Privacy policy

The data controller is Daniel Angelucci, who provides DADAAUDIO (VAT number IT04021720547). For anything about your data, write to support@dadaaudio.com.

When you put other people’s personal data into your workspace (for example your contacts, or the people you share music with), you decide why and how it is used, and we process it on your behalf to run the service.

• Waitlist. If you leave your email on dadaaudio.com, we keep it, with the date, to write to you once when early access opens. Legal basis: your consent, which you can withdraw at any time.
• Your account. Your email address and, if you sign in with Google, the basic profile Google shares with us (name, email and profile picture). We use them to sign you in, to show who did what in a shared workspace, and to write to you about your account. Legal basis: our contract with you.
• Your content. The music, files, metadata, credits, rights data, lyrics, notes, comments, contacts and custom fields you add, and the history of changes kept so that you can undo them. We use them only to provide the service to you and the people you work with. Legal basis: our contract with you.
• Workspace members. The email addresses of people you invite to a workspace, so that we can send the invitation.
• Use of the app. What you play (to show Insights to your workspace), and the searches you make with what you open or play afterwards (to make search better). These stay with us and are never sold or used for advertising. Legal basis: our legitimate interest in providing and improving the service.
• Feedback. If you send feedback from the app, we keep your message, your email, the page you were on and your browser type, and email them to Daniel so that he can read and answer. Legal basis: our legitimate interest in improving the service and answering you.
• Emails. We send sign-in codes, invitations, share emails you ask us to send, and notifications about your links (you can choose all, only important ones, or none in Settings).
• Payments. When paid plans open, Polar handles the purchase. We receive from Polar what we need to manage your plan (for example the plan, the billing period, the subscription status, your country and email), never your card details. Legal basis: our contract with you, and our legal obligations.
• Technical data. Like every website, our hosting providers receive technical data such as your IP address and browser type when you visit, and keep it in their logs for a limited time to run the service and protect it against abuse. Legal basis: our legitimate interest in keeping the service working and safe.
• Website statistics. To know how many people visit dadaaudio.com and which pages they read, we count visits without cookies and without storing anything on your device. For each page we record the page, the time you spent on it, the site you came from (its name only), your country and the kind of device. To count a person once a day, your IP address and browser type are mixed with a random value that changes every day and is then deleted, so the result can’t identify you, can’t be linked across days, and your IP address is never stored. Legal basis: our legitimate interest in understanding how our website is used.

When someone shares music with you through DADAAUDIO, the page of the link records what happens on it, so that the sender knows the music arrived: when the link was opened, which tracks were played, whether they were heard for 30 seconds or to the end, and what was downloaded or saved. To tell one listener from another without an account, and without cookies or anything stored on your device, your IP address and browser type are turned into a code that changes every day and for every link; the code can’t identify you and your IP address is never stored.

If you reply, comment, send files, ask for a licence or give your name and email, these are stored and shown to the sender, and the sender may get them in a notification email. The sender’s workspace may add you to its contacts, with the name, email and company you gave or the sender entered, and show your activity on their links on your contact card. If you have a DADAAUDIO account with the same email, the link also appears in your “Shared with you” list.

The sender is responsible for this use of your data, and we process it on their behalf. You can ask the sender, or us, to access or delete it.

Aerie uses Google’s Gemini API, a paid service, to listen to your music and suggest tags, lyrics, explicit-content flags, tempo and key: an excerpt of each track (up to its first 10 minutes) is sent to Google for analysis. When you upload many tracks at once, the excerpt is parked in Google’s Files API until the analysis runs, and Google deletes it automatically after 48 hours at the latest.

To power search by meaning, we also send Google the texts that describe your tracks (such as tags and short descriptions) and the words you type in a search. If you ask for an AI voice for your voice tag, we send its short text too.

Under Google’s terms for its paid API, Google does not use what we send to improve or train its products. Google may keep it for a limited time to detect abuse, as its terms allow. We never use your music to train AI, and we never use AI to make music.

We use a few trusted providers to run DADAAUDIO. They process data only on our instructions, under data processing agreements, except Polar, which acts as an independent controller for the purchase.

• Supabase: database and sign-in, including sign-in emails. Our database is in the EU (Frankfurt, Germany).
• Cloudflare: storage of your files, in a storage bucket restricted to the EU, and our domain’s DNS.
• Vercel: hosting of the website and the app; the app’s servers run in Frankfurt, Germany, and pages are delivered through Vercel’s global network.
• Google: the Gemini API for the AI features above, and Google sign-in if you choose it.
• Resend: delivery of emails such as notifications, invitations and share emails.
• Polar (Polar Software, Inc., United States): our reseller and Merchant of Record for payments, when paid plans open; it uses its own payment processors (such as Stripe) for card payments.

We never sell personal data, and we never share it with advertisers or data brokers. We disclose data to authorities only when the law requires it.

Your files and our database are stored in the EU. Some providers above are based in the United States or the United Kingdom, or may process data outside the European Economic Area (for example Google, Vercel, Resend and Polar). When that happens, the transfer is protected by an adequacy decision of the European Commission (such as the one for the United Kingdom, or the EU-US Data Privacy Framework for certified companies) or by the European Commission’s Standard Contractual Clauses. You can ask us for more information about these safeguards.

• Waitlist: until we have sent the email about early access, then it is deleted; earlier if you ask.
• Your account and content: for as long as you have the account. Tracks you put in the trash are deleted for good after 30 days. Uploads that were interrupted and never resumed are discarded after 7 days.
• After you close your account: we delete your content and account data within 30 days, apart from what we must keep by law. Backups are overwritten on a rolling basis.
• Activity on shared links: for as long as the sender keeps the link and the workspace, unless you ask for it to be deleted.
• AI excerpts parked at Google: 48 hours at most.
• Feedback messages: as long as they are useful to improve the service, and no longer than 2 years.
• Payment records: Polar keeps them as tax law requires; we keep what we must for our own accounts (in Italy, generally 10 years).

Under the GDPR you can ask us to access your data, correct it, delete it, limit its use, or give it to you in a portable format, and you can object to uses based on our legitimate interest. Where we rely on your consent, you can withdraw it at any time. Write to support@dadaaudio.com: we will answer within one month.

You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority of the EU country where you live or work.

Everything travels encrypted (HTTPS), and our providers encrypt stored data. Each workspace’s data is separated by access rules in the database itself, files are reached only through short-lived signed links, and link passwords are checked on our servers. We store no passwords for your account: you sign in with one-time codes or with Google.

DADAAUDIO is not meant for anyone under 16, and we don’t knowingly collect their data. If you think a child has given us data, write to us and we will delete it.

When this policy changes, we update the date at the top of this page. If a change matters, we will tell you by email or in the app before it takes effect.

For anything about your data: support@dadaaudio.com.

DADAAUDIO · VAT number IT04021720547 · support@dadaaudio.com