Privacy Policy

Last updated: 8/28/2026 — version 1.3

This document describes the processing of users' personal data in connection with the use of Spectraloom (https://spectraloom.app), in compliance with art. 13 of EU Regulation No. 2016/679 ("GDPR").

1. Data controller

Hit Beat Records di Sergio Mari, Via Emilio Brusa 50, 10149 Turin, Italy — VAT IT09654820019. Contact: info@hitbeatrecords.com

2. Data collected

• Anonymous device ID: a UUID generated by the browser and stored in localStorage. It is the only identifier linked to your analyses. We do not link any name, email or account.
• Uploaded audio tracks: kept for max 24 hours in temporary storage, then automatically deleted.
• Analysis metadata: filename, genre, mode, timestamp, DSP measurements (LUFS, BPM, dynamics, etc.), generated AI feedback.
• Quota counter: number of analyses performed, tied to the device ID.
• Consent record: timestamp, accepted legal version, IP (only at consent time) and user-agent.
• Technical cookies: only internal localStorage (UI language, device ID, optional admin token). No tracking cookie, no Google Analytics, no Meta/TikTok pixel.

3. Legal basis

• Performance of the requested service (GDPR art. 6.1.b)
• Legitimate interest (GDPR art. 6.1.f) to prevent abuse
• Explicit consent (GDPR art. 6.1.a) for Terms acceptance and copyright confirmation

4. Purposes

Provide the audio analysis, generate AI feedback, enable download, manage quotas and prevent abuse.

5. Third-party AI models and non-EU transfers

In compliance with the EU AI Act (art. 50) the textual feedback and the "AI Engineer" chat are generated by third-party AI systems:

• Anthropic (Claude Haiku) — US/EU servers. We never send the audio track, only derived numeric and textual data. Active DPA and EU SCCs.
• Google (Gemini 2.5 Flash) — EU/US servers. Same treatment. Active DPA and EU SCCs.
• Neither trains models on your requests. Audio tracks are never sent to third parties.

For any other non-EU transfers, appropriate safeguards will be identified (adequacy decisions, EU Standard Contractual Clauses SCCs, Binding Corporate Rules).

6. Retention

• Audio tracks: 24 hours then automatic deletion
• Metadata and feedback: up to 12 months from last device activity
• Consent: 10 years (GDPR proof obligation)

7. Security

Per-device isolated storage, MongoDB with authentication, HTTPS everywhere, separate rotatable admin token.

8. Your rights (GDPR arts. 15-22)

• Access: download all your data in JSON from History → "Export my data"
• Deletion: erase everything from History → "Delete my data" — irreversible
• Rectification, portability, objection, restriction: write to info@hitbeatrecords.com, we reply within 30 days
• Complaint: to the Italian Data Protection Authority (garanteprivacy.it)

9. Changes

Substantial changes bump the version and trigger a new consent request.

10. Contact

info@hitbeatrecords.com

© 2026 Spectraloom · Mix & Master Analyzer — All rights reserved. A project by Hit Beat Records di Sergio Mari — VAT: IT09654820019