the end of the financial year of the purchase, or of the invoice if we issue it later, because we have to keep records of the payments we receive. this means an issued invoice survives the deletion of your account, and longer if we need it for an open tax enquiry or a dispute
• support messages: kept while we may still need them to help you
• error reports, logs and metrics: kept for a limited period, long enough to investigate faults

our data deletion page explains how to ask us to delete your account and what we keep afterwards.

7. how do we keep your information safe?

in short: we use appropriate technical and organisational measures, though no service can promise perfect security.

• the site is served over https, so traffic between you and us is encrypted
• passwords are stored as salted hashes, never in a readable form, and corporate api keys are stored as hashes too
• we never receive your full card number or security code: you enter those on stripe's pages. we keep only the limited card details stripe sends us
• your audio is stored on our servers and delivered through our own download pages. through those pages, a track created while signed in can only be downloaded by you or our staff, and a track created without an account can be opened by anyone who has its link and downloaded for five days after it was created. for corporate api tracks, the account's key is needed to get a download link, and anyone who has that link can use it until it expires after 15 minutes. the services that process audio for us reach it through a separate, authorised route
• access to production systems is limited to what is needed to run the service

no method of transmission or storage is completely secure, so we cannot promise that your information will never be accessed by someone who should not have it. if a breach affects your rights, we will tell you and the regulator where the law requires it.

8. do we collect information from minors?

in short: songcleaner is for people aged 18 or over.

songcleaner is for people aged 18 or over, and we do not knowingly collect personal information from anyone younger. if you believe a child has given us their information, email us at hello@songcleaner.com and we will delete it.

9. what are your privacy rights?

in short: you can ask for a copy of your information, correct it, delete it, or object to how we use it. you can also complain to the ico.

depending on where you live, you have some or all of these rights:

• access: ask for a copy of the personal information we hold about you
• correction: ask us to fix information that is wrong or incomplete
• deletion: ask us to delete your information, subject to what we must keep, such as invoices and payment records
• restriction and objection: ask us to stop or limit certain uses, including uses based on our legitimate interests
• portability: ask for the information you gave us in a machine-readable form
• withdrawing consent: where we rely on your consent, you can withdraw it at any time

to exercise any of these, email hello@songcleaner.com. we will respond within 30 days. if you are unhappy with how we have handled your information, you can complain to the information commissioner's office, the uk regulator, at ico.org.uk.

10. controls for do-not-track features

in short: we do not respond to do-not-track signals, because there is no agreed standard for them.

most browsers offer a do-not-track setting. no common standard exists for how a website should respond to it, so we do not act on it. our site analytics is cookieless and does not track you across other sites, and advertising cookies are used only if you accept them.

11. do california residents have specific privacy rights?

in short: yes. california residents can ask what we collect, ask us to delete it, and we do not sell personal information.

if you live in california, you may ask us what categories of personal information we have collected about you, where it came from, why we collected it and which categories of provider we shared it with, and you may ask us to delete it. we do not sell personal information. if you accept advertising cookies, the meta pixel shares information about your visits with meta for advertising, which california law may treat as sharing for cross-context behavioural advertising; you can refuse, or withdraw your acceptance, with the cookie settings link at the bottom of every page. we will not treat you differently for exercising these rights. to make a request, email hello@songcleaner.com.

12. do we make updates to this policy?

in short: yes, and the date at the top tells you when we last did.

we update this policy when the service or the law changes. the revised version applies from the date shown at the top of this page. if a change matters to how we use your information, we will take reasonable steps to tell you, such as an email or a notice on the site.

13. how can you contact us about this policy?

if you have questions or comments about this privacy policy, you may email us at hello@songcleaner.com or by post to:

songcleaner.com
20-22 wenlock road
london n1 7gu
united kingdom

how can you review, update, or delete the data we collect from you?

based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, change that information, or delete it in some circumstances. to request to review, update, or delete your personal information, please submit a request using the contacts listed above. we will respond to your request within 30 days.