Informativa sulla privacy

In caso di discrepanze tra le versioni, prevale la versione in spagnolo.

Sicurezza e privacy per artisti: come proteggiamo le tue canzoni

Zoundroom Privacy Policy

Last updated: November 12, 2026

This policy explains what data Zoundroom processes when you use our mobile application, web application and website (together, the “Service”), why we use it and the choices available to you. Reading this policy does not mean that you consent to optional analytics.

Controller and contact

The controller is Eliseu Bellés Martí, owner of Zoundroom, Spanish tax ID (NIF) 20907184T, with address at Sc Puerto, 6, Poblats Marítims, 46024 València (Valencia), Spain. For questions or to exercise your rights, write to [email protected].

Data we process

Depending on the features you use, we may process:

  • Account and profile: user identifier, name, surname, email address, date of birth, language, profile picture and preferences.
  • Content and collaboration: projects, recordings, files, notes, lyrics, tags, comments and content shared with a band. We process this content to provide the features you request.
  • Chat: if you use it, your messages in the chat of your projects and bands, how far you have read, reports and blocks (see "Project and band chat").
  • Access and security: sessions, sign-in provider, IP address, technical logs and information needed to prevent abuse or investigate incidents.
  • Device and permissions: operating system, app version and permissions you choose to grant, such as microphone, camera, photos, files or notifications.
  • Error diagnostics: when the app or the website fails, a technical report with the type of error, the screen, the app and operating system version, the general device model (not its identifier) and your user ID if you are signed in. Before sending it we remove email addresses, keys and the content of your notes, lyrics and files. We only use it to find and fix errors. In the app you can turn it off in My profile → Send diagnostics.
  • Invitations program: if you take part, your code, who invited whom, the status of each invitation, the free months and anti-fraud signals (see "Invitations program").
  • Subscriptions: plan, status, store, country, price and transaction identifiers. Zoundroom does not receive your full payment-card details.
  • Notifications: device token, language, time zone, notification preferences and whether each notification was delivered or opened.
  • Support: information you choose to provide when contacting us.

If you sign in with Apple or Google, we receive the account information that provider authorizes, normally an identifier, name and email address. We do not request your contacts or social-account activity.

Purposes and legal bases

  • To create and manage your account, synchronize content, enable collaboration and provide contracted features: performance of a contract.
  • To process and verify subscriptions: performance of a contract and legal obligations.
  • To send you service notices by notification: performance of a contract (see “Notifications”).
  • To send you tips and reminders by notification: consent or, depending on where you are, the existing-customer exception in Article 21.2 of the Spanish Information Society Services Act (LSSI) and our legitimate interests (see “Notifications”).
  • To email you, at most twice a month, offers from Zoundroom about our own plans and features: the existing-customer exception in Article 21.2 of the Spanish LSSI and our legitimate interests. You can turn them down in every email (see “Zoundroom offers by email”).
  • To send you Zoundroom offers by notification, only if you say yes to the in-app message that asks you: consent (see “Notifications”).
  • To record whether notifications are delivered or opened, and avoid sending more than necessary: legitimate interests.
  • To run the invitations program and give the months earned: performance of the contract; to prevent fraud in the program: legitimate interest (see "Invitations program").
  • To protect the Service, prevent fraud and diagnose failures: legitimate interests, subject to your rights.
  • If you cancel a free trial, to send you a single email asking why and to keep your answer and, if you write one, your comment, together with the store, plan, language and days of trial used: legitimate interests in understanding why people cancel and improving the Service. It contains no offers or advertising, and you can unsubscribe from the email itself.
  • If you agree, to send you at most one email a week with ideas to take your songs further in Zoundroom (for example, going back to the idea you saved yesterday): your consent, which you can withdraw at any time (see "Tips by email").
  • If you say yes to emails to organize your ideas (during the welcome, on the card in the app or on the web, or in My profile → Notifications), or if you ticked the box to pick up your ideas when you saved your first idea, to write to you at most twice in your first days with a link to your latest idea, in case you left it half-finished. The yes to emails to organize your ideas is a single one: it covers these two emails and those in "Tips by email", and withdrawing it stops both. Basis: your consent (Article 6(1)(a) GDPR and Article 21.1 of the Spanish LSSI). We keep what you chose, when, and the text you saw, so we can prove it. You can withdraw it at any time with the unsubscribe link in each email or in My profile → Notifications. We don't track opens or clicks per person; we only count total clicks.
  • To produce internal, aggregate usage statistics for the Service (for example, how many people record, write in their notes or use each feature), using data we already process to provide it and without sending it to third parties: legitimate interests in understanding and improving the Service. They are not used for advertising or for decisions about you, and you can object by writing to [email protected].
  • If you complete your creative DNA, we keep your answers (for example, what time you usually feel inspired, which genres and emotions move you and what you use Zoundroom for) to personalize tips, the time of notifications and Auralis's replies: performance of a contract. Multiple-choice answers are kept anonymously if you delete your account; any text you write is deleted with it. You can change them at any time in «My creative DNA». We only send our subscription provider categories (for example, «ideas» or «lyrics»), never your texts. We use those categories to adapt the text of the Pro and Band plans screen we show you in the app; prices and plans don't change: legitimate interest in presenting our plans better.
  • To answer requests and comply with tax, accounting or legal requirements: legal obligation or performance of a contract.
  • For product analytics, campaign measurement and non-essential technologies: only with your consent, where required.

Tips by email

If you say yes in the app or on the web (during the welcome, after saving an idea, or in My profile → Notifications), we email the address on your account at most once a week with ideas to get more out of Zoundroom. They are tips about the Service itself: no offers, prices or ads, and nothing about other companies. Offers come in separate emails, which you can turn down and still get the tips (see "Zoundroom offers by email").

  • Legal basis: your consent (Article 6(1)(a) GDPR and Article 21 of the Spanish LSSI). It is optional, and the Service works the same if you say no.
  • How to unsubscribe: with the "Unsubscribe" link in every email, without signing in; in My profile → Notifications; or by writing to [email protected]. It takes effect immediately and does not affect your account emails (verification, security, billing or trial notices), which are part of the Service.
  • What data we use: your email address, language and time zone (to write at a reasonable hour), and whether you have come back to the app or saved ideas (so we don't write when there's no need). Never the content of your recordings or notes. We don't track whether you open the emails or which links you click.
  • What we keep about your choice: what you chose, when, where (app, web or an email) and which text you saw, so we can prove it, and which emails we have sent you, to respect the limit of one a week. It is deleted when you delete your account.
  • The emails are sent through Resend (see "Providers and recipients").

Zoundroom offers by email

From time to time we may email the address on your account with offers from Zoundroom: discounts or special terms on our own plans (Pro and Band) and on features of the Service you already use. Never from other companies, and at most two emails a month. They are separate from tips and from your account notices.

  • Legal basis: the existing-customer exception in Article 21.2 of the Spanish LSSI (in the European Union, Article 13(2) of Directive 2002/58/EC): you have a Zoundroom account and we offer you our own services similar to the ones you already use. And our legitimate interests in letting you know about them. Where the law of your country requires your prior consent and you haven't given it (for example, in Canada if you haven't bought a plan in the last two years, in Colombia or in Peru), we don't send them to you.
  • How to say no: with the "I don't want offers" link in every email, in one click and without signing in, or by writing to [email protected]. They stop right away (if you write to us, within 10 business days at most). It doesn't affect any tips you have agreed to or your account emails (verification, security, billing, trial notices or changes to our terms).
  • What data we use: your email address, language, country or time zone (to know which law applies and to write at a reasonable hour) and your plan (so we don't offer you what you already have). Never the content of your recordings or notes.
  • What we keep: which offers we have sent you and, if you turn them down, when, so we don't write again. It is deleted when you delete your account.
  • They are sent through OneSignal (see "Providers and recipients"), which records whether they are delivered and opened. We don't record which links you click.

Analytics and measurement in the application

Mobile analytics is optional and remains disabled until you accept it. If you accept, we may process usage events, screens visited, interactions, app version, platform, technical device information, an internal user identifier and campaign-attribution information.

We use:

  • Amplitude, to understand product usage and diagnose errors.
  • AppsFlyer, to attribute installations and measure campaigns.
  • Meta App Events, to measure campaigns and conversions.
  • Microsoft Clarity, to understand interactions and sessions within the application.

When Meta App Events data and the campaign events that AppsFlyer forwards to Meta are used to show and measure ads, Meta Platforms Ireland Limited is a joint controller with us for collecting and transmitting them. Meta's Privacy Policy explains how it processes this data and how you can exercise your rights with Meta. We don't send Meta your name, your email or your account identifier.

Our event layer excludes free-text fields, names, email addresses, lyrics, notes, creative content, file paths, full URLs and credentials. To measure campaigns and journeys across Zoundroom's public pages, we may process limited public paths, such as a language or article identifier. Providers may also process technical identifiers under their own privacy policies.

On Android, if you accept analytics, we also store with your account the installation source reported by Google Play, for example the zoundroom.com page you downloaded the app from. It is deleted if you withdraw your consent or delete your account.

On iOS, the advertising identifier is enabled only if you also authorize tracking through Apple's system prompt. Refusing that prompt does not prevent you from using Zoundroom.

You may refuse analytics and continue using the application. You can also change your choice at any time under Profile → Analytics and privacy. Withdrawing consent stops future optional collection on that device; it does not affect processing lawfully performed before withdrawal.

Artificial intelligence features

Zoundroom offers artificial intelligence features, such as the Auralis assistant and, in the web version, writing tools. They are enabled only if you give your permission: the application asks you the first time you use them, and you can withdraw it at any time in My profile → AI features.

To generate each response we send to Google Cloud (Vertex AI, Gemini models), which acts as a processor on behalf of Zoundroom, only the content that is needed:

  • in Auralis, your messages and the conversation, the text of the open note, the names of your recordings (never the audio), your artist profile and the project description;
  • in the web tools, the text you type into them;
  • in “By meaning”, in the Rhymes panel (in the app and on the web): the line you're on, up to four previous lines from the same stanza, the chosen word and the rhymes or synonyms in the list; nothing else from the note.

Auralis is processed on servers in the European Union. The web tools and “By meaning” are processed in the European Union.

Google does not use this data to train its models. It may keep it temporarily (a cache of up to 24 hours) and log it to detect abuse, in accordance with its terms.

Your conversations with Auralis are saved in your account and you can delete them in My profile → Conversations with Auralis. If we detect in a conversation that you are going through a hard time, that exchange is not kept.

Legal basis: your consent, and the performance of a contract to provide the feature you request.

Notifications

If you allow notifications on your device, Zoundroom may send you three types of notifications:

  • Service notices: activity in your projects and your band, invitations, the upcoming end of your free trial and payment problems. They are part of the Service: performance of a contract. You can turn off activity and invitation notices under My profile → Notifications, and all of them by revoking the notification permission in your system settings.
  • Tips and reminders: to help you save, come back to and finish your ideas while you use Zoundroom. They come more often in your first days and during a Pro or Band trial; after that, at most one or two a week. If you stop opening the app, fewer and fewer (after a week, two weeks and a month, then at most one a month for three months) and then none until you come back. At most one a day and between 10:00 and 21:30 local time, or from the time you choose in «My creative DNA». They are only about Zoundroom features, including those in your plan or your Pro or Band trial, and never include offers, prices or ads.
    • If your device's time zone is in Europe (inside or outside the European Union), Brazil, a European Union territory on another continent or a time zone between UTC−1 and UTC+3, or if we do not know it, we send them only if you expressly accept them in the app: consent.
    • Elsewhere, we tell you in the app before the first tip and you can refuse them with one tap; if you do not refuse, we send them. Legal basis: the existing-customer exception in Article 21.2 of the Spanish Information Society Services Act (Law 34/2002, LSSI) and our legitimate interests in helping you get the most out of a service you already use.
    • We use your device's time zone, not your location. Because a time zone does not always match a country, we ask for your consent in borderline cases.
    • We choose which tip to send with automated rules, based on the days since you signed up, when you last used Zoundroom and whether you opened previous tips, whether and how many ideas you have saved (also in the last week), what you use most in the app (recording, notes…) and the features you have not tried yet (if you have accepted analytics, also the ones you have already used), your latest idea, new activity from people who share projects or a band with you, your plan, whether you have an active Pro or Band trial, the time you choose in «My creative DNA», your language and your time zone. A tip may include the name of your audio, your project or a collaborator; it travels in the notification through OneSignal and we do not store that text. We do not send the content of your ideas to third parties to personalize them.
    • Every tip includes a one-tap way to opt out (“No more tips”), in the notification itself or when you open it. You can also turn them on or off at any time under My profile → Notifications, or stop all notifications by revoking the permission in your system settings. Withdrawing consent does not affect notifications already sent.
  • Offers and promotions: we only send them by notification if you give us your express consent. We ask for it separately, with a message inside the app ("Want us to let you know about deals…?") that you only see if you have accepted analytics and that is shown through OneSignal. If you don't answer or you say no, we don't send them. They are Zoundroom offers (discounts on Pro or Band), at most two a month, and they are separate from tips, which still never include offers.
    • We store your answer in OneSignal as a tag on your profile (yes or no, the date and the version of the text you saw) so that we can prove it, and we delete it when you delete your account.
    • You can withdraw it at any time by writing to [email protected] (we remove it within 10 business days at most), or stop receiving any notification by turning off the permission in your system settings. Withdrawing consent does not affect earlier sends.

We send notifications through OneSignal, which acts as our processor. To manage them, we process your device token, user identifier, language and time zone, which we use to send them at reasonable hours. We also record whether each notification was delivered or opened, to avoid sending more than necessary and to measure their usefulness. If you have accepted analytics in the mobile app, OneSignal also receives your email address.

To measure whether tips really help, a randomly chosen group of people does not receive them for a while.

We keep your choice about tips and reminders and a history of its changes (date, screen, platform, region and version of the text you saw) so that we can demonstrate it.

Invitations program

This section applies if you create your invite link or code in "Invite your friends" or try to use someone else's. Otherwise, we do not process any of this data.

  • What we process: your code, who invited whom and when, how the invitation arrived (link, typed code or Google Play), its status (whether it counted or not, and why) and the free months. If you were invited, also the charge and refund notices for your subscription that RevenueCat sends us (store, product, period type, amount, dates and purchase identifiers), so we know when the invitation counts. If you accepted analytics, we record that you came through an invitation.
  • What other people see: the person who invited you sees your first name, when you joined, whether their invitation counts and the date it will count. From that they can work out that you have subscribed, but they do not see your plan, your store or what you paid. Anyone who opens your link sees your first name, unless you turn off "Show my name on the invite". Your code may start with the first letters of your name, even if you turn that option off.
  • Against self-invitations: we keep, as a salted hash and never in clear, a device identifier (on iOS, the identifier the system gives our apps; on Android, the ANDROID_ID) and, when an invitation is used, part of the IP address (the network, not the full address). We also compare the email address, Band and store purchase identifiers of the person inviting and the person invited. These rules are automatic and are used only for this program: they are not used for advertising or to follow you across other apps. If you think an invitation has not been counted correctly, write to us.
  • Pending link: if you open an invite link, we keep the code on your device or in your browser until you sign in, for up to 30 days. On Android, if you install the app from that link, we read the code from Google Play's install data.
  • Notices: we tell you when someone uses your invitation and when it counts. You can turn this off in My profile → Notifications. Months are given through RevenueCat and notices are sent through OneSignal.
  • Legal basis: performance of the contract to give the months earned and our legitimate interest in preventing fraud in the program. You can object by writing to [email protected]; if you do, your invitations may stop counting.
  • Retention: device and IP signals are deleted 180 days after we last saw them, and charge and refund notices 180 days after we receive them. The rest is kept for as long as you have the account. If you delete your account, everything of yours is deleted; if you invited someone, their invitation is left with no link to you.

Project and band chat

This section applies if you use the chat of a band or of a project shared by two or more people. There are no stand-alone groups or direct messages outside a project or a band.

  • What we keep: the text of your messages (up to 2,000 characters), which message you reply to, the date and time, and the cards you attach. A card points to an audio, a note or a project that the people in that chat already share: we do not copy the file. Audio comments also appear in the chat. We also keep how far you have read each chat and whether you have muted it, only to show you your unread messages and not notify you more than needed; nobody else sees this.
  • Who sees it: everyone with access to the project or the band, including people who join later, who can see earlier messages. Anyone who loses access stops seeing the chat at that moment.
  • How it is protected: messages are stored in our database (Supabase) and encrypted in transit, but they are not end-to-end encrypted. We only look at them when needed to review a report, handle a request from you or comply with the law.
  • Notifications: when someone writes, we notify you through OneSignal with their name, never the text of the message, and at most once every two minutes per chat. You can mute each chat or turn off "Chat messages" in My profile → Notifications.
  • Automatic filter: before a message is sent, we check that it does not contain serious insults or hate speech from a fixed list. If it does, it is neither sent nor stored.
  • Reporting: if you press and hold a message from someone else, you can report it. We keep a copy of the message, who wrote it, in which chat and who reported it, even if it is deleted later, and it reaches us as a support request for review. We do not tell the author who reported it.
  • Blocking: from the same menu you can block that person: you stop seeing their messages and getting notifications from them in every chat. They are not told. You can unblock them in My profile → Notifications → Blocked people.
  • How long: messages are kept for as long as the project or the band exists, and are deleted with it. You can delete your messages at any time: the text is deleted at that moment and "Message deleted" is shown instead. If you delete your account, the text of all your messages is deleted and "Deleted account" is shown. In both cases, backups are gone within 7 more days at most. Reports are kept for as long as needed to resolve them and prevent further abuse.
  • Legal basis: performance of the contract to provide the chat; for the filter, reports and blocks, our legitimate interest in keeping a safe space and our legal obligations as a platform (Regulation (EU) 2022/2065, the Digital Services Act).
  • Rules: what you may not post is set out in the Terms.

Cookies and website measurement

The website uses strictly necessary storage to operate and remember your choices. Google Analytics and Meta Pixel load only according to the options selected in the cookie panel. You can reopen that panel through “Cookie settings”.

If you accept marketing in the cookie panel, Meta Pixel records that you visited the site, that you used a songwriting tool (for lyrics, chords, song structure or organisation; not the practice tools, such as the metronome or the tuner) and that you clicked a link to create an account or download the app. In the web app (app.zoundroom.com), with the marketing option of its own cookie notice, it also records when you create an account and when you start a trial or make a purchase, with its amount and currency. We use this to measure campaigns and, if we run ads, to show them to people who already know Zoundroom. We never send Meta your name, your email, your account identifier or anything you write, and we do not use advanced matching. Meta Platforms Ireland Limited is a joint controller with us for collecting and transmitting this data; its Privacy Policy explains how it processes it. Meta's cookie (_fbp) lasts up to 90 days. Legal basis: your consent, which you can withdraw at any time through “Cookie settings” on the website or Profile → Analytics and privacy in the web app.

If you accept analytics, we store in your browser, only on zoundroom.com and app.zoundroom.com, how you first arrived: the type of source (for example, a search engine or an AI assistant), the referring site without its full address, the landing page and the campaign parameters of the link. It is deleted after 90 days or when you withdraw your consent. If you create an account, we store that source with it to learn which channels bring sign-ups, trials and subscriptions, and we pass it to RevenueCat as part of your subscription data. It never includes your email, your name or what you write, and it is deleted if you withdraw your consent or delete your account.

Providers and recipients

We share data only when needed to provide the Service, comply with law or when you authorize us. Our providers include:

  • Supabase, for authentication, databases and backend functions.
  • Google Cloud, for storage, technical services and, if you authorize it, the artificial intelligence features (Vertex AI).
  • RevenueCat, Apple, Google Play and Stripe, for subscriptions and payments. RevenueCat also receives the source of your account if you accepted analytics.
  • OneSignal, for notifications and to email notices about changes to our terms and Zoundroom offers.
  • Resend, to send the Service's emails and, if you have agreed to them, tips by email and emails to pick up your ideas.
  • Cloudflare, to host the website and the server that syncs note editing in real time (it keeps a copy of the notes you edit).
  • Amplitude, AppsFlyer, Meta and Microsoft, for the optional analytics described above.

We may also disclose data when legally required, to protect rights and safety, or as part of a corporate transaction with appropriate safeguards. We do not sell your personal data.

International transfers

Some providers may process data outside the European Economic Area. Where applicable, we rely on adequacy decisions, standard contractual clauses or other safeguards recognized by applicable law.

Songwriting split sheet

If you fill in a split sheet in a project, we store the names and, if you add them, the collecting society, IPI number and publisher of each writer, including people who do not have a Zoundroom account. It is project content: people with access to the project can see it, and it is deleted with the project. We do not contact those people or use their details for anything else. Only add people who took part in the song and know you are including them.

Retention

We retain your account and content while the account remains active or as needed to provide the Service. After a deletion request, we delete or anonymize data except where temporary retention is necessary for security, backups or legal obligations. What you delete in the app (notes, audio, files, projects and Auralis conversations) is kept for up to 30 days (notes stay in the trash, where you can restore them) and is then permanently deleted. If you delete your account, we delete your content straight away. In both cases, database and file backups are gone within 7 more days at most. If you delete your account, we keep your answers to the welcome questionnaire and to the exit survey (your reason and, if you wrote one, your comment) in anonymous form, with no link to you or your account, together with general details such as the platform, app version or plan type. We use them only for aggregate statistics that help us improve the Service. Subscription records are retained for applicable tax and accounting periods. The history of your choice about tips and reminders is kept while you have an account and, if you delete it, blocked for three years, the maximum period during which liability for this processing can be claimed; it is then erased. Notification delivery and open records are retained only for as long as needed for the purposes described. When you delete your account, we also delete the copies of your notes on the co-editing server and ask Amplitude, OneSignal, RevenueCat and, if you delete it from the app on a device where you accepted analytics, AppsFlyer to delete your data. Microsoft Clarity and Meta don't allow deleting a single person's data: Clarity keeps session recordings for 30 days (those marked as favourites and a random sample, for up to 9 months) and Meta keeps event data for up to 2 years. Other analytics data is retained according to each provider's settings and only for as long as needed for the purposes described. Error diagnostics data is deleted after 90 days.

Your rights

Where applicable, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent without retroactive effect. You can delete your account from the application or contact [email protected]. For the data Meta processes as a joint controller, you can also exercise your rights directly with Meta; if you ask us, we'll pass your request on to Meta. You may also lodge a complaint with the Spanish Data Protection Agency or your local supervisory authority.

Security, children and changes

We apply reasonable technical and organizational safeguards, although no system can guarantee absolute security. The Service is not intentionally directed to children who cannot legally provide consent; their legal representatives may contact us to request data deletion.

We may update this policy to reflect legal or Service changes. We will update the date above and communicate material changes when required.