Privacy Policy

The controller for your personal data is Sascha Wagner, Steckfeldstraße 62, 70599 Stuttgart, Germany, sichatmusic@gmail.com. This policy explains what Artifex Studio collects, why, and what rights you have under the GDPR.

• Account data — email address and a hashed password (or your chosen sign-in method), your workspace name, and your plan.
• Content you upload — audio, images, video, lyrics, and artist details.
• Generated output — the images, videos, and text the Service produces for you, plus the prompts and settings used.
• Usage and billing records — credit transactions, generation and job history, and subscription status. Payment card data is handled by Stripe; we never receive it.
• Technical logs — request and error logs needed to operate and debug the Service.
• How you use the studio — if, and only if, you agree: which screens you open and which controls you use inside the app, together with a session identifier that is discarded when you close the tab. We do not record what you type, the contents of your pages, or your mouse movements.
• Public resource analytics — on the public Resources pages, Vercel Web Analytics records aggregated page views, referring page, approximate region, device type, operating system, browser, and named interactions such as opening a related article or the signup page. It uses no cookies and does not associate the data with a Studio account, named person, or persistent cross-site identifier.
• Operational records — render jobs and their outcomes, errors, and which AI model produced a given asset at what cost. These are kept whether or not you allow usage analytics, because they are how the Service is run and billed.
• Messages you send us — if you use the contact form, we store your name, email address, subject and message, together with your IP address and browser user-agent. You do not need an account to write to us.

We do not use advertising trackers, we do not sell personal data, and we do not build advertising profiles.

• To provide the Service (Art. 6(1)(b) GDPR — performance of a contract): running your account, storing your media, generating output, metering credits.
• To take payment (Art. 6(1)(b)): subscriptions and top-ups via Stripe.
• To keep the Service secure and working (Art. 6(1)(f) — legitimate interests): abuse prevention, rate and quota enforcement, debugging.
• To understand which features are worth building (consent — Art. 6(1)(a) GDPR, together with § 25(1) TTDSG for storing the session identifier in your browser). Nothing is stored on your device and no usage is recorded until you agree, saying no changes nothing about how the Service works, and you can withdraw at any time under Settings → Usage analytics with immediate effect. Withdrawing also clears the session identifier.
• To understand which public articles are useful (Art. 6(1)(f) — legitimate interests): aggregated, cookie-free page and interaction analytics on the Resources section. Vercel derives a short-lived hash from the request for daily aggregate statistics and discards it after 24 hours; it does not store a tracking identifier on your device.
• To keep the Service running and correctly billed(Art. 6(1)(b) and 6(1)(f)): render and error logs, and the record of which model generated what at which cost. These write nothing to your device, so § 25 TTDSG does not apply to them, and they are not part of the analytics consent above.
• To answer you (Art. 6(1)(b) where your message concerns a contract or a prospective one; otherwise Art. 6(1)(f) — our legitimate interest in replying to enquiries). The IP address and user-agent stored with a message are kept under Art. 6(1)(f) to defend the form against automated abuse, since it accepts submissions from anyone.
• To meet legal obligations (Art. 6(1)(c)): tax and accounting retention of invoices, and operating a contact channel under § 5 DDG.

To generate output, the content and prompts needed for a given request are sent to the AI provider you selected for that task. Some providers are in the United States; those transfers rely on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

We use paid API tiers, under which the providers act as processors on our instructions and do not train their models on your content. We do not control their internal retention windows; see their own policies for detail.

Your content and generated output are kept while your account is active. When your account is deleted we delete your content and media within 30 days, except where we must keep records longer: invoices and billing records are retained for the statutory period (10 years under German tax law), and technical logs are kept for up to 90 days.

Usage-analytics events are kept for 12 months and then deleted. Render and error logs are kept for 90 days. Records of what was generated, with which model and at what cost, are kept for as long as the account exists, because they underpin your credit balance and our invoices.

Public Resources analytics remain aggregated and are not linked to a Studio account. Vercel discards the short-lived visitor hash after 24 hours; aggregate reporting is retained according to the Web Analytics plan in force.

Contact-form messages are kept for up to 24 months after the matter is closed, so we can follow up on an earlier conversation, and then deleted. If your message becomes part of a contract or an invoice, the statutory retention above applies to that record instead.

You have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable form (Art. 15–21 GDPR). You can export your media from the app at any time. Account deletion is currently handled on request by email — we action it within 30 days.

To exercise any right, email sichatmusic@gmail.com. You also have the right to complain to a supervisory authority — in Germany, the data protection authority of your federal state.

Media is stored in a private object-storage bucket and served only through short-lived signed URLs. Workspace data is isolated per organisation and enforced at the database level. Access to production systems is restricted to the operator.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as required by Art. 33–34 GDPR.

The Service is not intended for anyone under 16. We do not knowingly collect data from children; if you believe we have, contact us and we will delete it.

We will post updates here and, for material changes, notify you by email or in the app before they take effect.