Privacy policy

1. Data controller

Deloy SpA, with address in Chile, is responsible for processing your personal data under this policy. For privacy matters write to privacy@deloymusic.com.

2. What data we collect

We collect only what's necessary to operate the service:

• Account data: email, name, hashed password, plan, payment method (processed by Stripe — we don't store card numbers).
• Usage data: sessions, virtual Producers created, parameters, activity metrics for billing and aggregate analytics.
• Your content: musical references you upload, Producer configurations, exported tracks, Deloy DNA certificates. This is your content and is handled under the terms of service.
• Technical data: IP, Ableton version, operating system, error logs for diagnostics.
• Communications: emails you send us, support tickets, roadmap suggestions.

3. What we use it for

• Operate the service and authenticate you.
• Process payments and issue billing.
• Send you operational notifications (registrations, confirmations, service changes).
• Improve Deloy: detect bugs, understand aggregate usage, prioritize features.
• Comply with legal obligations (accounting, auditing, tax requirements).

We don't use your musical content to train general models. We don't sell your data. We don't share it with advertising networks.

4. Who we share it with

We share data only with providers necessary to operate:

• Stripe — payment processing.
• Resend — transactional email delivery.
• Neon · Railway · Vercel — hosting infrastructure.
• Anthropic — the language model that powers the virtual Producers (inputs are processed, not used for training).

These providers act as data processors under agreements that require them to use the data only to operate the service.

5. International transfers

Some providers (Stripe, Anthropic, Vercel) operate from the U.S. Transfers are made under the EU Standard Contractual Clauses or equivalents to guarantee adequate protection.

6. How long we keep it

We keep your data while your account is active. If you close the account, operational data is deleted within 90 days. Billing data is kept for the applicable legal term (in Chile, up to 6 years due to tax obligations).

7. Your rights (GDPR, CCPA and local laws)

You have the right to:

• Access: request a copy of the data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: request deletion, except where there's a legal obligation to retain.
• Portability: receive your data in a structured, reusable format.
• Objection: object to specific uses of your data.
• Withdraw consent: when processing is based on it.

To exercise any of these rights, write to privacy@deloymusic.com. We respond within 30 days. If you're not satisfied, you can complain to the data protection authority in your country.

8. Security

Encryption in transit (TLS 1.3) and at rest. Passwords hashed with modern algorithms. Internal access limited by roles. Periodic audits of access logs. If we detect a breach affecting users, we notify within 72 hours per GDPR.

9. Cookies

We use strictly necessary cookies for authentication and site functionality. We don't use advertising tracking cookies. Aggregate metrics are obtained with privacy-respecting tools (no fingerprinting).

10. Minors

Deloy is not directed at minors under 16. If we detect a minor's account without parental consent, we delete it.

11. Changes to this policy

If this policy changes we'll notify you by email and on the site at least 30 days in advance.