1. Controller
The controller of your personal data is Websylvania S.R.L., a Romanian SRL, Trade Register No. J26/1084/2014, Sole Registration Code (CUI) 33831774, registered office Str. Negoiului nr. 19, Târgu Mureș, Mureș, Romania. Privacy contact: [email protected].
2. What this covers
How we collect, use, share, store and protect personal data when you use Trackpeel (trackpeel.com).
3. Data we collect and why
| Data | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Email address (sign-in, Google sign-in) | Create/secure your account; deliver “your stems are ready” emails | Performance of a contract (Art. 6(1)(b)) |
| Files you upload (audio/video) and the separated outputs | Run the separation and deliver your results | Performance of a contract (Art. 6(1)(b)) |
| IP address | Rate-limiting, bot/abuse prevention, protecting capacity and cost | Legitimate interests (Art. 6(1)(f)) |
| Approximate country (from network geolocation) | Show correct currency/pricing context; future regional pricing | Legitimate interests (Art. 6(1)(f)) |
| Language preference | Show the app in the right language | Legitimate interests (Art. 6(1)(f)) |
| Purchase/subscription data (plan, status, period, customer/subscription IDs) | Provide and manage paid access | Performance of a contract (Art. 6(1)(b)); legal obligation for records (Art. 6(1)(c)) |
| Analytics events (how you use the app) | Understand and improve the product | Consent (Art. 6(1)(a)) — collected only with your analytics consent (see §9 for how consent works by region) |
| Advertising/online identifiers (cookie & pixel IDs, IP, device/ browser data, ad events such as visit/purchase) | Measure and optimise our ads; share with Meta, Google and TikTok for advertising and conversion measurement | Consent (Art. 6(1)(a)) — collected only with your marketing consent (see §9) |
| Bot-gate token (free path) | Block automated abuse | Legitimate interests (Art. 6(1)(f)) |
We do not ask for or store your payment-card details — those are handled by Lemon Squeezy (see below).
4. About your uploaded files
Your files can contain anything you upload, including recordings owned by others. We process them only to perform the separation you asked for. To cut cost and processing time, we use a content-addressed cache: a file is identified by a cryptographic hash of its audio, and if an identical file has already been separated, the existing result may be reused. This means an output derived from a file can, in principle, be served to another job that uploads a byte-identical file. We do not browse, sell, or use your files to train models, and we do not associate cached audio with your identity. Please do not upload content you are not entitled to upload (see our Acceptable Use Policy).
5. Who we share data with (sub-processors)
We use trusted service providers who process data on our behalf under data-processing agreements:
- Supabase — authentication and database (email, account/job/subscription records).
- Cloudflare R2 — storage of your uploaded files and separated outputs.
- Cloudflare Turnstile — bot/abuse protection (IP + challenge token).
- Modal — GPU processing of your audio (processed transiently; not retained by the worker).
- Vercel — application hosting and request handling.
- PostHog (US Cloud) — product analytics (only if you consent to analytics).
- Google Analytics 4 (Google LLC) — aggregate traffic and usage measurement (only if you consent to analytics).
- Lemon Squeezy — Merchant of Record, payments, billing and tax/VAT invoicing.
- Resend — sending transactional emails (e.g. “your stems are ready”).
- Upstash — rate-limiting counters.
- Google — “Continue with Google” sign-in (if you use it).
If you consent to marketing cookies, we also use the following advertising partners. These pixels share online identifiers (cookie/pixel IDs, your IP address, device/browser data, and ad events such as page visits or purchases) with these platforms so they can measure and optimise our advertising:
- Meta Platforms, Inc. — Meta Pixel (Facebook/Instagram ad measurement and audiences).
- Google LLC — Google Ads conversion tag (Google Ads measurement).
- TikTok — TikTok Pixel (TikTok ad measurement and audiences).
For advertising/measurement, these platforms may act as independent controllers or joint controllers for the data they receive, under their own privacy policies. We do not load any of these pixels unless and until you give marketing consent. We do not sell your personal data.
6. International transfers
Several of our providers are located in or process data in the United States or other countries outside the EEA (including Modal, Vercel, PostHog-US, Lemon Squeezy, Resend, Cloudflare’s global network, and — where you consent to marketing — the advertising platforms Meta, Google and TikTok). Where we transfer personal data outside the EEA, we rely on appropriate safeguards — primarily the European Commission’s Standard Contractual Clauses (SCCs) in our agreements with these providers, and, where applicable, the EU–US Data Privacy Framework (DPF). You can ask us for more detail at [email protected].
7. How long we keep data
- Uploaded files: deleted automatically a short time after processing (target: within 24 hours).
- Separated outputs: kept for a limited period to let you download them (target: 7–30 days), then deleted.
- Account data (email, profile): kept while your account is active; deleted on account deletion (subject to any record we must keep by law).
- Purchase/billing records: retained as required by Romanian tax and accounting law (typically several years).
- Abuse/rate-limit data (IP-derived): short-lived (hours to days).
- Analytics: retained per our analytics settings while you keep consent.
- Marketing/advertising identifiers: retained by us and the ad platforms per their cookie/pixel lifetimes and policies while you keep consent; cleared on the platform side per their retention terms.
8. Your rights
If you are in the EEA/UK you have the right to: access your data; rectify inaccurate data; erase your data (“right to be forgotten”); restrict or object to processing (including processing based on legitimate interests); data portability; and to withdraw consent at any time (for analytics, via the cookie settings) without affecting prior processing. To exercise any right, email [email protected]. You can also delete your account, which removes your account data and associated files. You have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, dataprotection.ro), or your local EU authority.
9. Cookies, analytics and advertising
We use necessary cookies needed to run the site and keep you signed in. With your consent we also use analytics (PostHog) and marketing pixels (Meta, Google Ads, TikTok). How we ask for that consent depends on your region:
- EU/EEA, UK and Switzerland: opt-in — analytics and marketing load only after you actively accept.
- Other regions: opt-out — they may load by default with a dismissible notice, and you can opt out at any time.
Your explicit choice always takes precedence and is remembered; your region only sets the default. You can change or withdraw consent at any time via “Cookie settings” in the footer, and where supported we honour the browser Global Privacy Control (GPC) signal as an opt-out. See our Cookie Notice for the full list of cookies and trackers.
10. Children
Trackpeel is not intended for children under 16. In Romania the age for a child to consent to online services without parental authorisation is 16. If you believe a child has given us data, contact us and we will delete it.
11. Security
We use access controls, encryption in transit, scoped database row-level security, and least-privilege server credentials. No system is perfectly secure; we cannot guarantee absolute security.
12. Changes
We may update or modify this Privacy Policy at any time. The current version is always the one posted on this page, with a new “Last updated” date, and we will notify you of material changes. Your continued use of Trackpeel after changes take effect means you accept the updated policy.
13. Contact
[email protected] · Websylvania S.R.L., Str. Negoiului nr. 19, Târgu Mureș, Mureș, Romania.