Who is responsible
The controller within the meaning of Art. 4(7) GDPR is:
Meler/Buturak GbR (Sonosight GbR) Am Eichenpark 25 30823 Garbsen Germany
Represented by: C. Meler
Email: contact@sonosight.app
We have not appointed a data protection officer because we are not legally required to (Art. 37 GDPR, § 38 BDSG). Please send all privacy questions and requests to the email address above.
Overview
We only process personal data where a legal basis under Art. 6 GDPR applies. We rely on:
- Art. 6(1)(a) GDPR: your consent, which you can withdraw at any time with effect for the future (Art. 7(3) GDPR).
- Art. 6(1)(b) GDPR: performance of our contract with you, or steps you request before entering into one.
- Art. 6(1)(c) GDPR: compliance with legal obligations, in particular tax and commercial record-keeping.
- Art. 6(1)(f) GDPR: our legitimate interests, which we name in each section below.
We do not sell your data. We do not use it for advertising, and we do not use analytics or tracking tools. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR).
Hosting and server logs
Sonosight runs on a virtual private server rented from IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. IONOS processes the data stored on the server on our behalf under a data processing agreement pursuant to Art. 28 GDPR.
When you open our website, your browser necessarily transmits your IP address and technical request data to our server. We use this data only to deliver the website. Our request logs do not store IP addresses. They record the time, the requested path, the response status and the processing time, as well as technical error messages that can contain internal account IDs.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is operating a secure and stable service. Logs are deleted after [Missing: set a maximum retention period for server logs, e.g. 14 days. Log rotation is not yet configured on the server].
Cookies and local storage
Most of the information we store on your device is strictly necessary to provide the service you request. This does not require your consent under § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG):
- Session cookie “better-auth.session_token”: keeps you signed in. It is set when you sign in and expires after 7 days without activity, or when you sign out.
- Theme preference in local storage: remembers whether you chose light or dark mode. It stays in your browser and is never sent to us.
- Your cookie choice in local storage: remembers whether you allowed Google reCAPTCHA, so that we do not ask again on every visit. It stays in your browser and is never sent to us.
Google reCAPTCHA only stores or reads information on your device if you consent (§ 25(1) TDDDG); see “Google reCAPTCHA”. You can change your choice at any time under Cookie settings, which is also linked in the footer of our website.
We do not use analytics, advertising or tracking cookies.
Google Fonts
Our website currently loads fonts from Google Fonts, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When a page loads, your browser connects to Google’s servers and transmits your IP address to Google. Google may also process this data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR).
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a consistent presentation of our website. More information is available in the Google Privacy Policy.
Google reCAPTCHA
To protect our sign-up, sign-in, password-reset and contact forms against automated abuse, we use Google reCAPTCHA v3, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA runs invisibly. It analyses your interaction with the page, such as mouse movements, time spent on the page and the device and browser you use, and transmits this data together with your IP address to Google, which returns a score indicating how likely it is that the request was made by a person. For this purpose Google also sets a cookie (_GRECAPTCHA) on its own domain. Google may process this data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR).
We only use reCAPTCHA if you allow it, either in the notice shown on your first visit or directly on one of the protected forms. Until then, your browser does not connect to Google for reCAPTCHA. Once you have allowed it, reCAPTCHA is loaded when you first send one of the protected forms, and it remains active until you reload or leave our website.
The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). We ask for it to protect our service against automated sign-ups, attacks on login credentials and spam. You can withdraw your consent at any time with effect for the future under Cookie settings. The withdrawal does not affect the lawfulness of processing carried out before it.
Without your consent, the protected forms cannot be sent, because our server only accepts them with a valid reCAPTCHA response. You can still sign up and sign in with Google, GitHub or Apple, and you can contact us by email at contact@sonosight.app.
This site is protected by reCAPTCHA. The Google Privacy Policy and the Google Terms of Service apply to its use.
Creating an account and signing in
You need an account to use Sonosight. You must be at least 16 years old to create one.
When you register with an email address and password, we store your name, your email address, a hashed version of your password, whether your email address is verified, and when the account was created. We send you a link to confirm your email address. Confirmation and password reset links expire after one hour.
For each sign-in session, we store a session token, its expiry time, your IP address and your browser’s user agent. We use this to keep you signed in and to detect misuse of accounts.
The legal basis for the account is Art. 6(1)(b) GDPR. For the IP address and user agent, it is Art. 6(1)(f) GDPR. Our legitimate interest is protecting accounts from unauthorized access.
Signing in with Google, GitHub or Apple
You can also sign in with an existing account from one of these providers:
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. See the Google Privacy Policy.
- GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. See the GitHub Privacy Statement.
- Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. See the Apple Privacy Policy.
If you choose one of these options, you are redirected to the provider and sign in there. The provider then shares your name, your email address, your profile picture where available, and an account identifier with us. We also receive and store the access tokens needed to complete the sign-in. We never receive your password for that provider. If a Sonosight account with the same email address already exists, the sign-in is linked to that account.
Each provider is responsible for its own processing of your data, which may take place in the USA. Google LLC and GitHub, Inc. are certified under the EU-U.S. Data Privacy Framework. Apple relies on EU Standard Contractual Clauses for transfers.
The legal basis is Art. 6(1)(b) GDPR.
Scans, catalog and metrics
When you upload audio files or submit links for a scan, we transmit the file, its file name or the link to ACRCloud PTE. LTD., Singapore. ACRCloud creates an audio fingerprint and matches it against its reference database. We store the ACRCloud file reference with your account so that you can view your results. We also store a checksum of each uploaded file, a fingerprint of its bytes from which the audio cannot be reconstructed, so that we can tell you when you upload the same file twice. It is deleted together with the scan.
We use ACRCloud’s EU region (AWS eu-west-1, Ireland). Under ACRCloud’s terms, content and derived data of projects in an EEA region are processed and stored only within the European Economic Area, including backups, and ACRCloud neither transfers this data outside the EEA nor permits access to it from outside the EEA. ACRCloud does not retain the raw audio after processing. ACRCloud processes this data on our behalf under a data processing agreement pursuant to Art. 28 GDPR, ACRCloud’s Data Processing Addendum.
Please only upload content you are entitled to use. Audio files can contain personal data, such as recorded voices or names in file names.
To show catalog information and streaming statistics, our server queries Chartmetric, Inc. (USA) and Genius Media Group, Inc. (USA). These requests contain only song titles, artist names and track identifiers. They contain no information that identifies you, such as your name, email address or IP address.
We also store which songs you added to your catalog and how many scans and catalog additions you used in the current billing period. We log every request to Chartmetric, including the search term and the account that triggered it, to monitor costs and prevent abuse. We count searches per account and hour to enforce fair-use limits, and each counter is deleted after one hour.
The legal basis is Art. 6(1)(b) GDPR. For the request log and the search limits, it is Art. 6(1)(f) GDPR. Our legitimate interest is controlling costs and preventing misuse of the service.
Payments
Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.
When you create an account, we create a customer record at Stripe with your name, your email address and your internal account ID, so that you can choose a plan without re-entering your details. When you subscribe or buy credits, you enter your payment details directly on Stripe’s checkout page. We never see or store your full card or bank details. We receive and store your Stripe customer ID, your subscription status, your plan and your purchase history. For usage-based billing, we report your usage to Stripe.
Stripe also processes data as an independent controller, for example to prevent fraud and to meet its own legal obligations. Stripe may transfer data to Stripe, LLC in the USA. Stripe, LLC is certified under the EU-U.S. Data Privacy Framework and also uses EU Standard Contractual Clauses. More information is available in the Stripe Privacy Policy.
The legal basis is Art. 6(1)(b) GDPR. For accounting records, it is Art. 6(1)(c) GDPR.
Emails and support
We only send emails that are necessary for the service, such as confirming your email address or resetting your password. We do not send newsletters or advertising. Emails are sent through the mail servers of IONOS SE.
If you contact us by email or through our contact form, we process your email address, your name and the content of your message to answer your request. Messages sent through the contact form reach us as an email. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract with us. Otherwise it is Art. 6(1)(f) GDPR, and our legitimate interest is answering inquiries.
To protect the contact form against spam, we count the messages sent from each IP address. The counter holds your IP address and is deleted after one hour. The legal basis is Art. 6(1)(f) GDPR, and our legitimate interest is keeping the form usable and free of abuse.
Account administration
Authorized members of our team can view account and subscription details, adjust usage counters and credits, and suspend accounts that violate our terms. If an account is suspended, we store the reason and the end date of the suspension.
To resolve support requests, an administrator can temporarily view Sonosight from the perspective of your account for at most one hour. Such sessions are marked in our records.
The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR. Our legitimate interest is providing support and protecting the service.
Transfers outside the EU and EEA
Where personal data leaves the European Economic Area, it is protected as follows:
- Google LLC, GitHub, Inc. and Stripe, LLC (USA): adequacy decision of the European Commission for the EU-U.S. Data Privacy Framework of 10 July 2023 (Art. 45 GDPR).
- Apple: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
- ACRCloud PTE. LTD. (Singapore): no transfer takes place. Your data is processed and stored exclusively within the EEA, and ACRCloud does not permit access to it from outside the EEA.
- Chartmetric and Genius (USA): no personal data about you is transferred.
You can request a copy of the Standard Contractual Clauses from us.
How long we keep your data
- Account data, catalog and scan results: until you delete your account. Deletion takes effect immediately and also cancels any active subscription.
- Sign-in sessions: they expire 7 days after your last activity and are deleted when you sign out or delete your account. Expired sessions are deleted after 30 days.
- ACRCloud: raw audio is not retained after processing. Fingerprints and scan results are deleted when you delete a scan or your account.
- Chartmetric request log: kept for cost accounting. When you delete your account, the link to your account is removed. Entries are deleted after 24 months.
- Payment records: invoices and accounting records are kept for up to 10 years because of statutory retention obligations (§ 147 AO, § 257 HGB). For this reason your customer record and invoices at Stripe remain after you delete your account.
- Your cookie choice: stays in your browser until you change it or clear your browser data.
- Server logs: see “Hosting and server logs”.
Your rights
You have the following rights regarding your personal data:
- Access (Art. 15 GDPR): you can ask whether we process your data and request a copy of it.
- Rectification (Art. 16 GDPR): you can change your name in the account settings. To change your email address or correct other data, email us.
- Erasure (Art. 17 GDPR): you can delete your account at any time in the account settings, or ask us to delete it.
- Restriction of processing (Art. 18 GDPR).
- Data portability (Art. 20 GDPR): there is no self-service export. Email us, and we will send you the data you provided in a structured, commonly used, machine-readable format such as JSON or CSV.
- Objection (Art. 21 GDPR): see the next section.
- Withdrawal of consent (Art. 7(3) GDPR): you can withdraw your consent to reCAPTCHA at any time under Cookie settings.
To exercise your rights, email contact@sonosight.app, ideally from the email address of your account. We respond without undue delay and within one month at the latest (Art. 12(3) GDPR). We may ask you to confirm your identity.
Right to object
Where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims. To object, email contact@sonosight.app.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz Niedersachsen Prinzenstraße 5 30159 Hannover Germany www.lfd.niedersachsen.de
Do you have to provide your data?
You are not legally obliged to provide personal data. However, your name, your email address and, for paid plans, your payment details are necessary to conclude and perform the contract. Without them, we cannot provide the service.
Security
All connections to Sonosight are encrypted with TLS. Passwords are stored only as hashes. Access to our servers is restricted to authorized members of our team.
Changes and language versions
We update this policy when our service or the law changes. The current version is always available on this page. This policy is available in English and German. Both versions have the same content, and in case of discrepancies the German version prevails.