Privacy Policy

Last updated: March 2026

1. Data Controller

The data controller for personal data processed through TrueNote is:

2. Data Collected

TrueNote collects and processes the following categories of personal data:

• Account data: email address, name, account type (artist, label, distributor, etc.). Collected at registration and updated by the user.
• Audio files: uploaded tracks are stored temporarily during analysis only. Files are deleted immediately after analysis is complete.
• Audio fingerprints: a non-reversible acoustic fingerprint derived from each analysed track. Stored permanently to prevent duplicate analyses.
• Analysis results: AI probability scores, layer outputs, and final certification status. Stored permanently and linked to the track.
• Payment data: payment transactions are processed by Stripe Inc. TrueNote does not store card numbers or full payment details.
• Usage data: access logs, IP addresses, and in-app interactions used for security and service improvement.

3. Legal Basis for Processing

• Contract (GDPR Art. 6(1)(b)): processing of account data, audio files, fingerprints, analysis results, and payment data is necessary for the performance of the service agreement.
• Consent (GDPR Art. 6(1)(a)): newsletter and marketing communications are sent only with explicit opt-in consent, which can be withdrawn at any time.
• Legitimate interest (GDPR Art. 6(1)(f)): usage data and access logs are processed for security monitoring and fraud prevention.

4. Data Retention

• Account data: retained until the account is deleted by the user or by TrueNote.
• Audio fingerprints: retained until the associated account is deleted.
• Temporary audio files: deleted immediately after analysis is complete.
• Payment records: retained for 7 years in accordance with Belgian accounting law (Loi du 17 juillet 1975 relative à la comptabilité des entreprises).

5. Sub-processors

TrueNote uses the following sub-processors to deliver its service:

• Stripe Inc (USA) — payment processing. Data transfers to the USA are covered by Standard Contractual Clauses (EU SCCs) as per GDPR Art. 46.
• Brevo SAS (France) — transactional and marketing email delivery. EU-based processor.
• Hetzner Online GmbH (Germany) — server hosting and infrastructure. EU-based processor.

6. Your Rights (GDPR Art. 15–22)

As a data subject under the GDPR, you have the following rights:

• Right of access (Art. 15): obtain a copy of your personal data.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion of your personal data ("right to be forgotten").
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interest.

To exercise any of these rights, use our contact form. We will respond within 30 days.

You also have the right to lodge a complaint with the Belgian Data Protection Authority (APD/GBA): www.dataprotectionauthority.be

7. Cookies

TrueNote uses strictly necessary session cookies for authentication and CSRF protection. No third-party tracking cookies or advertising cookies are used.

For any questions regarding this Privacy Policy, use our contact form.