Kebijakan Privasi

Last updated: 11 November 2026

This policy explains which personal data Ostone processes when you use the ostone.app website, your account and the Ostone software, why, for how long, and how to exercise your rights. It is a translation of the French version, which prevails if the two differ.

In short

• Your music stays with you. Your projects, recordings and lyrics are saved on your computer. They are not sent to our servers.
• We keep only what is needed to run your account: your email address, display name, language, plan, connected computers and payment history.
• We never see your card. Payment is handled by Stripe.
• No advertising, no selling of data, no advertising cookies and no audience measurement.
• You stay in control: you can download your data or delete your account at any time from your account page.

1. Who is responsible for your data

The data controller is the publisher of Ostone, identified in the legal notice. For any question about your data, write to [email protected].

2. The data we process

Account and sign-in

• Your email address (required).
• Your first name or display name (optional).
• The language of the site and the software.
• The date your account was created and the date of your last sign-in.

Sign-in works without a password: we email you a single-use link and code, valid for 1 hour. If you choose to sign in with Google or Apple, when these options are offered, that service sends us your email address, your name and an account identifier. We never receive your password.

Subscription and payment

• Your plan, its period (month or year), its start, renewal and end dates, and the payment status.
• Your Stripe customer and subscription identifiers, your country and your invoice history.
• Your billing address and VAT number, if you enter them at Stripe.

Your card number, expiry date and security code are entered directly at Stripe. We never have access to them. Stripe may give us a technical fingerprint of the payment method, which cannot be used to recover the card and serves only to prevent abuse (for example referring yourself).

Connected computers

Your account can be used on up to 3 computers. For each one we keep an installation identifier created by the software, the computer's name if it is sent, the software version and the date of the last connection. The software receives a signed token that states your plan and stays valid for 14 days without an internet connection.

Student offer

The email address provided by your school, the school's name, and the status and date of the check. Student status is confirmed again once a year.

Gift cards and codes

• For the buyer: their email address, and the plan and duration given.
• If the card is sent by email: the recipient's email address, the sender's name and the message entered (300 characters at most).
• For the recipient: the date the code was redeemed and the account that redeemed it.

If you give us the email address of someone close to you, it is used only to send them their gift card.

Referral

Your referral code, the link between the referrer's account and the referred account, and the status of the reward. When you reach the site through a referral link, the code is kept in your browser until payment.

Support

When you write to us: your email address, your message and the date. Never send us an audio file: we do not need one to help you.

Project sharing

If you invite someone to work on a project from the software: the invited person's email address, the project name, the rights granted (listening or editing) and the information needed to work together. Audio files are not stored on our servers.

Security and technical data

Like any website, ostone.app produces technical logs at our hosting providers: IP address, date and time, page requested, browser type. They are used to run the service, protect it against attacks and limit abuse (for example the number of sign-in requests per hour).

3. What we do not collect

• The content of your projects: music, voice, lyrics, imported beats.
• Your bank card data.
• Your precise location, your contacts or your personal files.
• So-called sensitive data (health, opinions, origin and so on).

We do no advertising profiling and make no fully automated decision that has legal effects on you.

4. Why we use this data

• Creating and managing your account, signing you in, providing the software and your plan: performance of our contract with you (terms of use and terms of sale).
• Taking payments, issuing invoices, handling failed payments: performance of the contract, and legal accounting and tax obligations.
• Student offer, gift cards, referral: performance of the contract, at your request.
• Answering your support requests: performance of the contract and our legitimate interest in helping you.
• Securing the service and preventing fraud and abuse: legitimate interest.
• Sending you service emails (sign-in, receipt, failed payment, end of trial, deletion confirmation): performance of the contract.
• Answering the authorities when the law requires it: legal obligation.

We do not send advertising emails. If we offer a newsletter one day, it will be sent to you only with your consent, and every message will let you unsubscribe.

5. Who receives your data

Within Ostone, only the people in charge of support and administration have access. Administration access is protected by two-factor authentication and every action is logged.

We use service providers, who act on our instructions:

• Supabase (Supabase, Inc.): accounts, database and service functions. The data is hosted in France (Paris region).
• Stripe (Stripe Payments Europe, Ltd., Ireland): payment, invoicing, VAT calculation and fraud prevention.
• Cloudflare (Cloudflare, Inc.): hosting and delivery of the site, protection against attacks, domain name and incoming email.
• Resend (Resend, Inc.): sending of service emails, from a sending region located in Ireland.
• Google or Apple: only if you choose to sign in with one of these services.

We do not sell or rent your data. We disclose it to an authority only when the law obliges us to.

6. Transfers outside the European Union

Some of these providers belong to American groups. Part of the processing (technical support, worldwide delivery network, fraud prevention) may therefore involve a transfer of data outside the European Union, in particular to the United States. These transfers are covered by the European Commission's standard contractual clauses and, depending on the provider, by the EU–US Data Privacy Framework. You can ask us for more information about these safeguards.

7. How long we keep your data

• Account data (email, name, language, plan, computers, referral, student status): as long as your account exists. Once its deletion is confirmed, it is erased within 30 days.
• Sign-in link and code: 1 hour. The code that lets the software sign in: 60 seconds.
• Invoices and accounting records: 10 years, as required by law, including after the account is deleted.
• Technical payment notifications received from Stripe: 90 days.
• Gift cards: until the code is redeemed, then as long as the recipient's account exists. Purchase data follows the retention period of accounting records.
• Support messages: 3 years after your message.
• Log of administration actions: 2 years.
• Anti-abuse counters: 2 days.
• Technical logs of our hosting providers: for the limited period set by these providers.
• Session in your browser: until you sign out.

8. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. You can also give instructions about what happens to your data after your death.

• From your account page, under Privacy: "Download my data" gives you a copy of your data, and "Delete my account" erases your account after confirmation by email. Your subscription is then cancelled immediately.
• By email, at [email protected], preferably from your account's address so that we can recognise you. We answer within one month.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority of your country.

9. Security

• All connections to the site and the service are encrypted.
• We store no passwords: sign-in uses a single-use link or code.
• In the database, each user has access only to their own data.
• Secret keys are never present in your browser or in the software.
• Administration is protected by two-factor authentication.

If a data breach created a risk for you, we would inform the CNIL within 72 hours and let you know as soon as possible.

10. Minors

Ostone is intended for anyone aged 15 or over. Under 15, creating an account requires the agreement of a parent or legal guardian. Purchases must be made by an adult or with an adult's agreement. If you think an account was created without this agreement, write to us and we will delete it.

11. The Ostone software

• Your projects are local. They are saved on your computer, by default in the Documents\Ostone folder. We have no access to them.
• The software works offline. It connects to our servers to check your plan and to look for updates. As with any connection, your IP address is then visible to our hosting providers.
• Online features are optional. Project sharing, beat generation and AI assistants are active only when you use them, and exchange only the information needed for the feature you asked for.
• AI assistants. If you connect an AI assistant to the software, you choose that service and the rights you grant it in Settings. The information it accesses is then processed under that service's own privacy policy.

12. Cookies

The site uses no advertising cookies and no audience measurement. Details are on the Cookies page.

13. Changes to this policy

We may update this policy, for example if the service changes. The date at the top of the page shows the latest version. For a significant change, we will let you know by email or on the site before it takes effect.

14. Contact us

For any question: [email protected].