Privacy Policy

• Account information you provide: email, name, username, and (optionally) phone number.
• Content you upload or create: audio stems, recordings, project data, artwork, comments, and related metadata (including the timestamps of your acceptance of our Terms and upload rights confirmations).
• Payment and subscription status from Stripe, our payment processor — we do not store card numbers.
• Technical data needed to operate and secure the service: IP address, device/browser type, authentication cookies, and server logs (including moderation and copyright-report records).

To provide and maintain the service, process payments and subscriptions, enable collaboration and discovery, send transactional email (account, password-reset, and billing messages), enforce our Terms (including copyright and moderation processes), and keep the platform secure. We do not send marketing email without your consent, and we do not sell your personal data.

We share data only with the service providers that run StemShare, under appropriate safeguards:

• Stripe — payment processing and subscription billing.
• Amazon Web Services (Amplify) — hosting for the web application.
• Our backend hosting provider — servers (EU-located) that run the application and store its database.
• Cloudflare (R2) — storage of your uploaded audio and files, delivered from Cloudflare's global network.
• Google Workspace (Gmail SMTP) — delivery of transactional email.

We may also disclose data where the law requires it (for example a valid legal demand, or mandatory child-safety reporting).

We use strictly necessary cookies for authentication and session management. We do not currently use advertising or cross-site tracking cookies. If we add analytics that require consent, we will describe them here and ask first where required.

We keep personal data for as long as your account is active or as needed to provide the service, then delete or anonymise it. Some records survive account deletion where we have a legal basis or obligation — for example billing records, limited trial-abuse records (a keyed hash of your email address, redemption date and AI usage to enforce the lifetime trial), and copyright/moderation records we must keep to operate our repeat-infringer policy.

Tracks, recordings and files you delete — and songs you delete — are kept for 30 days so a mistake can be recovered (write to us within that window), then permanently removed. Content named in a copyright or moderation report may be kept longer as part of those records. Deleting your account does not wait for this window: it is immediate and permanent, as described below.

Depending on where you live (e.g. Canada, the EEA, UK, or California), you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. We honour these requests for all users regardless of location.

To delete your account and personal data, use the "Delete account" control in your account settings (Settings → Danger zone; you confirm with your password). This immediately and permanently deletes your account, songs, stems and uploads, including anything you deleted earlier that was still inside the 30-day recovery window (subject to the retention exceptions above). It also cancels any active subscription and deletes your payment customer record. You can also email support@sylvonyx.com from your account email address and we will process the deletion for you, normally within 30 days.

If you are unsatisfied with our response, you may complain to your local privacy regulator — in Canada, the Office of the Privacy Commissioner (OPC).

We operate from Canada, and our providers store data in the United States (web hosting, payments, email) and the European Union (application database). Uploaded audio and files are stored with Cloudflare (R2) and delivered from its global network. Where GDPR applies, transfers rely on appropriate safeguards such as standard contractual clauses implemented by our providers.

We use reasonable technical and organisational safeguards: encrypted connections (TLS), hashed passwords via our authentication provider, least-privilege access, and server-side entitlement checks. No method of transmission or storage is completely secure. If a breach creates a real risk of significant harm, we will notify affected users and report to the OPC (and other regulators where required) as the law requires, and we keep a breach log.

StemShare is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

We may update this policy as the service evolves. Material changes will be notified (for example by email or an in-app notice) and the "Last updated" date above will change.

Privacy questions and requests: Sylvonyx Technologies, Inc., Attn: Privacy Officer — support@sylvonyx.com.