Privacy policy
The short version. We collect what we need to run your account, train and deliver your signatures, take payments, pay creators and keep the service safe. We don't sell your data, we don't use advertising or tracking cookies, and your audio is used for your signatures, not to train anyone else's. Our servers are in the EU (Stockholm). You can access, correct, download or delete your data.
1. Who is responsible for your data
DigMusiK Ltd (company number 16671712), Shrewsbury, SY4 3LD, United Kingdom, is the controller of personal data processed through digmusik.com, app.digmusik.com and the DigMusiK plugin. Contact us about privacy at support@digmusik.com.
2. What we collect
| Data | Where it comes from |
|---|---|
| Account: name, display name, email, password (stored only as a secure hash), country, date of birth confirmation, plan | You, at sign-up and in your account |
| Captures: audio renders, chain descriptions and credits, control settings, attestations (with date, time and IP address), training results | You and the capture assistant |
| Audio you upload for previews or AI matching | You |
| Plugin devices: device name you choose, plugin version, operating system, licence checks (date, time, IP address), an anonymous device identifier | The plugin |
| Payments: plan, invoices, purchase history, partial card details (brand, last four digits, expiry) and billing country | Stripe and you |
| Creators: payout and identity verification status, tax details we must report, ownership evidence (photos of a unit's serial number with a verification code), sales and payouts | You and Stripe |
| Profile (Pro): bio, photos, links, your units' stories | You |
| Partner programme: the partner code you joined with; for partners, your code, channel, commission and payouts. Visits to partner links are counted with a daily-changing one-way code made from the visitor's address, which can't be turned back into the address | You and the link you used |
| Communications: emails and messages with us, reports you make or that concern you | You and other users |
| Technical: IP address, browser, security logs, error reports | Your browser and our servers |
We don't ask for identity documents. Where identity checks are needed for payouts, Stripe carries them out and tells us only the outcome.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Provide your account, captures, training, signatures, plugin sign-in and licence checks | Contract |
| Take payments, sell creators' plugins, pay creators, keep accounting records | Contract; legal obligation |
| Report sellers' details and earnings to HM Revenue & Customs under the digital platform reporting rules | Legal obligation |
| Verify ownership of hardware offered for sale | Contract; legitimate interests (preventing fraud and protecting rights holders) |
| Protect signatures and plugins (encryption, device limits, invisible owner marks), detect misuse and abuse, keep the service secure | Legitimate interests |
| Handle reports, takedowns and disputes | Legitimate interests; legal obligation |
| Service emails (receipts, training finished, renewal reminders, security) | Contract; legal obligation |
| Running the partner programme: crediting partners, calculating and paying commission, preventing self-referral and fraud | Contract (with partners); legitimate interests (for referred members) |
| Product news and offers | Consent (you can opt out at any time) |
| Improve the engine and service using aggregated statistics | Legitimate interests |
| Train shared models on your renders | Only with your opt-in consent |
4. Who we share it with
We use these service providers, who process data only on our instructions under contracts that protect it:
- Amazon Web Services (servers, storage and GPU training, in the EU: Stockholm, Sweden);
- Stripe (payments, payouts, identity verification and tax calculation);
- Hostinger (our website and email);
- our email delivery provider, for service emails.
Partners see only totals (how many people joined with their code, started a trial or pay, and the commission earned). We never tell a partner who you are.
Other people see what you choose to make visible: published signatures show your display name and the chain credits; Pro profiles show what you put on them; buyers of your plugin see your creator name. We share data with authorities when the law requires it, and with professional advisers, insurers or a buyer of our business under confidentiality. We never sell personal data.
5. International transfers
Our servers are in the EU, which the UK recognises as providing adequate protection. Stripe may process data in the United States; transfers are protected by the UK International Data Transfer Addendum or the UK-US data bridge, as applicable.
6. How long we keep it
| Data | Kept for |
|---|---|
| Account data | While your account is open, then 30 days (backups 60 days) |
| Capture renders | 30 days after training, unless you choose to keep them for retraining; deleted with the capture |
| Signatures | Until you delete them (copies sold within a creator's plugin remain licensed to buyers) |
| Preview and matching audio | Up to 24 hours |
| Ownership evidence | While the unit is listed for sale, then 2 years (to handle disputes) |
| Attestations, reports and takedown records | 6 years |
| Payments, invoices, payouts and tax records | 6 years after the end of the financial year (UK tax law) |
| Security and licence-check logs | 12 months |
7. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you or another provider in a portable format. You can withdraw consent at any time. Most of this is available directly in your account (including downloading your captures and closing your account); otherwise email us. We'll respond within one month. You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), though we'd appreciate the chance to help first.
8. Automated decisions
Our capture checks automatically accept or reject renders (for example, if a render is silent or time-stretched) and tell you why; you can re-upload or contact us for a human review. Quality ratings and AI matching suggestions don't have legal or similarly significant effects on you.
9. Children
DigMusiK isn't intended for anyone under 16. If we learn an account belongs to someone under 16 we'll close it and delete its data.
10. Security
We encrypt data in transit and at rest, store passwords only as salted hashes and plugin sign-in tokens only as hashes, restrict staff access to what each role needs, and test our backups. If a breach puts your rights at risk we'll tell you and the ICO as the law requires.
11. Cookies
See our cookie policy. In short: essential cookies only, no tracking.
12. Changes
We'll post updates here and tell you by email about significant changes before they take effect.