Privacy Policy

1. Who we are

EDMFeedback ("we", "us", "our") is operated as an individual/sole trader service. For data protection queries, contact us at: [email protected]

This service is operated from Norway and complies with the EU General Data Protection Regulation (GDPR) as implemented in Norwegian law through the Personal Data Act (Personopplysningsloven).

2. What personal data we collect

Account data

• Email address — collected when you register. Used to identify your account and send transactional messages (e.g. email verification). We do not send marketing emails.
• Encrypted password — stored as a bcrypt hash. We never have access to your actual password.
• Account metadata — your subscription plan, credit balance, and account creation date.

Analysis history

• Track names — the name you enter (or your filename) for each analysis you run.
• Genre selection — which genre you selected for each analysis.
• AI critique text — the written feedback generated for each analysis. This is stored so you can review it in your dashboard history.
• Date and time — when each analysis was performed.

What we do NOT collect

• Audio files — your WAV or AIFF file is either analyzed entirely in your browser (browser analysis mode) or sent to our analysis server in Germany (server analysis mode) for more accurate results. In both cases, your audio file is immediately and permanently deleted after analysis — we never store audio. Only numerical technical measurements (loudness, frequency values, BPM etc.) derived from your audio are sent to the AI. Your music is never shared with any third party.
• Payment card details — all payment processing is handled by Stripe (stripe.com). We never see or store your card number, CVV, or full payment details. We only store a Stripe subscription ID and Stripe customer ID to manage your account.
• IP addresses or usage analytics — we do not run analytics, tracking pixels, or advertising scripts.

3. Legal basis for processing (GDPR Article 6)

• Contract performance (Art. 6(1)(b)) — processing your email and account data is necessary to provide the service you signed up for.
• Legitimate interest (Art. 6(1)(f)) — storing your analysis history so you can access it later, and protecting the service from abuse.
• Legal obligation (Art. 6(1)(c)) — retaining transaction records as required by Norwegian accounting law.

4. Where your data is stored

Your account data and analysis history is stored in Supabase, with the database hosted in the EU (Ireland or Frankfurt region). Supabase is GDPR-compliant and processes data under Standard Contractual Clauses. See Supabase's privacy policy.

When you run an analysis, anonymised technical data about your track (numbers only — no audio) is sent to Anthropic's Claude API, hosted in the US. Anthropic does not use API inputs to train its models. See Anthropic's privacy policy.

Full list of data processors

We believe in full transparency about every service that touches your data:

Service	Purpose	Data shared	Location
Supabase	Auth & database	Email, analysis history, plan	EU (Frankfurt)
Anthropic (Claude)	AI feedback generation	Track measurements only (no audio, no personal data)	US
Stripe	Payment processing	Email, payment details (we never see card numbers)	US/EU
Resend	Transactional email	Email address (confirmation emails only)	US
Hetzner	Audio analysis server	Audio file (analyzed and immediately deleted, never stored)	EU (Germany)
Google Analytics 4	Usage analytics	Anonymised page views (IP anonymised, no advertising)	US
Audio analysis system	Technical & musicality analysis	Audio file processed on our EU server, immediately deleted	EU (Germany)

US-based processors operate under Standard Contractual Clauses (SCCs) as required by GDPR Article 46.

5. Data retention

• Active accounts: Your data is retained as long as your account exists.
• Deleted accounts: All personal data is deleted within 30 days of account deletion.
• Transaction records: Stripe subscription IDs and customer IDs may be retained for up to 5 years for accounting purposes under Norwegian law (Bokføringsloven).

6. Your rights under GDPR

As a user, you have the following rights:

• Right of access — you can view all your data in your dashboard at any time.
• Right to erasure ("right to be forgotten") — you can delete your account and all associated data directly from your dashboard settings. Deletion is permanent and takes effect immediately.
• Right to rectification — contact us to correct inaccurate data.
• Right to data portability — contact us to receive a copy of your data in a machine-readable format.
• Right to object — you can object to processing based on legitimate interest by contacting us.
• Right to lodge a complaint — you have the right to lodge a complaint with Datatilsynet (the Norwegian Data Protection Authority) at datatilsynet.no.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Cookies

We use one functional cookie: a session token set by Supabase when you log in. This cookie is strictly necessary for the service to function and does not require consent under ePrivacy rules. We do not use advertising cookies, tracking cookies, or third-party analytics cookies.

8. Children

This service is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has registered, please contact us and we will delete the account.

9. Changes to this policy

If we make material changes to this policy, we will notify registered users by email at least 14 days before the changes take effect.

10. Analytics & your choices

We use Google Analytics 4 to understand how people use EDMFeedback — which pages are visited, how long analyses take, and where users drop off. This helps us improve the service. We do not use advertising tracking, remarketing, or any third-party ad networks.

Google Analytics anonymises your IP address before storage. We have configured it with anonymize_ip: true and do not share data with advertisers.

You can change your analytics preference at any time:

11. Contact

For any privacy-related questions: [email protected]