Privacy Policy

Last updated: September 28, 2026

At Music Pro (“we”, “us”, “our”), we are committed to protecting your personal privacy. Our architecture is built on the principle of data minimization: we collect only the personal information strictly necessary to operate our service, deliver our tools, and secure your account.

We do not sell personal data, do not engage in behavioral advertising, and do not track you across other sites or applications.

1. Data controller and contact

The data controller responsible for personal data processed through Music Pro is:

Music Pro
Email: privacy@musicpro.app
Support: support@musicpro.app

2. Personal data we collect and why

A. Account and authentication information

When you sign up or sign in to Music Pro (via email magic link or optional Google Sign-In), we collect:

• Email address: Used as your unique account identifier, to deliver authentication magic links, send purchase receipts, and communicate critical service notices.
• Name and profile image: If you choose to sign in with Google, we receive the display name and avatar URL associated with your Google account for account personalization.
• Session and security metadata: When an active session is created, our authentication system records the IP address and browser user-agent string to maintain session integrity and protect your account against unauthorized access or hijacking.
• Verification tokens: Short-lived, single-use authentication tokens generated when you request an email sign-in link. These tokens expire automatically after 5 minutes.

B. Prepaid credits and tool usage ledger

Music Pro maintains an authoritative server-side ledger to record credit transactions:

• Credit balance and transactions: We record every credit grant (such as free promotional sign-up credits or purchases) and deduction (when you run a tool).
• Tool execution records: We log tool activity, including the tool name, action performed, credit amount, and timestamp.
• Transience of creative files: Audio files and stems that you process through our web tools are processed transiently to generate outputs (such as MIDI). We do not retain, archive, or train public models on your proprietary music or audio files.

C. Payment and billing information

Credit pack purchases are billed through our third-party payment processors, Polar and Payhip.

• Zero payment card storage: All payment card numbers, expiry dates, and CVC security codes are submitted directly to the payment processor. Music Pro never receives, processes, or stores your payment card details on our servers.
• Purchase metadata: We store only non-sensitive transaction references, including a customer ID, checkout or order ID, amount paid (USD), credits allocated, masked receipt information, and timestamp for fulfillment and accounting.

D. Technical and abuse-prevention logs

• Edge infrastructure logs: Request routing, security filtering, and DDoS protection logs are processed by our edge network provider, Cloudflare.
• Rate limiting: Client IP addresses are temporarily logged on promotional credit redemptions to prevent automated bot abuse and multi-account farming. These IP addresses are scrubbed after 90 days.

3. Legal bases for processing (GDPR / UK GDPR)

Under the General Data Protection Regulation (GDPR) and UK GDPR, we process your personal data under the following lawful bases:

• Performance of a Contract (Art. 6(1)(b)): Processing necessary to create and manage your account, authenticate sign-ins, process credit purchases, execute requested tool operations, and provide customer support.
• Legitimate Interests (Art. 6(1)(f)): Processing necessary to maintain platform security, protect against fraud or abuse, diagnose system errors, and ensure service continuity.
• Compliance with Legal Obligations (Art. 6(1)(c)): Processing necessary to fulfill statutory tax, accounting, and financial reporting requirements regarding commercial transactions.

4. Third-party processors (sub-processors)

We partner with select third-party service providers to deliver our infrastructure and services. Each provider processes data under strict contractual data protection terms:

No advertising or tracking networks: We do not integrate tracking scripts, advertising networks, social media trackers, or third-party behavioral analytics services (such as Google Analytics or Meta Pixel).

5. Data retention and deletion schedule

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Account profile data: Retained for the lifetime of your account. Upon a verified account deletion request, your profile, authentication credentials, and active sessions are permanently erased.
• Active sessions: Expire automatically after 7 days of inactivity (or immediately upon sign-out).
• Verification tokens: Expire automatically within 5 minutes of generation.
• Credit transaction & purchase records: Retained for 7 years to comply with mandatory statutory tax and accounting retention requirements. Following account deletion, historical financial ledger entries are de-identified so they can no longer be associated with your identity.
• Abuse prevention IP addresses: IP addresses stored in connection with sign-up bonus validation are automatically scrubbed to null after 90 days.
• Database backups: Automated point-in-time recovery snapshots (Cloudflare D1 Time Travel) cycle out and are permanently overwritten within approximately 30 days.

6. Your data rights

Under applicable data protection laws (including the EU GDPR, UK GDPR, and California Consumer Privacy Act / CPRA), you have enforceable rights regarding your personal data:

• Right of Access: You may request confirmation of whether we process your personal data and receive a copy of that data.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure (“Right to be Forgotten”): You may request deletion of your personal data, subject to statutory retention exceptions (such as tax and accounting obligations).
• Right to Restriction: You may request that we restrict processing of your data under specific statutory circumstances.
• Right to Data Portability: You may request your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You may object to data processing based on legitimate interests.
• Non-Discrimination: We will never deny services, charge different prices, or provide a different level of quality for exercising your privacy rights.

To exercise any of these rights, please email us at privacy@musicpro.app. We will respond to verified requests within one month (or within statutory deadlines).

You also have the right to lodge a complaint with your local supervisory data protection authority (such as the Information Commissioner's Office in the UK or your competent Data Protection Authority in the EU).

7. Children's privacy

Music Pro is designed for music producers, audio engineers, and creative artists. Our services are not directed to children under 13 years of age (or under 16 in the European Economic Area and United Kingdom). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at privacy@musicpro.app, and we will promptly delete such information.

8. Data security

We implement rigorous technical and organizational safeguards to protect your personal data against unauthorized access, loss, alteration, or disclosure:

• All network communications are encrypted in transit using modern TLS/HTTPS.
• Session credentials use HttpOnly, Secure, and SameSite cookie attributes.
• Database access is strictly restricted to server-side Worker operations.
• API keys, secrets, and environment credentials are encrypted and never exposed to the client.

9. International data transfers

Because our infrastructure relies on globally distributed edge networks (including Cloudflare, Polar and Payhip), your information may be processed in servers located outside your home country, including in the United States. Where personal data is transferred internationally, we rely on standard contractual clauses approved by the European Commission and UK authorities to ensure an equivalent level of protection.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory changes. Any modifications will be posted here with an updated “Last updated” date. Material changes will be communicated via notice on our website or direct email where appropriate.