Privacy policy

Who holds your data

SOGV2 Limited (CR No. 76825703), the company operating Euphona, is the controller of the personal data described here.

We have not yet appointed a representative in the European Union, or in the United Kingdom. A company outside those places that offers services to people inside them generally has to appoint one, under Article 27 of the EU General Data Protection Regulation (the GDPR) and its UK counterpart, and we are not going to argue ourselves into the narrow exemption for occasional low-risk processing — recordings carry people’s voices and we process them continuously. The appointment is outstanding, and it is named here rather than left for you to notice.

Data-protection questions go to privacy@euphonaai.com, and a person reads that address.

What we collect

• •Account details — your email address, your name if you give one, whichever sign-in method you chose, and the language the Studio, your account page and our email to you are written in: the one you choose, or until you do, the one of the page you signed up from. There is no password to hold: you sign in with a one-time code we email you, or with Google. A code lives for fifteen minutes and we store only a hash of it, never the code itself, so a copy of our database would not let anyone sign in as you. If you sign in with Google, we hold the identifier Google returns and nothing else about that account.
• •Audio you upload, the analysis derived from it, and the results produced from it. See below — this is the part that matters most.
• •Usage and metering — which jobs ran, how long the audio was, what they cost, and whether they succeeded. This is how a bill is calculated and how a support question is answered.
• •Webhooks, if you set them up through the API — the web addresses (URLs) you register for us to notify about your jobs, the description you give each one, and the secret that signs those notices, which we store encrypted. We also keep a log of the notices: which job each one was about, what it said, and whether your server accepted it.
• •Your Studio preferences — the options you last chose for each service, so they are there when you come back, and the kind of work you told us you do. They are deleted with your account; the options you chose in a workspace are also deleted when you leave it.
• •Billing details — held by Stripe, our payment processor, not by us. We store an identifier, your plan and your invoice history. We never see your card number.
• •Support correspondence — what you wrote to us and what we replied, by email or on WhatsApp. On WhatsApp we also receive your phone number and your WhatsApp profile name, and your profile picture if you have one and your WhatsApp settings let us see it.
• •Technical logs — request identifiers, timings, errors and coarse information about the client. Kept short, used to find out why something broke. We also use them to produce anonymous, aggregated traffic statistics: how many visits, which pages, which sites sent visitors, which countries they came from, and how many new accounts came from each page and country. To find a country we look the IP address up in an IP-to-country table kept on our own server; the address is not sent to anyone for this. The statistics identify no one and are kept as totals only.
• •Your email address, if you ask us to write to you — the form at the foot of every page on this site. The mailing list is separate from an account in both directions: you can be on this list having never signed up for anything, and signing up does not put you on it. We keep the address, the day you asked, which form you asked from and the language of the page it was on — so that we write to you in it — and whether you confirmed, plus a hash of the link we send you, so that following it proves something while a copy of our database would not let anyone forge one. No name. See the clause below for what we do with it.

Five of the free tools never receive your audio. The loudness checker, the BPM & key finder, the spectrum analyzer, the stereo width analyzer and the clipping & noise detector run in your browser; the file is decoded and measured on your own device, and there is no endpoint on those pages to send it to. That is not a policy we could quietly change without you noticing — it is how the pages are built, and you can watch the network tab to confirm it.

The vocal remover is the exception, and it is labelled as one. It uploads the file to our servers, because the separation runs on the engine, and it holds the upload and the two parts made from it for at most twenty-four hours before deleting them automatically (see retention below). While we hold them they are your audio in every sense the section on your audio describes: private, unlistened-to by anyone here, never training data. If you sign up and move the result into your account, it becomes an ordinary file in your workspace and is kept as one.

What we do see is the request for the page itself, because that is an ordinary web request and it appears in the technical logs above like every other one — including your IP address. An IP address is personal data, so we would rather say this than let “the tools collect nothing” do work it cannot do. We use it for three things: finding out why something broke; counting requests per address so that the tools can stay free without an account, which they only can while nobody automates them; and the anonymous traffic statistics described above. The acceptable use policy says the second of these from the other side. Your IP address, logged this way, is not linked to an account, not used to build a profile, and ages out with the rest of the logs.

Children

You need to be at least 13 to have an account. Below that age, the law in the United States requires a parent’s verified consent before a service like this one holds a child’s data, and we have no way to collect it. We use that one number everywhere instead of checking your country, because a policy that gives you fewer rights depending on your address is the thing this document is trying not to be.

We do not knowingly collect data from anyone younger, and we do not profile age or infer it. If you are a parent or guardian and believe a child has made an account here, write to privacy@euphonaai.com and we will close it and delete what it holds. You do not need to prove anything first; we would rather act on a plausible message than make you produce documents about your own child.

The browser-based free tools are a deliberate exception, and only because they can be: they need no account, they collect no audio, and a twelve-year-old measuring the loudness of their own mix in their own browser is not something we need to know about, let alone gate. The vocal remover asks no age either, but it does take an upload, which exists on our servers for up to twenty-four hours; a parent who would rather it did not can reach us the same way and we will delete it then rather than later.

Your audio, specifically

It is never used to train anything. Not our models, not anyone else's. If we ever want to, we will ask you separately and explicitly, you will be able to say no, and you will be able to change your mind later. That consent does not exist yet because the machinery for honouring it does not exist yet, and asking for permission we could not yet keep would be worse than not asking.

It is private by default. It is stored in a location specific to your workspace, reachable only through links that are signed and expire. There is no public URL for your audio and no way to guess one.

Nobody here listens to it. Our staff have no standing ability to listen to it. Where a support case genuinely requires it, we ask you first, and any internal access is recorded in an audit log that cannot be edited afterwards.

It is decoded carefully. Malformed media files are one of the oldest ways to attack a system, so decoding happens in a sandbox with no network access and nothing to reach — which protects you as much as it protects us, because the thing being attacked would be the process holding everyone's audio.

A file you send us in a WhatsApp chat is part of that conversation, not an upload to the service. It stays with the conversation, in the WhatsApp Business app on our support phone, as who else touches it describes.

Why we hold it

To run the service you asked for, to bill you correctly, to answer you when something goes wrong, to keep the platform secure and to meet legal obligations such as keeping tax records. Where the law requires a legal basis to be named, these are the bases under Article 6(1) of the GDPR: performing our contract with you for most of it; meeting a legal obligation (Article 6(1)(c)) for the tax and accounting records the law requires us to keep; our legitimate interest in security and service quality for the logs, and in knowing how people find the site for the anonymous statistics made from them; and consent for the two things that are optional — the mailing list described next, and the analytics described after it. Refusing either costs you nothing else on this site, and neither is a condition of anything.

Email you asked us to send

There is a form at the foot of every page on this site that puts your address on a list we write to occasionally — what we shipped, and what we learned building it. There is no schedule and no series, because we have not committed to one. This is the only mail we send that is not about an account or a purchase, and it is the only thing on this page that can concern somebody who has no account at all.

We send it because you asked and then confirmed that you asked, which is consent under Article 6(1)(a) of the GDPR and could not honestly be anything else. A message about what we have released is not something we could claim you need in order to be served, and calling it a legitimate interest would be the polite version of not asking. The list is not sold, not shared, not rented, and not used to look for you anywhere else.

Confirming is the point, not a formality. Typing an address into a form proves that somebody typed it; following the link in the message we then send proves it was yours. Until you follow it we hold an address that has confirmed nothing and we send nothing further — one request, then silence. So doing nothing is a complete answer, and the cheapest one available to you: an address that never confirms is never written to again, and you do not have to tell us that is what you meant.

Every message carries an unsubscribe link that works without signing in, without an account and without replying to us: it opens a page with one button, and pressing that button is all it takes. Where your mail app offers its own unsubscribe button, that works in one step. Withdrawing has to be as easy as agreeing — Article 7(3) of the GDPR says so, and we would want it anyway, because the alternative to an easy unsubscribe is not a loyal reader, it is the spam button. It takes effect at once, and we honour it even when the link is malformed or forwarded from somebody else’s copy, on the reasoning that a person trying to stop mail should not be refused on a technicality.

Leaving is currently permanent, and you should hear that from us rather than discover it. Unsubscribing records that the address is not to be written to, and that record is checked before anything is sent — including before a new subscription would be accepted. Filling in the form again therefore will not put you back on the list, and the form will not say so: it answers identically for every address, deliberately, because an answer that distinguished them would let an anonymous stranger test whether a given person is on our list or has complained about us. If you left and want to come back, write to privacy@euphonaai.com and say so, and we will put you back.

That do-not-mail record is the one thing we keep after you go. It holds the address, the reason and the date, and nothing else about you. It has to outlive the subscription itself, or a later import or a mistake in our own code could put you back on a list you had already left — which is the failure it exists to prevent, and the reason we would rather hold that one line than be able to say we hold nothing. The rest of what the list held about you — the subscription record itself, with the day you asked, the form and the language, and the record of which messages went to your address — you can have deleted: write to the same address and we will delete it.

We do not measure who opens what. There is no tracking pixel in what we send, and no link that counts a click by bouncing you through us — the links go where they say they go. One image is loaded from our servers, the Euphona logo at the top, and it is the same address for every recipient: fetching it tells us that an image was fetched, not who fetched it. If your mail client blocks remote images, as many do by default, not even that happens.

Analytics, cookies and browser storage

This site measures how it is used, and only if you agree first. Before you answer there is no measurement script on the page at all — not one loaded and held in a disabled state, which is the usual arrangement and a weaker one. If you decline, or never answer, nothing is fetched and no analytics cookie is written.

What runs once you accept is Google Analytics 4, on this marketing site and on the pages where you sign up or sign in, at auth.euphonaai.com, and nowhere else. It sets its own cookies to tell a returning visit from a new one, and reports which pages were read, where the visit came from, an approximate location derived from your IP address, and the device and browser. On the sign-up pages it also records that an account was created, with nothing that identifies the account. We send it no account identifier, no name and no email address. It never runs in the Studio, where your audio is — that is a different origin with a different answer, and consent given here is not carried there. One answer covers this site and the sign-up and sign-in pages: we ask once, on whichever of them you reach first, and your answer applies to both.

Agreeing is necessary and not sufficient. The tag also declines to load on any page whose web address (URL) carries an email or token parameter, whatever you have agreed to — so the confirmation and unsubscribe links we send you cannot become an analytics event, and neither your email address nor the single-use credential in those links reaches Google. The check is on what the URL contains rather than which page it is, because a page that moves should keep the protection; a page carrying neither, including the one you land on after subscribing, is measured normally.

You can change your mind whenever you like. “Analytics choice” in the footer of every page, here and on the sign-up and sign-in pages, reopens the question, and your new answer applies to both, as the first one did; declining after having accepted switches the tag off in that browser. Your answer is kept in a cookie of ours, eu_consent, for a year; it holds one word and identifies nobody. It is set for euphonaai.com and its subdomains, so that the sign-up and sign-in pages read the same answer; the Studio and our other addresses receive it too, and nothing there reads it.

Google plays two roles with this data. In measuring the site for us it is our processor, acting on our instructions; for the purposes it uses the data for itself, it is an independent controller, under its own privacy policy. The data may be handled in the United States under the EU–US Data Privacy Framework.

The pages you can read without an account set nothing until you ask them to. Arrive, read, use the free tools, leave again — nothing is stored on your device by this page, by the guides or by the tools. Two things change that, and only if you do them yourself: choosing the light or the dark theme records that choice, so the site is still in that theme the next time you open it; and picking a language records that language, so the site opens in it the next time.

The theme is kept in a cookie, because a cookie is the only storage the sign-in pages and the Studio can also see: kept anywhere else, a choice of light made here would turn back to dark the moment you went to sign in. Being a cookie, it travels to us with every request your browser makes; nothing on our side reads it, and it changes what your browser paints and nothing else.

Signing in sets two more, asking for a sign-in code or starting a Google sign-in briefly sets one more, and the Studio sets four of its own. All of them are ours: the one third-party exception on this service is the analytics cookies described above, which exist only if you said yes. And all of them exist only to do the thing you asked for: to remember a display, layout or language choice you made, to carry out signing in and staying signed in, to open the Studio in a workspace you joined, and to show you a new API key once. That is why none of them needs a consent banner: not one measures you, follows you between sites, or reports anything about you to anyone.

• •eu_theme — the word light or the word dark, and nothing else. It exists only once you have chosen a theme; until then there is no such cookie and the site follows whatever your device already prefers. Scripts on the page can read it, because reading it before the page is drawn is the whole point — a theme applied a moment late is a white flash on every click. It identifies nothing and permits nothing: someone who forged it would get a page in the other colour. It lasts a year, is not cleared by signing out, and clearing it puts you back to following your device.
• •eu_locale — the tag of the language you picked, such as de or pt-BR, and nothing else. It exists only once you have picked a language from the list at the foot of a page; until then there is no such cookie and every page is in the language of its address. While it is set, opening a page that exists in that language takes you to that version; picking English stops that. It is kept by this site only — the Studio and the sign-in pages never receive it, and your language there is a setting on your account. Scripts on the page can read it, because that is where the choice is acted on; nothing on our servers reads it. It identifies nothing and permits nothing: someone who forged it would get pages in another language. It lasts a year, is not cleared by signing out, and clearing it means each page opens in the language of its address again.
• •eu_session — a reference to your signed-in session. It is a random value that means nothing on its own; the session it points to lives on our servers, which is what lets you sign out of every device and have that take effect. Marked HttpOnly and Secure, so no script on the page can read it and it never travels unencrypted. It expires after 30 days without use — using Euphona pushes that date back, so an account in regular use stays signed in rather than being turned out on a schedule — and after 400 days from the day you signed in whatever happens, which is the one date using Euphona does not move. Signing out ends it immediately, everywhere it counts.
• •eu_session_hint — the single character 1, and nothing else. It records that somebody is signed in on this browser, so our public pages can offer you the Studio instead of asking you to log in again. Unlike the cookie above, scripts on the page can read it, which is why it holds no name, no email address, no account reference and no session value: reading it tells you only what the page you are looking at already shows. It cannot be used to sign in, prove anything, or reach anything. It is written and deleted at exactly the same two moments as the cookie above, and lasts exactly as long. If a session lapses through disuse the hint can outlast it, and all that happens is that a public page offers you the Studio and the Studio asks you to sign in — which is what it would have done anyway.
• •eu_oauth_flow — set only while you are signing in with Google, and only on the sign-in site. It holds the one-time values that tie the trip to Google back to the browser that started it, which is what stops somebody walking you into an account that is not yours. It lasts two minutes and is deleted the moment you arrive back, whether the sign-in worked or not.
• •eu_signin_address: set only while you are signing in with a code we email you, and only on the sign-in site, which sends it back only to its sign-in page. It holds a random reference and nothing else; it does not hold your email address. The page where you type the code looks that reference up on our servers to say which mailbox the code went to, and our servers keep the reference only as a hash, beside the account the code was sent to. Marked HttpOnly and Secure, so no script on the page can read it and it never travels unencrypted. It lasts fifteen minutes, the life of the code, and is deleted as soon as the code signs you in.
• •eu_workspace: set by the Studio, and only when you accept an invitation to somebody else’s workspace, so that the Studio opens in the workspace you have just joined rather than in your own. It holds that workspace’s identifier and nothing else. It decides nothing: on every request our servers check that you are a member of the workspace it names, and refuse it if you are not. Marked HttpOnly and Secure, so no script on the page can read it. It has no expiry date of its own, so your browser deletes it when its session ends, usually when you close it; signing out does not clear it.
• •eu_tracks: the word grid or the word list, and nothing else: how the Studio’s Library shows your tracks. It exists only once you have switched between the two; until then the Library shows the grid. It is kept by the Studio only. Scripts on the page can read it, and the Studio reads it to draw the Library the way you left it. It identifies nothing and permits nothing: someone who forged it would see the other layout. It lasts a year and is not cleared by signing out.
• •eu_rail: the word expanded or the word collapsed, and nothing else: whether the Studio’s side menu is shown at full width or as icons only. It exists only once you have used the button that collapses or expands the menu; until then the menu is shown at full width. It is kept by the Studio only. Scripts on the page can read it, and the Studio reads it to draw the menu at the right width from the first moment. It identifies nothing and permits nothing: someone who forged it would see a wider or narrower menu. It lasts a year and is not cleared by signing out.
• •eu_key_flash: set only when you create an API key in the Studio’s settings, and it holds that new key, so that the page you are taken to next can show it to you. We show a key once and keep only a hash of it, and this cookie is how the key reaches that page without being put in a web address (URL), where it would be recorded. It is sent only to the settings pages and is marked HttpOnly and Secure, so no script on the page can read it and it never travels unencrypted. It lasts sixty seconds, after which your browser deletes it.

These ten, like eu_consent above, are first-party cookies set by us. None of them holds your name, your email address or anything about what you have uploaded: the session cookie and the sign-in cookie are random references and nothing more, and the workspace cookie names a workspace, not a person. Blocking them costs you three things and nothing else: you cannot stay signed in, a theme you choose will not survive the tab, and the site will not remember a language you pick. Everything readable without an account works with cookies blocked entirely. Signing out clears both session cookies and ends the session on our side, so a copy of either is no longer any use to anyone; the theme, the language and the Studio’s layout are preferences rather than part of your session, so signing out leaves them alone.

If we ever set anything that is not strictly necessary, the consent mechanism ships in the same release rather than afterwards — and a refusal will be as easy as an acceptance.

Who else touches it

We use a small number of processors and each one exists for a stated reason: an email provider for the email we send and the email you send us, a payment processor for billing and tax, an analytics provider for the marketing site and the sign-up and sign-in pages if you agree to it, infrastructure for hosting, storage and backups, and the GPU computers our AI models run on. Where they act for us, each is bound to process data only on our instructions. One more service touches your data, but not as our processor: WhatsApp, if you choose to message us there.

Two of them also use some of the data for purposes of their own, and for those they are not our processors but independent controllers, answerable under their own privacy policies: Google, for the purposes it uses analytics data for itself, and Stripe, for preventing fraud, meeting its compliance and legal obligations, and the other purposes its own policy names.

We do not sell personal data, we do not share it for advertising, and we do not hand it to data brokers. If we are ever legally compelled to disclose something, we will tell you unless we are prohibited from doing so.

Your audio is stored on servers we administer, with storage we operate. One provider below, which rents us GPU computers, processes it while one of our AI models works on it, and keeps none of it afterwards. The next three hold the personal data that is not audio — your email address and what we send you, payment data, and analytics data — and the last, WhatsApp, carries what you send us there:

• •GPU computing provider — rents us the GPU computers our AI models run on, located in the European Economic Area. When a job needs a model, one of those computers receives the audio of that job, already decoded, with the name and technical details of the file, runs the model, and sends the result back to our servers. The audio travels encrypted in both directions and is decrypted only into that computer's memory; our software never writes it to the computer's disk, and the computer deletes its copy when the model's work on that job is done.
• •Email provider (United States) — everything we send by email: address confirmation, sign-in codes, security notices, receipts, and notices about your plan, your packs and your account — among them a reminder before every renewal and, when you cancel, a confirmation with the date it takes effect — and the occasional list mail described above if you asked for it; and the email you send us, which reaches us through it. Receives your email address and the contents of the messages we send you and of the messages you send us, and nothing else; we do not have it report opens or clicks back to us.
• •Stripe (United States and Ireland) — payments. Receives your email address, your billing address, your card details and what you bought; we receive an identifier, your plan and your invoice history, and never your card number. It takes payment for us, and is an independent controller for the purposes described above. It was named here before paid plans opened and before any charge was taken, which is the point — for everyone who pays, this notice came first.
• •Google Analytics (United States and Ireland) — how the marketing site and the sign-up and sign-in pages are used, and only for visitors who agreed to it. Receives page addresses, referrers, an approximate location from your IP address and your device type, and, from the sign-up pages, the fact that an account was created; never your audio, your account or your email address, and nothing at all from the Studio. It measures for us, and is an independent controller for the purposes described above.
• •WhatsApp, a Meta company — messages you choose to send us there. It carries the conversation under its own terms and privacy policy, as an independent controller for that service and not as our processor. Receives your phone number, your profile name and picture, and everything you send in the chat, including any files. We read and answer in the WhatsApp Business app on our support phone, +1 774 699 6016, and the conversation stays there: it is not copied into your Euphona account or onto our servers, and chat backup on that phone is off. Pressing the WhatsApp button takes you to WhatsApp, which sees that visit under its own privacy policy; nothing is sent to it before you press.

Sign-in is not delegated to anyone. Accounts, sign-in codes and sessions run on our own machines: a code is a one-time secret that expires after fifteen minutes and is stored only as a hash, never in a form that can be read back, and sessions are records we can revoke. If you sign in with Google, Google confirms who you are and we store the identifier they return — they are not told what you do here, and we never receive your Google password.

For any processor we add after you become a customer, the data processing agreement promises thirty days’ notice before it touches anything of yours. It is a period you can object during, not a formality: write to privacy@euphonaai.com and if we cannot accommodate you, you can leave and we refund what you have not used. Each processor is engaged under data-protection terms that protect your data at least as well as this policy does.

What our own staff can see

Enough to help you and no more. Support tooling shows job records, error traces and account state — not the contents of your audio. Reading a customer record is itself recorded, in a separate append-only store, so the question “who looked at my account” has an answer that does not depend on anyone's memory or honesty.

How long we keep it

• •Audio and results — until you delete them. Deleting is immediate in the service.
• •Backups — deleted material can survive in encrypted backups for up to 31 days, after which the backup holding it is deleted. Restoring a backup never resurrects something you deleted into your live account.
• •Free tool uploads — the browser-based tools upload nothing. The vocal remover’s upload, and the two parts made from it, are purged within twenty-four hours, automatically, unless you sign up and move the result into your account — from then on it is kept like any other file in a workspace.
• •Account and billing records — kept while your account is open, and afterwards only as long as tax and accounting law requires.
• •Technical logs — a short rolling window, then gone.
• •Webhook notices — the log of each notice, and of our attempts to deliver it, is deleted 30 days after the notice, or sooner if its job or your account is deleted. A web address you registered, and its secret, stay until you remove them or close your account.
• •WhatsApp conversations — kept in WhatsApp on our support phone until we delete them.
• •The mailing list — your address stays until you unsubscribe or ask us to delete it. There is no automatic expiry, and an address that is never confirmed is kept unconfirmed rather than removed on a timer — it is never mailed again, but we are still holding it, and that is worth saying plainly rather than leaving you to assume it aged out. Unsubscribing keeps the do-not-mail line described above. We also keep a record of which broadcast went to which address, so that a send interrupted halfway cannot deliver the same message to the same person twice.
• •Dormant free workspaces — once inactive for more than ninety days, stored source files may be reclaimed following three emails over a thirty-day period. Paid workspaces are never reclaimed this way.

Where the law requires us to keep data, for example for a legal claim, deletion can be delayed until that obligation ends.

Your rights, and how to use them

Depending on where you live you have rights to access, correct, delete, export, restrict or object to our processing of your personal data, and to complain to your data-protection authority. We apply all of them to everyone rather than checking your address first — the alternative is a worse product for people whose legislature has been slower, and we would rather not build the check.

Where your own law gives you more, you have it. If the data-protection law that applies to you gives you a right this policy does not list, you have that right too, and you use it the same way as the others: in your account where it is self-serve, or by writing to privacy@euphonaai.com.

Deletion and export are self-serve in your account, which is deliberate: a right you have to write an email to exercise is a right with friction on it, and friction is how these rights are usually defeated in practice.

If you are in the United States, the state laws that now cover most of the country add a right to know what we collect and why, to delete it, to correct it, to take a copy, and to opt out of its sale or of targeted advertising. There is nothing to opt out of here — we sell nothing, share nothing for advertising, and run no targeted advertising — but the right exists regardless of whether we exercise the practice, so it is stated rather than assumed away. We also honour the Global Privacy Control browser signal, and publish that as a machine-readable file so the claim is checkable without taking our word for it.

If we refuse a request, you can appeal it. Reply to our refusal, or write to the address below with “appeal” (or the word for it in your language) in the subject, and a different person reviews it. You will get an answer within sixty days with the reasoning, and if we still say no, we will tell you how to complain to your state attorney general. Several state laws require this; we would rather describe it as a route you can actually walk than as a clause you have to find.

For anything the self-serve path does not cover, write to privacy@euphonaai.com. We will verify who you are before acting — impersonating you is otherwise a way to have your work deleted — and we log each request and its outcome.

Where it is processed

Your audio is stored on our own servers in the European Economic Area and processed there, or, while one of our AI models works on it, on GPU computers we rent in the European Economic Area. Email you send us is received through our email provider, which may process it in the United States. A message you send us on WhatsApp is carried by WhatsApp, whose own privacy policy says where it processes data, and we keep it only in the app on our support phone. Where a processor listed above operates elsewhere — email, payments, analytics — transfers to it rely on the safeguards the law provides, such as the European Commission’s standard contractual clauses or an adequacy framework, and the countries involved are stated beside each processor.

How it is protected

Encryption in transit and at rest; signed and expiring access to every audio object; per-workspace storage separation; sandboxed decoding of untrusted media; audited internal access; encrypted backups on a fixed, bounded cycle.

The security page describes all of this in more detail. Read it here. If you find a problem, tell us at security@euphonaai.com.

Changes

If this policy changes materially we will tell you before it takes effect, and the date at the top always reflects the current version. A change that would newly involve your audio in anything is not something we would do by updating a policy page.

We publish this policy in other languages to help you read it. Where a translation and this English version say different things, this version is the one that applies.