Disclaimer: This English version is a non-binding translation provided for convenience only. Only the German version of this privacy policy is legally binding. In the event of any discrepancy or inconsistency between the German and the English version, the German version shall prevail.

Privacy Policy

Dear Audio – Website and Web Application

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection laws is:

A STUDIO Creative Audio GmbH Duisburger Strasse 19 40477 Düsseldorf Germany Email for data protection requests: datenschutz@dear-audio.io General email: hello@dear-audio.io Website: https://dear-audio.io

No data protection officer has been appointed at present. Please direct data protection requests to datenschutz@dear-audio.io.

2. Scope

This privacy policy applies to the website at dear-audio.io, the web application at app.dear-audio.io, user accounts, the processing of uploaded audio and video files, support and email communication and – subject to separate consent – newsletters and marketing emails.

3. Principles, Purposes and Legal Bases

We process personal data only to the extent necessary for the provision, security and further development of Dear Audio, the performance of the user relationship, the handling of enquiries or compliance with legal obligations.

Processing is based in particular on Art. 6(1)(b) GDPR for the performance of the user relationship and pre-contractual measures, Art. 6(1)(c) GDPR for compliance with legal obligations, Art. 6(1)(f) GDPR for the secure and uninterrupted provision of our service, and Art. 6(1)(a) GDPR where you voluntarily consent to newsletters or marketing emails.

If you upload special categories of personal data within the meaning of Art. 9 GDPR, you yourself must have an appropriate legal basis for this processing. If you upload content containing data of other persons, you are responsible for informing these persons where necessary and for obtaining the required rights or consents.

4. Accessing the Website and Technical Log Data

When you access our website and web application, technically necessary connection data is processed. This may include IP address, date and time, requested URL or file, referrer URL, browser type and version, operating system, amount of data transferred, HTTP status code, and security and error logs.

This processing serves to deliver the pages, ensure stability and security, analyse errors, and detect and prevent misuse and attacks. The legal basis is Art. 6(1)(f) GDPR; where access serves the use of contractual functions, additionally Art. 6(1)(b) GDPR. Our legitimate interest lies in secure, stable and efficient operation.

Technical log data is stored only for as long as necessary for operation, security and error analysis. Longer storage takes place only if a specific security incident must be investigated or legal obligations apply.

5. Hosting and Email by IONOS

The website, web application, local media files and business email mailboxes are provided through services of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. IONOS processes the data required for hosting, server operation, data backup and email transport on our behalf.

The legal bases are Art. 6(1)(b) and (f) GDPR. Where required, a data processing agreement pursuant to Art. 28 GDPR is to be concluded with IONOS. Further information: https://www.ionos.de/terms-gtc/datenschutzerklaerung/

6. Strictly Necessary Cookies and Local Storage Technologies

Dear Audio uses strictly necessary cookies or comparable storage technologies to the extent required for login, session management, security, storing necessary settings and providing requested functions. These technologies are not used for advertising or cross-site tracking.

The legal basis for the subsequent processing of personal data is Art. 6(1)(b) or (f) GDPR. The storage of or access to strictly necessary information takes place without consent in accordance with the applicable provisions of the German Telecommunications Digital Services Data Protection Act (TDDDG). Should optional analytics, marketing or third-party technologies be used in the future, they will only be activated after your consent and this policy will be updated accordingly.

7. User Account, Registration and Authentication

A user account is required to use the web application. In this context, we process in particular your email address, authentication data, registration and confirmation timestamps, account and plan status, usage and credit information, and security-related session and login information.

Passwords are not stored in plain text. Authentication, the account database and automated account emails, e.g. for registration or password reset, are provided using services of Supabase. The provider is Supabase, Inc., USA. The processing serves to set up, manage and secure the user account; the legal bases are Art. 6(1)(b) and (f) GDPR.

In the course of providing its services, Supabase may process data within the European Union and – depending on the sub-processors and support processes used – also in third countries. Where no adequacy decision exists, the transfer is based on appropriate safeguards, in particular the Standard Contractual Clauses of the European Commission pursuant to Art. 46 GDPR. A data processing agreement pursuant to Art. 28 GDPR is to be concluded with Supabase. Further information: https://supabase.com/privacy and https://supabase.com/legal/dpa

8. Uploaded Content and Audio/Video Processing

When you upload audio or video files, we process the file itself as well as any voices, speech, music, sounds, image content and communication content contained therein, the file name, file type, file size, duration, technical media information and the processing settings you select.

Processing takes place exclusively in order to perform the service you requested, provide results, enable repeat processing within the booked scope of service and handle technical errors. The legal basis is Art. 6(1)(b) GDPR.

For certain technical processing steps, we use a specialised processor based in the European Union for cloud-based audio processing. The media material required for processing is transmitted to it temporarily for this purpose. Where required, a data processing agreement pursuant to Art. 28 GDPR is to be concluded with the service provider. The content is not published.

We do not use uploaded content to train or fine-tune general-purpose AI models and do not share it for advertising purposes. No automated decision-making with legal or similarly significant effects within the meaning of Art. 22 GDPR takes place.

Please do not upload any unlawful content. In particular, you must hold all necessary rights to voices, recordings, music, images and other content. Dear Audio is intended exclusively for adult users aged 18 and over.

9. Retention Period for Media Content

The plan-dependent retention period begins as soon as successful processing (“Enhancement”) has been completed. Uploaded original files, generated previews and processing results are automatically deleted from the operational media storage after the following period:

Free: 24 hours
Starter: 48 hours
Premium: 5 days
Pro: 14 days
Agency: 28 days

Earlier deletion may take place by deleting the respective project or upon a justified request, unless technical or legal reasons prevent this. Temporary upload files, aborted uploads and error artefacts no longer required for the provision of the service are deleted as soon as technically possible.

After deletion of the media files, non-content account, job and transaction metadata may continue to be stored to the extent necessary for billing, abuse prevention, proof of errors or legal obligations. Backup copies are overwritten in accordance with the defined backup cycle; restoring individual deleted files from rotating backups is generally not provided for.

10. Projects, Usage Data and Credits

To organise and perform the service, we process project and job identifiers, file assignments, processing status, technical parameters, timestamps, error codes, plan, entitlements, credit transactions and repeat processing. This data serves the performance of the contract, the correct provision of booked services, support and protection against misuse. The legal bases are Art. 6(1)(b) and (f) GDPR.

This data is generally stored for the lifetime of the user account. Technical detail data that is no longer needed is deleted or anonymised as soon as it is no longer required for the stated purposes and no statutory retention obligations apply.

11. Support and Email Communication

If you contact us by email, we process your sender address, the content of your message, technical email metadata and any information you voluntarily provide in order to handle your enquiry. A contact form is not currently offered.

The legal basis is Art. 6(1)(b) GDPR for contract-related or pre-contractual enquiries and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper handling and documentation of enquiries. Correspondence is deleted as soon as it is no longer required for this purpose, unless statutory retention obligations or legitimate evidentiary interests apply.

12. Newsletter and Marketing Emails

We send newsletters, product information and offers by email only if you have voluntarily and separately consented to this. Marketing consent is optional, not pre-selected and not a prerequisite for registering for or using Dear Audio.

For this purpose, we process your email address, the time and version of your consent, the confirmation status and, where applicable, the time of withdrawal. Sign-up is to be confirmed via a double opt-in procedure. The legal basis is Art. 6(1)(a) GDPR; the documentation of consent is additionally based on Art. 6(1)(c) and (f) GDPR.

You may withdraw your consent at any time with effect for the future via the unsubscribe link in every marketing email or by sending a message to datenschutz@dear-audio.io. Withdrawal does not affect the lawfulness of processing carried out until then and has no effect on necessary account, security or service emails. No analysis of open or click behaviour takes place unless you have been separately informed in advance and any required consent has been obtained.

13. Contract, Billing and Payment Data

Where paid services are offered, we process the master, plan, order, invoice and transaction data required for the contract, activation, billing, refunds, fraud prevention and tax records. The legal bases are Art. 6(1)(b) and (c) GDPR and, for abuse and fraud prevention, Art. 6(1)(f) GDPR.

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”). When you purchase a paid plan or credits, the data required for payment – in particular name, email address, billing address, payment method details, VAT identification number where applicable, and transaction data – is collected and processed directly by Stripe. We ourselves do not receive or store complete payment method data such as card numbers, but only payment confirmations, transaction and subscription identifiers and the billing data required for accounting and tax purposes.

Stripe processes this data partly as an independent controller, e.g. for fraud prevention and to comply with its own legal obligations, and partly on our behalf. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Stripe to the extent that Stripe acts as a processor.

In the course of payment processing, data may be transferred to Stripe affiliates, in particular Stripe, Inc., based in the USA. Transfers to third countries are based on appropriate safeguards pursuant to Art. 44 et seq. GDPR, in particular the Standard Contractual Clauses of the European Commission pursuant to Art. 46 GDPR and, where applicable, an adequacy decision. Further information: https://stripe.com/de/privacy

We use Stripe’s tax features to automatically determine the applicable VAT and to verify the VAT identification numbers of business customers. European VAT IDs are verified against the European Commission’s confirmation system (VIES).

Documents relevant under tax and commercial law are stored in accordance with the statutory retention periods and deleted thereafter.

14. Recipients and Processors

Personal data is only received by internal departments and external service providers who need it to fulfil the purposes described. These include in particular hosting and email providers, providers of authentication and database operations, a specialised audio processing service provider and our payment service provider Stripe.

Service providers are contractually bound and, where they act as processors, may only process data in accordance with our instructions. Personal data is not disclosed for advertising purposes or sold. Disclosure may take place if we are legally obliged to do so or if it is necessary for the establishment, exercise or defence of legal claims.

15. Transfers to Third Countries

Some service providers or their sub-processors may be based outside the European Union or the European Economic Area. A transfer only takes place if the requirements of Art. 44 et seq. GDPR are met, for example on the basis of an adequacy decision or appropriate safeguards such as the Standard Contractual Clauses of the European Commission. You can request information on the specific safeguards used at datenschutz@dear-audio.io.

16. Deletion of the User Account

You can request the deletion of your user account via the designated function or by email to datenschutz@dear-audio.io. To prevent unauthorised deletions, we may verify your identity. After successful verification, we delete or anonymise the account, the associated media files and metadata that is no longer required, unless statutory retention obligations, open contractual matters or compelling security and evidentiary interests prevent this.

Data that must continue to be retained is restricted from use for other purposes and deleted after the relevant period has expired. Processing of the request will be confirmed.

17. Data Security

We implement appropriate technical and organisational measures pursuant to Art. 32 GDPR. These include in particular encrypted transmission via TLS, access restrictions, role-based permissions, separation of user content, security updates, logging of security-relevant events and data backups. However, no internet-based service can guarantee absolute security.

18. Your Rights

Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection (Art. 21 GDPR). You may withdraw any consent given at any time with effect for the future.

Where processing is based on Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons.

To exercise your rights, please contact datenschutz@dear-audio.io.

19. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority competent for the controller’s registered office is in particular:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia) Kavalleriestraße 2–4 40213 Düsseldorf Germany https://www.ldi.nrw.de

20. Changes to this Privacy Policy

We will amend this privacy policy if the legal situation, the service providers used or the data processing operations change. The version published on the website at the relevant time applies. Material changes affecting an existing user account will be communicated in an appropriate manner.

Last updated: 31 August 2026