Data we collect

You provide

• Account info: name, email, username.
• Linked-service data via OAuth: service ID, display name, library or playlist metadata and playback context we are permitted to read or write, and access/refresh tokens. We do not receive your third-party password.
• User Content: photos you capture or upload, prompts, tags, feedback, and preferences.
• Purchases: plan, transaction IDs, and limited billing details from our processor. We do not store full card numbers.

Collected automatically

• Device and app data: device type, OS, app version, language, time zone, identifiers, crash logs.
• Usage data: feature use, session events, referral source, in-app interactions.
• Network data: IP address and coarse location derived from IP.

From third parties

• Linked services (Spotify/Apple/TIDAL) per your permissions.
• Analytics, attribution, and error-reporting vendors.
• If you consent, marketing platforms.

How we use data

• Authenticate and link your music service.
• Run SoundStylists: analyze photos to generate music styling and recommendations.
• Create, edit, or organize playlists on your linked service when you request it.
• Personalize features, content ordering, and UX.
• Provide customer support and communicate about changes.
• Process payments and prevent fraud.
• Protect security and enforce terms.
• Comply with legal obligations.
• Model improvement. In the future we may use de-identified usage data to improve algorithms. We will only use your photos and generated outputs for model training beyond your session if you opt in. You can change this at any time in settings should this feature become available.

Legal bases (EEA/UK)

• Contract: to provide the Service you request.
• Legitimate interests: product improvement, security, fraud prevention, analytics, anonymization.
• Consent: optional marketing, cookies where required, and any training on your photos/outputs beyond your session.
• Legal obligation: tax, accounting, compliance.

Sharing

• Vendors/Processors: cloud hosting, CDNs, analytics, crash reporting, customer support, payment processing. Bound by contract to process on our instructions.
• Music partners: Spotify, Apple Music, TIDAL as needed to fulfill requested actions and subject to their APIs and policies.
• Business transfers: merger, acquisition, financing, or sale of assets.
• Legal: to comply with law, protect rights, users, or the Service.
• With your consent: for any other sharing you authorize.

We do not sell personal data. We do not share for cross-context behavioral advertising without your consent where required.

Data retention

We keep personal data while you have an account and for as long as necessary for the purposes above, then delete or de-identify it. Photos used for SoundStylists are retained per your settings: ephemeral processing by default, with an option to save to your history. Logs and backups are kept for limited periods.

Your choices and rights

• Access, correct, delete, or export your data.
• Object or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Opt out of marketing communications.
• Disable training use of your photos/outputs at any time.

Submit requests at jarvis@cymatiq.com. We will verify your request and respond as required by law.

Children

The Service is not for children under 13 or under the minimum age in your country. We do not knowingly collect data from children. If you believe we have, contact us to delete it.

Security

We use technical and organizational safeguards, including encryption in transit, access controls, and least-privilege practices. No system is 100% secure.

International transfers

We may transfer data to the United States and other countries that may not provide the same level of protection. Where required, we use approved safeguards such as Standard Contractual Clauses and conduct transfer impact assessments.

Cookies and similar tech

We use necessary cookies for core functions and, with consent where required, analytics and performance cookies. Manage preferences in the app or your device settings.

Do Not Track / Global Privacy Control

We honor legally recognized signals where applicable.

California and similar laws

Residents of California, Virginia, Colorado, Connecticut, and Utah have rights to know, access, delete, correct, and opt out of certain disclosures. We do not sell personal information as defined by CPRA. Sensitive data (e.g., photos that could reveal biometric traits) is processed only to provide features you request and, if applicable, with consent for training. You may use an authorized agent. Non-discrimination: we will not discriminate for exercising rights.

Changes

We will update this Policy from time to time. Material changes will be notified in-app, by email, or on our site. Continued use after the effective date means you accept the updated Policy.

Contact

Privacy inquiries and rights requests: jarvis@cymatiq.com