Privacy policy

The data controller is Rubén Zafra, who runs Mixkeeper as a self-employed professional. Tax ID (NIF): [Tax ID (NIF)]. Address: [Postal address]. For anything privacy-related, write to legal@mixkeeper.app.

We have no data protection officer because, given the size and type of processing, one is not required. Privacy questions are handled directly by the owner.

There are two different roles, and it helps to keep them apart:

• We are the controller for your account data, the waitlist and technical and security logs. We decide why and how they are used, and we answer for it.
• We are a processor for the content a studio or band keeps in its workspace: clients, projects, songs, audio files, comments, tasks and approvals, including data about the people they invite by link. There, the workspace owner decides, and we only process that data to provide the service to them, under the processing terms set out in the Terms of use.

If you commented on a review link and want what you wrote corrected or deleted, you can ask the studio that sent you the link. If you write to us instead, we will pass the request on and help them handle it.

• Account. Name, email, password (stored as a hash, never in plain text), preferred language, the workspaces you belong to and the invite you joined with.
• Sign in with Google, when enabled. If you choose to sign in with Google, we receive your name, email, profile picture (if you have one) and an identifier for your Google account. We do not receive your Google password or any access to your email or files. If you sign in with Google to comment on a review link, a basic account is created with that data; it gives no access to any workspace.
• Sessions. A session identifier, the IP address and browser (user agent) you signed in from, and when the session expires.
• Workspace content. Names of clients and bands, client emails and notes added by the studio, images or logos, projects, song titles, audio files and their versions, technical data derived from the audio (waveform, loudness, duration), comments, tasks, approvals, notes and shared links with their recipient's name.
• People invited by link. The name you type when commenting, your comments, votes and approvals, and a random key stored in your browser so your votes count only once. We do not ask for your email or for an account.
• Link statistics. When a shared link is opened and when a song is played or downloaded. These are stored as counts per link, without your IP or any identifier of yours.
• Waitlist. Your email, the profile you pick (producer, engineer, artist or other), your language and, if you came from a link with a reference, where you came from.
• Technical logs. When you visit any page, our hosting provider logs technical data such as IP address, browser, the page requested and the time. We use it only to keep the service running, find errors and prevent abuse.
• Communications. Whatever you tell us if you email us.

We do not process special categories of data (health, beliefs, etc.), and we ask you not to include them in comments or notes.

We do not use your data for advertising, we do not sell it, we do not build profiles and we make no automated decisions with legal effects on you. Nor do we use your music or your comments to train artificial intelligence models.

To work, Mixkeeper relies on these providers, which process data on our behalf as processors and under contract:

Sign-in runs on Better Auth, an open-source library that runs on our own server: it is not a third party and does not receive your data.

Payments, once they launch. Paid plans will be sold through Paddle.com Market Ltd (United Kingdom), acting as merchant of record: Paddle charges you, issues the invoice and handles taxes and refunds. To do so it will process your payment data as a controller, under its own privacy policy. We never see or store your card details; we only receive from Paddle your subscription status, plan and the data needed for billing.

Beyond these cases, we will only disclose data to authorities or courts when the law requires us to.

Several of these providers are US companies or may process data outside the European Economic Area. When that happens, the transfer relies on the EU-US Data Privacy Framework where the provider is certified or, otherwise, on the standard contractual clauses approved by the European Commission, with the additional safeguards each provider offers. For the United Kingdom (Paddle) there is an adequacy decision from the European Commission.

If you want more detail on the safeguard that applies to a specific provider, write to us.

• Account: for as long as it is open. If you delete it or ask us to, we erase your data within 30 days at most, except what we must keep by law.
• Workspace content: for as long as the workspace exists. Anything you move to the trash, audio files included, is deleted for good after 30 days (or earlier if you empty the trash). An automatic job checks this every day.
• Comments by invited people: for as long as the studio keeps the project, or until it deletes them.
• Sessions: expire after 30 days without use or when you sign out.
• Waitlist: until we give you access or open sign-ups, and at most 12 months after that. Earlier if you ask us to remove you.
• Hosting technical logs: short periods, usually hours to a few days, depending on the provider's settings.
• Backups: the database provider keeps a short restore history; deleted data also disappears from it once that history rolls over.
• Billing data, once there are payments: as long as tax and commercial law requires (generally 4 to 6 years).

You can exercise these rights over your data at any time:

• Access: find out what data of yours we process and get a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data.
• Objection: object to processing based on legitimate interest.
• Restriction: ask us to freeze the use of your data while a complaint is resolved.
• Portability: receive your data in a structured, commonly used format, or have us send it to another service.
• Withdraw your consent (for example, leaving the waitlist), without affecting what was done before.

Write to legal@mixkeeper.app saying which right you want to exercise. If we have reasonable doubts about your identity, we will ask for the minimum needed to check it. We will reply within one month, extendable by two more in complex cases, and we will tell you if that happens. It is free.

If you believe we have not handled your data properly, you can complain to the Spanish data protection authority, Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, at www.aepd.es, or to the authority in your own EU country. We would appreciate it if you wrote to us first so we can try to sort it out.

We apply reasonable measures to protect your data: encrypted connections (HTTPS), passwords stored as hashes, audio files in private storage reachable only through signed links that expire shortly, and system access limited to the owner. Review links are private but have no password: anyone who has the link can open it, so only share it with people you want to.

If a security breach affected your data, we would notify the AEPD and, where the law requires it, you, within the deadlines set by the GDPR.

You must be at least 18 to open a workspace (studio or band). To comment on a review link, with your name or by signing in with Google, you must be at least 14 or have permission from your parent or guardian, as provided by article 7 of the LOPDGDD.

If we change this policy, we will update the date above. If the change is significant (for example, a new provider that handles your content or a new purpose), we will tell you in advance by email or in the app.

The Spanish version of this policy prevails if there is any discrepancy between languages.