# Privacy Policy — Aleatoria Issued: **16 October 2026** · Effective: **16 October 2026** (on publication; version 1.2 was effective from 12 October 2026, version 1.1 from 8 October 2026, version 1.0 from 10 September 2026) · Version 1.3 · Translation of the Czech original , **which prevails in case of any discrepancy**. > **(k právní revizi / pending legal review)** Prepared by the engineering team from the actual behaviour of the > service (). The text needs a lawyer's review. ## 1. Who we are The controller of your personal data is **Cloudpeakify s.r.o.**, company ID (IČO) **21041342**, VAT ID **CZ21041342**, registered seat **Jičínská 226/17, Žižkov, 130 00 Prague 3, Czech Republic**, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 396064 — "we", "Aleatoria". Privacy contact and security reports alike: **support@aleatoria.io**. We have not appointed a Data Protection Officer; we assessed that the conditions of Art. 37 GDPR are not met. ## 2. What we process | data | example | source | |---|---|---| | Account | account id, e‑mail (optional), plan, credit balance, creation date, preferred e‑mail language and operational e‑mail preferences; for accounts created from 3 October 2026 until version 1.1 was published, possibly the name of our landing page you came from (sign-up source; not collected since version 1.1); from version 1.1 your **optional** answer to "How did you hear about us?" at sign-up, if you give one | you | | Sign-in data | **password hash** (scrypt, never the password), whether the address is verified, one-time e-mail tokens (sign-in link, address confirmation, password reset) | you / produced by the service | | Sessions | session id, sign-in method, created and last-seen time, **truncated IP address** and browser string (user agent), hash of the session secret | produced by the service | | Google sign-in | your Google user id (`sub`) and e-mail address; **we ask for neither name nor picture** | **from Google** | | Abuse protection | attempt counters keyed on a **truncated IP address** and on an **e-mail digest** (sha-256, never the address itself) | produced by the service | | Subscription and credits | plan, subscription status and period, credit ledger (every movement with its time and reason) | produced by the service | | Orders and invoices | what was bought, amount, currency, VAT, country, VAT id, document numbers, links to the provider's documents, the terms version you accepted | you and the payment provider | | Payment-provider event records | what the payment provider told us about your payment, including the original message | from the payment provider | | Access credential | API key used to authenticate (stored only as an HMAC digest) | generated by us | | Generation input | prompt, lyrics, title, song structure, nature layers, seed, quality settings | you | | Generated content | audio (WAV, FLAC, MP3), stems, MIDI, score JSON, immersive masters, waveform overview | produced by the service | | Track metrics | audio fingerprint, novelty and repetition scores, energy curve | produced by the service | | Operational logs | request time and type, status, duration, job and account id, **truncated (anonymised) IP address** (the URL query string is never written to our records). In addition: an attempt to send you a transactional message writes the **recipient e-mail address**, the subject and the message tags into these same records — never the message text (§5, first exception) | produced by the service | | Hosting platform logs | the request logs Google Cloud itself writes for every request (Cloud Run and the load balancer): time, method, **the full request URL including its query string**, status, duration and the **full client IP address** — we do not produce these records and the IP in them cannot be truncated | produced by the infrastructure provider | | Billing | on paid plans: billing details, payment history, invoices, payment‑provider customer id | you and the payment provider | | Service review (only if you write one) | star rating, text, **display name in the form you choose** (full name, first name, or initials), the record of your consent to publication, the approval status and our internal note on it, the "verified purchase" flag (whether your account has ever paid — derived from payment records); your e‑mail is never published | from you / created by the service | **We never see your card number** — it is entered directly with the payment provider. The service is not intended for anyone under 16. We process no special categories of data (Art. 9 GDPR) and no biometric data; the audio fingerprint is computed from machine‑generated music, not from a person's voice (see §8). ## 3. Why, and on what legal basis | purpose | legal basis | |---|---| | Running the studio (account, generation, library, exports, credits) | performance of a contract — Art. 6(1)(b) GDPR | | Signing you in and keeping you signed in (password, one-time link, Google, sessions, API key) | performance of a contract — Art. 6(1)(b) | | Protecting sign-in against abuse (attempt limits, session-reuse detection) | legitimate interests — Art. 6(1)(f) | | Sending transactional e-mail (address confirmation, sign-in link, order confirmation, withdrawal acknowledgement) | performance of a contract — Art. 6(1)(b); for the order and withdrawal confirmations also a legal obligation, Art. 6(1)(c) | | Managing the subscription and the credit ledger | performance of a contract — Art. 6(1)(b) | | Consumer-law consent records (start of performance, withdrawal information, terms version) | legal obligation — Art. 6(1)(c) with Directive 2011/83/EU | | Novelty checking against **your own** history (so tracks never repeat) | performance of a contract — it is the core product feature | | Security, abuse prevention, debugging | legitimate interests — Art. 6(1)(f) | | Learning where new users come from: the optional answer to "How did you hear about us?" at sign-up (kept with the account for 12 months; for accounts made from 3 October 2026 until this version, possibly the older landing-page source `lp-…` instead) and daily aggregate counts of page views and downloads that are not linked to anyone | legitimate interests — Art. 6(1)(f) (knowing which channels work); the answer is voluntary and you can object to its processing (§ 8) | | Payments, accounting and VAT | contract and legal obligation — Art. 6(1)(b) and (c) | | Marking files as AI‑generated | legal obligation — Regulation (EU) 2024/1689, Art. 50 | | Publishing your service review on aleatoria.io under the name you choose — visible to **anyone** on the internet, but only after our manual approval | **consent** — Art. 6(1)(a) GDPR; you give it by ticking the box when you submit the review and **can withdraw it at any time** by deleting the review in your account (it leaves the site at once); withdrawal does not affect publication before it | | Verifying a review (that it comes from an account with a finished track, and whether it is a verified purchase) and moderating it | legitimate interests and legal obligation — Art. 6(1)(f) and (c) together with § 5c of Czech Act No. 634/1992 Coll. on consumer protection | **We use consent as a legal basis only for publishing a review** you decide to write; without it a review cannot be submitted, and nothing else depends on it. The consent to start performance before the 14-day period expires, which you tick at checkout, is a **contractual** consent under § 1837(l) of the Czech Civil Code and Art. 16(m) of Directive 2011/83/EU — not consent under Art. 6(1)(a) GDPR. We record it because the burden of proof is on the trader. **Google sign-in.** If you sign in with Google we receive your Google id (`sub`), your e-mail address and the fact that Google verified it — data obtained from a third party, and this paragraph is the information required by Art. 14(1) and (2) GDPR. The scope is limited to `openid` and `email`; we ask for neither name nor picture. For your Google account, Google is a separate controller ([policies.google.com/privacy](https://policies.google.com/privacy)). **We do not:** profile you with legal effects, take automated decisions under Art. 22, use advertising or tracking cookies, sell data, or train models on your data. Your tracks and prompts are never used for training, never compared against other users' work, and never published. ## 4. Cookies and local storage We set **three technical cookies** and no others: | cookie | what it is for | how long | |---|---|---| | `__Host-aleatoria_session` | keeps you signed in (it holds only a session id and a random secret; `HttpOnly`) | until you sign out, at most 30 days | | `__Host-aleatoria_csrf` | protects against forged requests from other sites (double-submit technique) | for a signed-in user as long as the session; **for an anonymous visitor only until the browser is closed** | | `__Host-aleatoria_oauth` | the short-lived Google sign-in state (`state`, PKCE); `HttpOnly` | 10 minutes, deleted as soon as you return from Google | All three are **strictly necessary for the service you asked for**, so under Art. 5(3) of Directive 2002/58/EC they need no consent — which is why there is **no cookie banner**. We use no analytics, advertising or tracking cookies. Your browser stores only **functional settings** you asked for by using the service in `localStorage`: the chosen language and currency, the draft of the track you are working on, the editor layout and render queue, interface sounds, the folder and format for DJ exports, dismissed notices, the way back to the studio, and optionally your API key. We store no measurement or visit attribution in your browser; the landing-page value the build of 3 October 2026 kept there is deleted on your next visit. They stay in your browser and are removed when you clear site data. We count views of our landing pages and file downloads only as **daily totals** (e.g. "page /ai-dj-tools: 37 views"). Nothing is stored on your device for this, and a count is not linked to you, your account or your IP address. Where you heard about us we learn only if you tell us at sign-up. ## 5. Where your data lives **Your account, your prompts and the audio you create stay inside the European Union.** We run on Google Cloud in `europe-west4` (Netherlands) and `europe-west1` (Belgium, secret replicas only); database backups stay in the `eu` multi‑region. The organisation policy `gcp.resourceLocations = in:eu-locations` makes creating a non‑EU resource in the project impossible. The full map is in §5 of . **Storage and processing happen in the EU.** Infrastructure support staff could in theory access systems from a third country; this is covered by the Google Cloud Data Processing Addendum and standard contractual clauses. **Three exceptions you should know about:** * **Transactional e-mail.** Since **22 September 2026** account e-mail is sent through **Resend** (Plus Five Five, Inc., USA; processor P3 in ). We pass Resend your **e-mail address and the content of the message**: sign-in and verification links (for a sign-in link that content *is* a credential), password resets, order confirmations and withdrawal acknowledgements. Delivery runs on infrastructure in Ireland (Amazon SES, `eu-west-1`), but Resend's account, metadata and logs are in the **USA** whichever region is used, so this is a transfer to a third country under Chapter V GDPR. It is covered by **standard contractual clauses (Module Two, controller to processor)** under Resend's data processing addendum and by its certification under the **EU-US Data Privacy Framework**. The sending attempt is also written into our operational records (recipient address, subject and message tags — not the message text) for the log retention period — 30 days — and, **while the default `_Default` sink is switched on** (it is today), into the copy in the `_Default` bucket described below. Version 1.0 of this policy said the sender was "not switched on yet"; that was no longer true from 22 September 2026 and version 1.1 corrects it. * **Google sign-in.** Pressing "Sign in with Google" makes your browser talk to Google directly; Google is a separate controller for your Google account. * **Log buckets in the `global` multi-region.** Our application logs are routed to the `aleatoria-eu-logs` bucket in `europe-west4` (30 days). Cloud Logging keeps two default buckets alongside it whose location the project cannot change: `_Required` (records of administrative action on the project, 400 days; Google-managed, and it can be neither moved nor switched off) and `_Default` (30 days). `_Default` stores a copy of the operational records **while the default `_Default` sink is switched on** — today it is. That sink can be switched off, and from then on no operational or audit record is written to `_Default` at all and the records stay only in the EU `aleatoria-eu-logs` bucket; `_Required` stays `global` either way, because it cannot be switched off. Both buckets sit in the `global` multi-region, for which Google gives **no guarantee** that the data stays in the EU. They hold the operational and audit records described in §2, never the audio you generate. Any resulting transfer to a third country is covered by the Google Cloud Data Processing Addendum and standard contractual clauses. ## 6. Who else is involved The list of processors and their roles: . In short: * **Google Cloud EMEA Limited** (Ireland) — hosting of the application, database, storage and logs (EU regions). * **Stripe Payments Europe, Ltd.** (Ireland) — payments and invoices on paid plans. Stripe has a **dual role**: it is our **processor** when it executes a payment we instruct, and a **separate controller** for fraud prevention, anti-money-laundering duties and payment-services regulation. As a separate controller it follows its own policy ([stripe.com/privacy](https://stripe.com/privacy)) and you exercise your rights over that processing directly with it. The invoice link in your account points at a Stripe domain; opening it sends Stripe data it already has. * **Resend** (Plus Five Five, Inc., USA) — transactional e-mail since 22 September 2026; see §5 above. * **Seznam.cz, a.s.** (Czech Republic) — the support mailbox `support@aleatoria.io` (questions, complaints, withdrawals). * **Google LLC / Google Ireland Limited** — only if you choose to sign in with Google (separate controller). * **Accountants and public authorities** — to the extent required by law. We do not sell your data and do not share it for third‑party marketing. ## 7. How long we keep data | data | retention | |---|---| | Account | until you close it | | Tracks and audio — created on Basic, Studio or Pro | until you delete them or close the account; **cancelling a subscription changes nothing** | | Tracks and audio — created on Free (an account without a subscription) | 180 days after creation (removed by the automatic retention sweep) | | Stems | 90 days (Free) / 180 days (Basic, Studio, Pro) after creation | | Trial preview without an account (feature `anon_trial`, page `/try`): a job row with no owner holding only the chosen genre preset and the pipeline's own log lines — no prompt, no name, no address — and its 30‑second audio file | 24 hours, then both are deleted; the per‑visitor limit (3 a day) counts the same anonymised network‑address bucket as every other abuse‑protection counter (row below), kept at most 24 hours; a count per day and preset, linked to nobody, remains | | Generation records (jobs, including prompt and lyrics) | 30 days after creation | | Lifecycle e-mail queue (the record that and when we sent you the welcome e-mail or a credits-renewed notice; it holds no address) | 90 days; the welcome record (without content) for the life of the account, so it is never sent twice | | Service review | until you delete it or close your account; a deleted review stops being public at once | | Sign-up source and the optional answer to "How did you hear about us?" | 12 months from sign-up | | Aggregated counts of views of our landing pages and of downloads by file type (not linked to anyone, no IP address, no cookies) | 400 days | | Operational logs (ours and the hosting platform's request logs) | 30 days | | Sessions | until sign-out or expiry, at most 30 days; expired rows are deleted automatically | | One-time e-mail tokens | until used or expired (sign-in link 15 minutes, address confirmation and password reset 24 hours) | | Abuse-protection counters | until their window closes (at most 24 hours) | | Subscription and credit ledger | for the life of the account (the ledger is the accounting trail a refund is proved from) | | Orders | for the life of the account | | Payment-provider event records | message content 90 days, then deleted along with the link to the account; only the event id, its type and its outcome remain | | Database backups | 7 days (disaster‑recovery window) | | After account deletion | erased immediately; gone from backups within 7 days | | Invoices and tax documents | 10 years (statutory) — **they survive account deletion, in pseudonymised form** | The complete table with the technical parameters is in §6 of . ## 8. Your rights You have the right of access, rectification, erasure, restriction, portability and objection. Most of it is one click in the app: | right | how | |---|---| | Access (Art. 15) | **Account** page, technically `GET /api/me` and `GET /api/tracks` | | Portability (Art. 20) | **Export my data** — `GET /api/me/export` returns a ZIP: `export.json` with every track, prompt, job, metric, **session, linked identity, subscription, credit-ledger entry, invoice and order**, plus all your audio files | | Erasure (Art. 17) | **Delete account** — `DELETE /api/me?confirm=DELETE` erases tracks, fingerprints, jobs, audio objects, sessions, identities and tokens | | Rectification (Art. 16) | change your e-mail address on the **Account** page (`PATCH /api/me`); the new address then has to be confirmed again | | Withdrawing consent to publish your review (Art. 7(3)) | the **Your review** card on the **Account** page → **Delete review** | | Restriction (Art. 18), objection (Art. 21) | write to **support@aleatoria.io** | **What erasure deliberately does not erase.** Issued invoices and tax documents are accounting records we must keep for 10 years, so deleting an account **pseudonymises** them (detaches them from the account, empties the VAT id and the links) and keeps only the amounts, the tax and the document numbers — Art. 17(3)(b) GDPR. Stripe keeps its own copy as its own accounting record. The export, conversely, deliberately **omits** the password hash, the API key hash and token hashes: they are security material, not information about you. **Erasure reaches the payment provider too**: we cancel your subscription and delete the customer record there. It happens asynchronously through a queue, so an erasure request never depends on the provider being reachable at that moment; until it completes, the entry stays queued. We answer within **one month**; for complex requests we may extend by two months and will tell you. If we cannot identify you from the request, we may ask for more information. You may also lodge a complaint with a supervisory authority — in the Czech Republic the **Office for Personal Data Protection (ÚOOÚ)**, Pplk. Sochora 27, 170 00 Prague 7, [uoou.gov.cz](https://uoou.gov.cz/). ## 9. Security Data is encrypted in transit (HTTPS/TLS); the database has a private IP only and requires encrypted connections; storage and secrets are encrypted at rest; access rights are least‑privilege; administrative access is audit‑logged. Audio download links are temporary (valid one hour). Details in §10 of . ## 10. AI‑generated content Every file you export carries a machine‑readable marking that the audio was created by AI (WAV `LIST/INFO ICMT`, FLAC `AI_GENERATED=true`, MP3 `TXXX:AI-GENERATED`), and downloads return the header `X-Aleatoria-AI-Generated: true`. This implements Art. 50 of Regulation (EU) 2024/1689; see . ## 11. Changes We will announce material changes by e‑mail or in the app at least 14 days in advance. Version history is kept in the project repository. **Version 1.1** corrects the description of what actually happens: e-mail sent through Resend (USA) since 22 September 2026 (§5, §6), the support mailbox at Seznam.cz (§6), the list of functional values in `localStorage` and the end of storing the visit source (§2, §4). It adds the optional question "How did you hear about us?" at sign-up and daily totals of page views that are not linked to anyone (§2, §3, §4, §7); otherwise nothing new is processed, it is described truthfully. Version 1.1 was published and took effect on 8 October 2026. **Version 1.2** (12 October 2026) follows the paid **Basic** plan and the anonymous **trial** (§7): tracks made on Basic are kept like those made on Studio or Pro, Free is named as an account without a subscription, and the row for the trial preview without an account (24 hours, no account, no prompt) is added. It describes processing that already runs and adds none that concerns an account holder, so it took effect on publication. The terms of service changed at the same time (version 1.1 of 12 October 2026, effective 12 November 2026). **Version 1.3** (16 October 2026) adds **service reviews** (§2, §3, §7, §8): anyone who wants to can write a review in their account and, with consent, have it published under the name they choose; we approve each one manually before publication, and consent can be withdrawn at any time by deleting the review. The new processing concerns only those who submit a review themselves, so this version took effect on publication. We give no reward for reviews.