Privacy Policy

The controller for your personal data is Sascha Wagner, Steckfeldstraße 62, 70599 Stuttgart, Germany, sichatmusic@gmail.com. This policy explains what Artifex Studio collects, why, and what rights you have under the GDPR.

• Account data — email address and a hashed password (or your chosen sign-in method), your workspace name, and your plan.
• Content you upload — audio, images, video, lyrics, and artist details.
• Generated output — the images, videos, and text the Service produces for you, plus the prompts and settings used.
• Usage and billing records — credit transactions, generation and job history, and subscription status. Payment card data is handled by Stripe; we never receive it.
• Technical logs — request and error logs needed to operate and debug the Service.
• How you use the studio — if, and only if, you agree: which screens you open and which controls you use inside the app, together with a session identifier that is discarded when you close the tab. We do not record what you type, the contents of your pages, or your mouse movements.
• Public resource analytics — on the public Resources pages, Vercel Web Analytics records aggregated page views, referring page, approximate region, device type, operating system, browser, and named interactions such as opening a related article or the signup page. It uses no cookies and does not associate the data with a Studio account, named person, or persistent cross-site identifier.
• Operational records — render jobs and their outcomes, errors, and which AI model produced a given asset at what cost. These are kept whether or not you allow usage analytics, because they are how the Service is run and billed.
• Weekly email replies — if you turn on the weekly “What’s new?” email for an artist, we store the text of your replies (without the quoted email), the sender address, and the timeline changes each reply made, so they can be shown back to you and undone.
• Messages you send us — if you use the contact form, we store your name, email address, subject and message, together with your IP address and browser user-agent. You do not need an account to write to us.
• Cancellations and withdrawal declarations — a cancellation sent through “Verträge hier kündigen” is stored like a contact message and confirmed to you by email. When you ask us to start a purchase before the withdrawal period ends, we record that declaration with its time in the audit log and email you a confirmation. Both are kept as contract records (Art. 6(1)(b) and (c) GDPR) for the statutory retention period.

We do not use advertising trackers, we do not sell personal data, and we do not build advertising profiles.

• To provide the Service (Art. 6(1)(b) GDPR — performance of a contract): running your account, storing your media, generating output, metering credits.
• To take payment (Art. 6(1)(b)): subscriptions and top-ups via Stripe.
• To keep the Service secure and working (Art. 6(1)(f) — legitimate interests): abuse prevention, rate and quota enforcement, debugging.
• To understand which features are worth building (consent — Art. 6(1)(a) GDPR, together with § 25(1) TDDDG for storing the session identifier in your browser). Nothing is stored on your device and no usage is recorded until you agree, saying no changes nothing about how the Service works, and you can withdraw at any time under Settings → Usage analytics with immediate effect. Withdrawing also clears the session identifier.
• To understand which public articles are useful (Art. 6(1)(f) — legitimate interests): aggregated, cookie-free page and interaction analytics on the Resources section. Vercel derives a short-lived hash from the request for daily aggregate statistics and discards it after 24 hours; it does not store a tracking identifier on your device.
• To keep the Service running and correctly billed(Art. 6(1)(b) and 6(1)(f)): render and error logs, and the record of which model generated what at which cost. These write nothing to your device, so § 25 TDDDG does not apply to them, and they are not part of the analytics consent above.
• To answer you (Art. 6(1)(b) where your message concerns a contract or a prospective one; otherwise Art. 6(1)(f) — our legitimate interest in replying to enquiries). The IP address and user-agent stored with a message are kept under Art. 6(1)(f) to defend the form against automated abuse, since it accepts submissions from anyone.
• To meet legal obligations (Art. 6(1)(c)): tax and accounting retention of invoices, and operating a contact channel under § 5 DDG.

To generate output, the content and prompts needed for a given request are sent to the AI provider you selected for that task. Some providers are in the United States; those transfers rely on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

We use paid API tiers, under which the providers act as processors on our instructions and do not train their models on your content. We do not control their internal retention windows; see their own policies for detail.

You can connect an artist’s Instagram professional account, Facebook Page, TikTok account or YouTube channel. Studio then posts the videos you choose, at the time you choose, and nothing else. Connecting is always your own login on the platform’s site; Studio never sees your password there.

For each connected account we store: the platform’s account id, the name, handle and profile picture it reports, the permissions you granted, and the access tokens the platform issued. Tokens are encrypted (AES-256-GCM) before they are stored and are never shown in the app, to AI agents or to other members. For every post we keep a record of where it went, when, its link on the platform and any error the platform returned.

AI agents (an MCP client you connect, or Studio’s assistant) can post to an account only after you allow it for that account, and never to TikTok, which requires a person to post each video.

Disconnecting deletes the tokens immediately. Where the platform offers it (TikTok, YouTube) we also revoke Studio’s access on their side; for Instagram and Facebook, remove Studio under Settings → Apps and websites (Instagram) or Business integrations (Facebook). Posts already published stay on the platform until you delete them there.

YouTube. Studio uses YouTube API Services to upload to your channel. By connecting YouTube you agree to the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy. You can revoke Studio’s access at any time on the Google security settings page.

The platforms’ own policies apply to what you post there: Meta (Instagram, Facebook) and TikTok.

Your content and generated output are kept while your account is active. When your account is deleted we delete your content and media within 30 days, except where we must keep records longer: invoices and billing records are retained for the statutory period (10 years under German tax law), and technical logs are kept for up to 90 days.

Usage-analytics events are kept for 12 months and then deleted. Render and error logs are kept for 90 days. Records of what was generated, with which model and at what cost, are kept for as long as the account exists, because they underpin your credit balance and our invoices.

Public Resources analytics remain aggregated and are not linked to a Studio account. Vercel discards the short-lived visitor hash after 24 hours; aggregate reporting is retained according to the Web Analytics plan in force.

Contact-form messages are kept for up to 24 months after the matter is closed, so we can follow up on an earlier conversation, and then deleted. If your message becomes part of a contract or an invoice, the statutory retention above applies to that record instead.

You have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable form (Art. 15–21 GDPR). You can export your media from the app at any time, and delete your account yourself under Settings → Account → Delete account (see how data deletion works). You can also ask us by email and we will action it within 30 days.

To exercise any right, email sichatmusic@gmail.com. You also have the right to complain to a supervisory authority — in Germany, the data protection authority of your federal state.

Media is stored in a private object-storage bucket and served only through short-lived signed URLs. Workspace data is isolated per organisation and enforced at the database level. Access to production systems is restricted to the operator.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as required by Art. 33–34 GDPR.

The Service is not intended for anyone under 16. We do not knowingly collect data from children; if you believe we have, contact us and we will delete it.

We will post updates here and, for material changes, notify you by email or in the app before they take effect.