Privacy Policy

1. Who we are (data controller)

The controller responsible for your data is Szymon Wiatr APROV-IT (NIP / VAT EU: 663 18 396 66), a business registered in Poland. For any privacy question or to exercise your rights, contact us at contact@emusic.tools.

2. Account data and emails about new tools

If you create an account we store your email address, username and a securely hashed password (argon2id - we never store your password in plain text), plus email-verification and password-reset tokens and your login sessions. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). Retention: for as long as the account exists. When you delete it we anonymise the record immediately - the address, username and profile fields are overwritten and the sign-in credentials removed, so what remains cannot be traced back to you.

The sign-up form also has an optional box: “Send me occasional emails about new tools and features”. It starts unticked, and the account works the same either way. You can tick it there or later in your profile. If you do, we store the date and time you ticked it and send those emails to the address on your account. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time: untick “Emails about new tools and features” in your profile, or write to contact@emusic.tools. Unticking deletes the stored date, and if you tick the box again later, that's a new consent with a new date. Withdrawing doesn't affect emails we sent before. Retention: until you withdraw your consent or delete your account. Deleting the account erases the date too.

At sign-up we also record where the visit in which you create the account came from: the utm_source, utm_medium and utm_campaign parameters in the address of the visit's first page or, without them, the domain of the site that sent you to us. It tells us which channels bring accounts and purchases, and lets us settle up with partners: people and schools who recommend the service and receive a share of the payments made by accounts created through their link. Until you sign up, the source waits in your browser (sessionStorage, cleared when the tab closes): in the EEA, the UK or Switzerland only once you accept the cookie banner, elsewhere straight away. A partner's link is the exception. Before you answer the banner we keep it only in the open tab's memory, without writing anything to your device, and receive it with the sign-up form. If you click “Reject”, we receive no source at all, not even a partner, and remove whatever was stored. Legal basis: our legitimate interest in measuring channels and settling up with partners (Art. 6(1)(f) GDPR). Retention: for as long as the account exists. Deleting the account erases this data.

3. In-product survey and interest lists

Once, after a tool has produced a result, we ask a single question - what you do with music - and you can answer “I teach”, “I play in a band”, “I sing” or “none of these”. The answer itself is stored without your name or address: only the choice, the language, which tool asked, the page it asked on and a one-way hash of your IP address (never the address itself), which we use to stop the same person answering a hundred times. If you then choose to leave an email address, we store it to write to you about that one subject and nothing else - no newsletter, no other product news. Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by typing the address into a field that says what it is for. Retention: an address that never becomes an account is deleted after 12 months. Every message we send from these lists carries an unsubscribe link, and you can also ask us to remove you at contact@emusic.tools; withdrawing consent does not affect what we sent before. The same question appears as an optional “I teach music” checkbox when you create an account, which is unticked by default, grants nothing and changes nothing about the account - you can turn it off in your profile at any time.

4. Audio you upload (stem separation & audio editor)

When you use Stem Separation (and related tools such as Karaoke Maker, Acapella Extractor and Drumless Tracks) the audio file you upload is sent to our own processing server, which we run in Poland. The upload itself carries no account identifier: the processing server knows the job only by a random number. Our database keeps a record of the separation (its number, the file's name, its status and when it expires) so that you can come back to it. Signed in, that record belongs to your account. Made without an account, it belongs to nobody, and the browser that made it is recognised by a small signed cookie (section 9); if you create an account before the separation expires, it moves to that account. After every separation our server also works out the song's tempo, key, chords and sections on its own, and when the recording has a vocal part it writes down the sung words with a speech-recognition model that runs on the same server. The words are stored next to the stems and deleted with them. Only whoever made the separation sees the whole text; a shared link shows the first bars of singing. The musical analysis contains no audio, only data derived from it, such as the tempo and the chords, and we keep it in our database and reuse it when the same file is uploaded again. Legal basis: performance of our contract (Art. 6(1)(b)). Retention: without an account, the uploaded audio, the stems and the words are deleted 24 hours after processing. On a free account they are deleted 14 days after processing, and 90 days on a paid one: the longer window is part of what a subscription buys. For a separation that moves to an account, those 14 or 90 days count from the moment it moves. The clock applies to the original upload as well as the stems.

Quality testing (files uploaded from 5 October 2026). To check whether a new or changed separation or analysis model works better than the current one, we may run files uploaded from that date through both and compare the results, by measuring them and by listening to them ourselves. A test happens only within the retention period above and never extends it: when we delete the file, we delete any copy made for the test with it. What we keep from a test contains no audio, only results such as scores, the tempo, the chords or which model did better. Files uploaded before that date are not used this way. Legal basis: our legitimate interest in improving separation and analysis (Art. 6(1)(f) GDPR). You can object at any time by writing to contact@emusic.tools, and from then on we will leave your files out of tests.

AI training (files uploaded from 1 October 2026). We may use files uploaded from that date to train and improve our own AI models, including the ones that separate and analyse music. We do this only within the retention period above and never extend it: when we delete a file, we delete our copy with it. Deleting a file does not undo a model that was already trained on it. Files uploaded before that date are not used this way. Legal basis: our legitimate interest in improving separation and analysis (Art. 6(1)(f) GDPR). You can object at any time by writing to contact@emusic.tools, and from then on we will leave your files out of training.

5. Payments

Paid plans and minute top-ups are sold through Stripe, which runs the checkout page. Your card details go to Stripe directly; we never see or store them. To open a checkout we send Stripe your email address, your username and an internal account number, and Stripe collects the billing details it asks for there, which it uses to calculate the VAT due. From Stripe we get back what we need to give you what was paid for: a customer number, whether a subscription is active and until when, and for each paid invoice its number, the amount, the tax, the currency, your country and the minutes it added. If you have accepted analytics cookies, we also tell Google Analytics that a purchase happened, with the invoice number, the amount and what was bought, never your card or your address. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) and, for invoices and payment records, our obligations under tax and accounting law (Art. 6(1)(c)). Retention: payment records are kept for as long as Polish tax and accounting law requires, including after you delete your account, when our copy is no longer linked to your name or email address. Deleting your account cancels a running subscription at once. Stripe also uses some of this data for its own purposes, such as preventing fraud and meeting its own legal obligations, as its privacy policy describes (stripe.com/privacy).

6. Analytics, session replay and product improvement

To understand how the site is used we use Google Analytics 4 (ID G-6R2WFNCKK0), LogRocket (session replay that records interactions and may identify signed-in users by email, name and username) and Contentsquare (heatmaps, session recordings and analysis of the paths visitors take through the site). These tools may record page interactions and set cookies. Google Analytics 4 loads on every page. If you are in the EEA, the UK or Switzerland it starts in a restricted mode (Google Consent Mode) in which nothing is stored on or read from your device and no analytics cookie is set - we receive aggregate, cookieless measurement only, on the legal basis of our legitimate interest in knowing which pages are used (Art. 6(1)(f) GDPR). It switches to normal operation, and may set cookies, once you accept our cookie banner. Outside those regions it runs normally from the start unless you decline. LogRocket and Contentsquare are treated differently: wherever you are, they do not start at all until you accept the banner, because a session recording has no cookieless equivalent. Legal basis for those, and for analytics cookies: your consent (Art. 6(1)(a) GDPR / ePrivacy). You can change your answer at any time via the Privacy settings link in the footer, without affecting processing already carried out - withdrawing reloads the page so that any recording already running stops. Wherever you are, you can also use each provider's own opt-out (e.g. the Google Analytics Opt-out Add-on).

7. Advertising

We show Google AdSense ads on some pages. If you are in the EEA, the UK or Switzerland, Google's certified consent management platform asks whether you agree to the advertising purposes; if you agree, Google and its partners may set cookies or read device identifiers to select and measure personalised ads, and if you do not, ads are limited to non-personalised ads or are not shown at all. Advertising consent is separate from our own cookie banner: it is asked for, recorded and withdrawn in Google's own dialog. Google explains how it uses data from sites that use its services at policies.google.com/technologies/partner-sites.

8. Affiliate links

Some pages contain affiliate links to Amazon, marked as such next to the links themselves. We do not send Amazon any data about you. If you click one, Amazon receives the information any website receives from a visitor (such as your IP address and browser) and may set its own cookies in order to attribute a later purchase to us; that processing is governed by Amazon's own privacy notice. We earn a commission on qualifying purchases at no extra cost to you.

9. On-device storage

We use your browser's cookies and localStorage to remember preferences (such as language and theme) and to keep in-app data like recent tools and ear-training progress on your device. This on-device data stays in your browser until you clear it and is not, by itself, sent to us. One cookie serves the service itself: after a separation made without an account, a signed cookie (httpOnly, 7 days) lists the separations this browser made, so that only this browser sees their analysis and whole words, can share them and can move them to an account. It holds nothing else and is not used for analytics or advertising.

10. Who we share data with (processors) and international transfers

We share data only with service providers who process it on our behalf: Supabase (database hosting, EU region), Vercel (website hosting), Stripe (payments), Google (Analytics and AdSense), LogRocket, Contentsquare, Resend (transactional email) and Cloudflare (Turnstile, the check on the sign-up form that tells people from scripts and receives your IP address and details about your browser for that). The stem-separation server is our own hardware in Poland, not a third party. Several of these providers are established in the United States, so using the service involves transfers of personal data outside the EU/EEA. Those transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses. We do not sell your personal data.

11. Your rights

Under the GDPR you have the right to access your data; to rectify inaccurate data; to erasure; to restrict or object to processing; to data portability; and to withdraw consent at any time without affecting prior processing. To exercise any of these, contact contact@emusic.tools. You also have the right to lodge a complaint with a supervisory authority - the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland or the authority in your country of residence.

12. Security

Passwords are hashed with argon2id and traffic is encrypted in transit (HTTPS). No method of transmission or storage is completely secure, but we take reasonable technical and organisational measures to protect your data.

13. Children

eMusic.Tools is not directed to children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the 'Last updated' date above; please review it periodically.

15. Contact

For any question about this policy or your data, email contact@emusic.tools or use the Contact page.