Privacy notice

Controller

One Properties Korlátolt Felelősségű Társaság; registered office: 1039 Budapest, Királyok útja 245.; company registration number: 01-09-941251; tax number: 22736529-2-41. Privacy contact: [email protected].

This notice covers the Mastering Studio website, studio workspace, Player app and cloud service. Számlázó API, used for our own invoicing, is operated by the same company and is not a separate controller. We process data necessary for the service; your local music library is not uploaded automatically.

Data, purposes and legal bases

Processing necessary for contractual performance and pre-contractual steps relies on GDPR Article 6(1)(b); legal obligations on (c); security and demonstrable legal claims on (f). You may object to processing based on legitimate interests. Where consent applies, the basis is (a), and consent may be withdrawn.

• Account and sign-in: email, account identifier, authentication and session data for access, authorisation and account security (contract and legitimate interests). Supabase authenticates passwords.
• Studio work and cloud: project and file names, audio, metadata, versions, invitees, timestamped comments, shared EQ profiles and storage usage for performance, playback, synchronisation and requested sharing (contract). Recordings may contain personal data, such as voices.
• Contact and suggestions: reply address and submitted message. Support relies on performance or preparation of a contract; voluntary suggestions rely on legitimate interests in improving the service and replying. Complaint handling is a legal obligation. Sending a message does not subscribe you to a newsletter.
• Billing: customer name, address, tax number where required, email, plan, payment and invoice identifiers, amount and currency for payment, invoicing and accounting (contract and legal obligation). We do not store full card details.
• Security and technical data: IP address, request and error signals, authorisation events and short-lived anti-abuse and deduplication fingerprints for security and troubleshooting (legitimate interests). The form does not automatically send audio, full device logs or passwords.

Local use and sharing

The Producer library, local EQ presets and private notes are stored on your device. Upload or cloud sync transfers the selected data to the service. Device backup behaviour may also depend on device and Apple settings.

Participants authorised by the studio or project owner can see the files, versions and comments shared with them. Share only content you are entitled to share. Where a business customer uploads other people’s personal data, the parties’ roles and processing terms must be determined according to the actual task.

Providers and recipients

One Properties Kft. operates its own application, mail and related internal systems. External providers listed below may access data required for the relevant feature.

• Contabo GmbH: hosting for our servers and related infrastructure. Relevant data includes web requests, application and mail data depending on the system.
• Supabase Pte. Ltd.: managed account authentication and database; account, workspace, comment, authorisation and billing-status data. We do not claim all data remains exclusively in Hungary.
• Cloudflare, Inc.: traffic handling, protection and R2 object storage; technical request data, uploaded audio and metadata according to the feature used.
• Hetzner Online GmbH: storage of encrypted backups for related self-operated systems. This does not mean every R2 or Supabase dataset has a separate full backup.
• Stripe Payments Europe, Limited: web payments, subscriptions and fraud prevention; customer and transaction data needed for payment. It may also act as an independent controller for its own statutory purposes.
• Apple: iOS distribution, App Store purchases, purchase restoration and device system functions under its own terms. Player may process purchase receipts and entitlement data; it does not receive card numbers.
• NAV and other competent authorities: invoice data required by law or data covered by mandatory requests. Authorities are not the Provider’s processors.

Retention and deletion

We process account and workspace data during the service relationship and as necessary for each purpose. Retention of cloud files, studio material and comments depends on ongoing work, sharing and deletion requests. There is no universal automatic deletion deadline for all material. When a purpose ends, data not subject to legal obligations is deleted or anonymised.

Manual review of deletion requests does not permit indefinite retention. We individually review the request, associated orders and accounting data to be separated. We generally provide information about data-subject requests within one month, including notification of any justified GDPR extension and its reasons.

Invoices and supporting accounting documents are retained for at least 8 years; written consumer complaints and responses for 3 years. Suggestions and support correspondence are processed for as long as necessary to resolve the matter and for justified follow-up. In a dispute, relevant portions may be retained separately as necessary for legal claims.

Form deduplication and anti-abuse memory retains fingerprints and sending status for up to 1 hour. No separate administrator support-case database is created. Email goes to our mail system. Copies in backups can be removed as the applicable backup cycle expires; previously approved deletions must be reapplied after restoration.

Security and international transfers

We use encrypted transport, role-based access, server-side authorisation and confidential credentials. File download permissions and app entitlements do not replace privacy rights. We do not promise absolute security or unlimited recoverability.

Supabase and Cloudflare are international providers; international operation of the listed systems may involve processing outside the EEA. Such transfers require appropriate GDPR safeguards, such as an applicable adequacy decision or standard contractual clauses and necessary supplementary measures. Ask our privacy contact for information about a specific transfer and its safeguards.

Cookies, local storage and external content

We use session data, cookies or local storage needed for sign-in, and secure token storage in the app. Your personal library and downloaded studio audio occupy device storage. We have not introduced advertising or behavioural tracking for the workspace or this contact form. Measurement requiring consent may only be used after appropriate prior notice and consent.

Opening an external link invokes that provider’s own data processing. Using an external reference source may establish the connection needed for the requested service; this does not make your personal audio library public.

Your rights and remedies

You may request access, rectification, erasure, restriction and statutory data portability. You may object to processing based on legitimate interests and withdraw consent. GDPR sets the conditions; erasure does not override mandatory accounting retention.

Send requests to [email protected]. Where necessary, we may request proportionate identity verification. You may complain to Hungary’s National Authority for Data Protection and Freedom of Information (https://naih.hu) and seek judicial remedies. The service does not make solely automated decisions based on personal data that produce legal effects.

Website usage statistics

We use self-hosted Umami to understand visits and key contact or service links on public pages, and the main steps in the self-service audio editor: opening a local file, trying and applying tools, reviewing prices, opening checkout and preparing a download. Measurement does not use analytics cookies. It includes browser and device characteristics and the referring domain; visit identifiers are not linked to your account. We do not send audio, filenames, speaker samples, form contents, account or order identifiers, or URL query strings and fragments. We do not record sessions, heatmaps or keystrokes. Private studio, admin, upload and account pages are excluded.