Who is responsible
The controller of your personal data is Margarita Popova, NIF 322938384, Portugal.
Contact: hi@sonicdesk.studio
What we collect
Account data. Your email address, username, display name and avatar colour. We sign you in with a one-time code, so we never store a password.
Content you upload. Audio files, MIDI, project files, links, lyrics, song structure and chords, comments, chat messages, roadmap items and checklists.
Band data. Which bands you belong to, your role in them, and your activity within them (uploads, versions created, comments left).
Billing data. If you subscribe, we store your Stripe customer and subscription identifiers, your plan, and its status. We never see or store your card details — Stripe handles those directly.
Support and feedback. If you send feedback or a bug report, we store the message, your email address, and the page you were on.
Notifications. If you enable push notifications, we store the technical subscription details your browser provides.
Usage data. Anonymous behavioural events — which features are used, which buttons are clicked. These contain no email address, no user identifier and no content.
Technical data. IP address and browser user agent, processed as part of serving and securing the site.
Why we use it, and on what basis
| Purpose | Legal basis |
|---|---|
| Running your account and bands, storing and serving your files | Performance of our contract with you |
| Taking payment and managing subscriptions | Performance of our contract with you |
| Issuing invoices and keeping tax records | Legal obligation |
| Keeping the service secure and preventing abuse | Our legitimate interest |
| Answering your support messages | Our legitimate interest |
| Analytics and advertising measurement | Your consent |
| Push notifications | Your consent |
You can withdraw consent at any time. For cookies and trackers, use the cookie settings on the site; for push notifications, turn them off in your account.
How long we keep it
Your account and content are kept while your account exists.
When you delete your account, your account data and content are removed from our database immediately and permanently. We do not keep backups from which they could be restored.
Two exceptions, which we are required or unable to avoid:
- Invoices and payment records. Portuguese tax law requires us to keep accounting records, including invoices, for ten years. These are retained by us and by Stripe regardless of account deletion.
- Feedback messages. Messages you send through the feedback form are also stored in a separate spreadsheet, which is not connected to your account. Ask us at hi@sonicdesk.studio and we will delete them.
Content you contributed to a band stays with that band if you leave or are removed. This is explained in our Terms of Service.
Anonymous usage data is retained by our analytics providers under their own retention settings.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Correct it if it is wrong
- Delete it — you can delete your account yourself, or ask us
- Export your data in a portable format
- Object to processing based on our legitimate interests
- Restrict processing in certain circumstances
- Withdraw consent where processing is based on it
To exercise any of these, email hi@sonicdesk.studio. We will respond within one month.
If you believe we are handling your data improperly, you can complain to the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt — or to the authority in the EU country where you live.
Children
Sonicdesk is not intended for children under 16. We do not knowingly collect data from anyone under that age. If you believe a child has given us personal data, contact us and we will delete it.
Security
Data is encrypted in transit. Access to the database is restricted by row-level security, so one band's data is not reachable from another's. Payment details never reach our systems.
No service is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will notify you and the CNPD as the law requires.
Changes
We may update this policy. If a change materially affects how we handle your data, we will email you before it takes effect. The date at the top shows when it was last changed.