Privacy policy
Last updated : 14 June 2026
The French version prevails.
This policy explains what personal data Carmina processes, why, and how to exercise your rights. Data controller: Julien Muraccioli (Carmina), 9 rue Cdt Luce Casabianca, 20200 Bastia, France — [email protected].
1. Data we process
- Account: your email address, and a display name if you set one.
- Audio files you upload, for the time needed to produce your result.
- Audio fingerprints: numeric characteristics extracted from your tracks (brightness, loudness, dynamics, width, estimated genre…). These are numbers and cannot be used to reconstruct your audio.
- Usage & credits: processing history, balance and credit movements.
- Technical data: IP address, logs, needed for operation and security.
- Payment (upcoming): handled by a payment provider; we do not store card data.
2. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage your account, sign you in (magic link) | Contract |
| Process your files and deliver the result | Contract |
| Manage credits and billing | Contract / legal obligation |
| Security, abuse prevention | Legitimate interest |
| Keep fingerprints to improve Carmina | Legitimate interest, with opt-out |
3. Raw audio and improving Carmina
We do not train AI on your raw audio. Your files are processed to produce your result, then not kept for improvement purposes. Only the numeric fingerprint may be retained to refine the tool. You can turn this off at any time from your account (“Settings”). Opting out does not affect the quality of your processing.
4. Recipients and sub-processors
| Provider | Role | Location |
|---|---|---|
| Supabase | Accounts, database (email, credits, fingerprints) | European Union (Paris) |
| Cloudflare | Site hosting and file storage | EU / international |
| Modal | Compute (analysis, mastering, processing) | United States |
| Anthropic (Claude) | Generating diagnostic explanations | United States |
| Resend | Sending emails (sign-in link) | European Union |
| Payment provider | Credit payments (upcoming) | EU / international |
Transfers outside the EU: some processing (Modal, Anthropic) takes place in the United States, framed by appropriate safeguards (EU Standard Contractual Clauses).
5. Retention
- Account: while it exists; deleted on request.
- Audio files: kept for up to 30 days (for processing and re-download from your history), then automatically deleted.
- Fingerprints: kept unless you opt out or your account exists.
- Billing: as required by accounting and tax obligations.
6. Your rights
You have rights of access, rectification, erasure, restriction, objection and portability. You can:
- edit your display name and opt out of fingerprint retention from your account;
- delete your account (and associated data) from your account, “Settings”;
- contact us at [email protected].
You may also lodge a complaint with the French CNIL (cnil.fr).
7. Cookies and local storage
The site only uses local storage strictly necessary for your session. No advertising cookies or analytics trackers, so no consent banner is required for this essential storage.
8. Security
Access is protected (passwordless single-use link sign-in, per-user data isolation). We apply reasonable measures to protect your data.