Privacy Policy

Data Controller

• Controller: ARCHITECT Music Inc. (United States)
• For account, billing, and marketing data, ARCHITECT acts as the data controller
• For catalog, customer, and campaign data uploaded into the platform by business clients, ARCHITECT acts as a data processor on the client’s behalf (see "Our Role as a Processor")

Data Protection Contact

• Privacy & Data Protection Officer: privacy@architectmusic.ai
• Legal & compliance: legal@architectmusic.ai
• Security & vulnerability reports: security@architectmusic.ai

Account & Identity Data

• Name and email address provided at registration
• Phone number when used for SMS verification
• Company / organization details for business accounts
• Authentication metadata (session tokens, login timestamps, device and IP information)

Payment Data

• Subscription plan, billing status, and invoice history
• Card and payment details are collected and stored by Stripe — we never see or store full card numbers

Platform & Usage Data

• Features used, pages visited, and in-app actions
• API usage statistics and rate-limiting data
• Performance metrics, error logs, and diagnostic information

Behavioural & Analytics Data

• Page views, clicks, scroll depth, and navigation paths
• Heatmap and session-interaction data used to diagnose usability issues
• Device, browser, language, and approximate (IP-derived) location
• Form interactions and conversion-funnel events

Client-Uploaded Content

• Music catalog, track, and rights metadata you add to the platform
• Brand, product, and campaign configuration you create
• Any end-user or customer data you choose to import — processed strictly under your instructions

Publicly Sourced Market Data

• Trend and engagement signals about tracks, sounds, and brands collected from public platform APIs (e.g. streaming, social, and marketplace sources)
• This data describes content and market activity, not the personal data of our individual users

Article 6 Bases

• Performance of a contract (Art. 6(1)(b)) — to create your account, deliver the platform, and process payments
• Legitimate interests (Art. 6(1)(f)) — to secure the service, prevent abuse, analyse usage, and improve our products, balanced against your rights
• Consent (Art. 6(1)(a)) — for non-essential cookies, optional analytics, and marketing communications; withdrawable at any time
• Legal obligation (Art. 6(1)(c)) — to meet tax, accounting, and regulatory requirements

Service Provision

• Provide and maintain the AI-powered intelligence and IP-management platform
• Process and analyse your catalog, brand, and campaign data
• Generate trend-detection, scoring, and campaign recommendations
• Deliver real-time alerts and notifications you have configured

Platform Improvement

• Improve our models, scoring, and recommendation engines
• Enhance usability and develop new features
• Optimize performance, reliability, and operating cost

Security & Compliance

• Detect, investigate, and prevent fraud, abuse, and unauthorized access
• Maintain audit logs and meet our legal and contractual obligations

Communications

• Send transactional messages (account, billing, security, service status)
• Send product and marketing updates only where you have opted in — unsubscribe at any time

What the AI Does

• Trend detection, breakout-probability scoring, and source-authority weighting on market signals
• AI-assisted insights, executive summaries, and translations
• These outputs describe content and market dynamics — they are decision-support tools, not automated decisions about individuals

Your Safeguards

• We do not make decisions producing legal or similarly significant effects about you based solely on automated processing (GDPR Art. 22)
• AI-generated recommendations are advisory; a human always remains in control of campaign and business decisions
• Where third-party AI providers are used (e.g. Google), data is processed under their data-processing terms and not used to train their foundation models without a contractual basis

Categories

• Strictly necessary — authentication, security, and core functionality (always on)
• Preference — language, theme, and UI settings
• Analytics — usage and heatmap measurement to improve the product
• Marketing — only set with your consent

Managing Cookies

You can accept or reject non-essential cookies via the cookie settings available in our footer, and change your choice at any time.

You can also block or delete cookies in your browser settings, though some features may stop working as a result.

Infrastructure & Storage

• Google Firebase (Authentication, Firestore, Storage, App Hosting, App Check) — hosting, authentication, and encrypted data storage
• Google BigQuery — analytics and intelligence data warehouse

Payments & Verification

• Stripe — subscription billing and payment processing
• MessageBird (Bird) — SMS verification for account security

AI & Language Processing

• Google Gemini API — AI insights, summaries, and translations
• Google Cloud Natural Language API — sentiment analysis

Analytics & Delivery

• Firebase Analytics — product usage and conversion analytics
• Heatmap / session analytics — usability and interaction analysis
• Google Fonts — typography delivery

Market-Data Sources

• Public platform APIs — Spotify, TikTok, YouTube, Instagram, and X/Twitter — for trend and engagement signals
• Serper.dev, RapidAPI, Firecrawl, and SEC EDGAR — for market, retail, and public-filing intelligence
• These sources supply content and market data, not your account information

We Do Not Sell Your Data

We do not sell your personal information, and we do not share it for cross-context behavioural advertising as defined under the California Consumer Privacy Act (CCPA/CPRA).

When We Share

• With subprocessors listed above, strictly to deliver the service
• When required by law, regulation, legal process, or a valid government request
• To protect the rights, safety, and security of ARCHITECT, our users, or the public
• In connection with a merger, acquisition, or asset transfer — with notice to you and continued protection of your data

Data Regions

• Primary processing region: EU (Frankfurt)
• Secondary regions: US East and US West
• GDPR-compliant handling applies by default

Transfer Safeguards

• Transfers out of the EEA/UK rely on European Commission Standard Contractual Clauses (SCCs) and equivalent safeguards
• A Data Processing Agreement (DPA) with SCCs is available to business clients on request via legal@architectmusic.ai

Security Measures

• Encryption of data in transit (TLS) and at rest
• Enterprise-grade cloud infrastructure with network and access controls
• Role-based access control and least-privilege permissions
• Continuous monitoring, logging, and vulnerability management
• Automated backup and disaster-recovery procedures

Breach Notification

In the event of a personal-data breach likely to result in a risk to your rights, we will notify the relevant supervisory authority and affected users without undue delay, as required by applicable law.

Retention Periods

• Account data — retained for the life of your account and deleted within 30 days of account closure
• Billing and invoice records — retained as long as required by tax and accounting law
• Usage and analytics data — retained in anonymized or aggregated form for product improvement
• Backups — securely overwritten on a rolling schedule per our retention policy
• Client-uploaded content — retained under your instructions and deleted on request or contract termination

GDPR Rights (EEA / UK)

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your personal data ("right to be forgotten")
• Portability — export your data in a machine-readable format
• Restriction & Objection — limit or object to certain processing, including direct marketing
• Withdraw consent — at any time, without affecting prior lawful processing
• Complaint — lodge a complaint with your local data-protection supervisory authority

CCPA / CPRA Rights (California)

• Know what personal information we collect, use, and disclose
• Request deletion or correction of your personal information
• Opt out of sale or sharing — note: we do not sell or share your personal information
• Non-discrimination for exercising any of your privacy rights

How This Works

• The client is the data controller and decides why and how that data is processed
• We process it only on the client’s documented instructions and under our DPA
• End-user privacy requests relating to client data are forwarded to, and handled by, the relevant client

Age Restriction

ARCHITECT is a business product not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a minor has provided us with personal data, contact privacy@architectmusic.ai and we will delete it.

Updates

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a revised "Last updated" date and, where appropriate, communicated to you directly.

Your continued use of the platform after an update constitutes acceptance of the revised policy.