Last updated: September 2026
This policy explains what personal data eMusic.Tools collects, why we collect it, who we share it with and the rights you have. We aim to collect as little as possible and to be honest about what leaves your device.
The controller responsible for your data is Szymon Wiatr APROV-IT (NIP / VAT EU: 663 18 396 66), a business registered in Poland. For any privacy question or to exercise your rights, contact us at contact@emusic.tools.
If you create an account we store your email address, username and a securely hashed password (argon2id - we never store your password in plain text), plus email-verification and password-reset tokens and your login sessions. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). Retention: for as long as the account exists. When you delete it we anonymise the record immediately - the address, username and profile fields are overwritten and the sign-in credentials removed, so what remains cannot be traced back to you.
Once, after a tool has produced a result, we ask a single question - what you do with music - and you can answer “I teach”, “I play in a band”, “I sing” or “none of these”. The answer itself is stored without your name or address: only the choice, the language, which tool asked, the page it asked on and a one-way hash of your IP address (never the address itself), which we use to stop the same person answering a hundred times. If you then choose to leave an email address, we store it to write to you about that one subject and nothing else - no newsletter, no other product news. Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by typing the address into a field that says what it is for. Retention: an address that never becomes an account is deleted after 12 months. Every message we send from these lists carries an unsubscribe link, and you can also ask us to remove you at contact@emusic.tools; withdrawing consent does not affect what we sent before. The same question appears as an optional “I teach music” checkbox when you create an account, which is unticked by default, grants nothing and changes nothing about the account - you can turn it off in your profile at any time.
When you use Stem Separation (and related tools such as Karaoke Maker, Acapella Extractor and Drumless Tracks) the audio file you upload is sent to our own processing server, which we run in Poland. The upload carries no account identifier: the job is known to the server only by a random number, so the file is not linked to you even when you are signed in. We do not use your audio to train AI models. Legal basis: performance of our contract (Art. 6(1)(b)). Retention: uploaded audio and separated stems are deleted 14 days after processing on a free account, and 90 days on a paid one - the longer window is part of what a subscription buys. The clock is set when the job finishes and applies to the original upload as well as the stems.
Paid plans are not yet available to buy, and we process no payment data today. The code and this policy are prepared for them, which is why section 4 already gives retention periods for paid accounts. Before we collect any payment information we will update this section and section 10 (processors), and date the change.
To understand how the site is used we use Google Analytics 4 (ID G-6R2WFNCKK0), Hotjar (ID 6629776, heatmaps and session recordings) and LogRocket (session replay that records interactions and may identify signed-in users by email, name and username). These tools may record page interactions and set cookies. Google Analytics 4 loads on every page. If you are in the EEA, the UK or Switzerland it starts in a restricted mode (Google Consent Mode) in which nothing is stored on or read from your device and no analytics cookie is set - we receive aggregate, cookieless measurement only, on the legal basis of our legitimate interest in knowing which pages are used (Art. 6(1)(f) GDPR). It switches to normal operation, and may set cookies, once you accept our cookie banner. Outside those regions it runs normally from the start unless you decline. Hotjar and LogRocket are treated differently: wherever you are, they do not start at all until you accept the banner, because a session recording has no cookieless equivalent. Legal basis for those, and for analytics cookies: your consent (Art. 6(1)(a) GDPR / ePrivacy). You can change your answer at any time via the Privacy settings link in the footer, without affecting processing already carried out - withdrawing reloads the page so that any recording already running stops. Wherever you are, you can also use each provider's own opt-out (e.g. the Google Analytics Opt-out Add-on, hotjar.com/legal/compliance/opt-out).
We show Google AdSense ads on some pages. If you are in the EEA, the UK or Switzerland, Google's certified consent management platform asks whether you agree to the advertising purposes; if you agree, Google and its partners may set cookies or read device identifiers to select and measure personalised ads, and if you do not, ads are limited to non-personalised ads or are not shown at all. Advertising consent is separate from our own cookie banner: it is asked for, recorded and withdrawn in Google's own dialog. Google explains how it uses data from sites that use its services at policies.google.com/technologies/partner-sites.
Some pages contain affiliate links to Amazon, marked as such next to the links themselves. We do not send Amazon any data about you. If you click one, Amazon receives the information any website receives from a visitor (such as your IP address and browser) and may set its own cookies in order to attribute a later purchase to us; that processing is governed by Amazon's own privacy notice. We earn a commission on qualifying purchases at no extra cost to you.
We use your browser's cookies and localStorage to remember preferences (such as language and theme) and to keep in-app data like recent tools and ear-training progress on your device. This on-device data stays in your browser until you clear it and is not, by itself, sent to us.
We share data only with service providers who process it on our behalf: Supabase (database hosting, EU region), Vercel (website hosting), Google (Analytics and AdSense), Hotjar, LogRocket and Resend (transactional email). The stem-separation server is our own hardware in Poland, not a third party. Several of these providers are established in the United States, so using the service involves transfers of personal data outside the EU/EEA. Those transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses. We do not sell your personal data.
Under the GDPR you have the right to access your data; to rectify inaccurate data; to erasure; to restrict or object to processing; to data portability; and to withdraw consent at any time without affecting prior processing. To exercise any of these, contact contact@emusic.tools. You also have the right to lodge a complaint with a supervisory authority - the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland or the authority in your country of residence.
Passwords are hashed with argon2id and traffic is encrypted in transit (HTTPS). No method of transmission or storage is completely secure, but we take reasonable technical and organisational measures to protect your data.
eMusic.Tools is not directed to children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.
We may update this policy from time to time. Material changes will be reflected by the 'Last updated' date above; please review it periodically.
For any question about this policy or your data, email contact@emusic.tools or use the Contact page.
We use cookies to measure how the site is used and remember your settings. Privacy Policy.