Privacy Policy

What We Collect

• Account info: Email address, name, and password (stored only as a secure cryptographic hash — we cannot see your password), plus preferences like language and theme
• Your music: Audio files you upload, and the annotations and comments your team adds to them
• Payment info: Handled securely by Stripe (web) and by the app stores via RevenueCat (in-app purchases). Card details go directly to these processors — we never see or store them.
• Push notification tokens: If you enable push notifications, a device token issued by Google's Firebase Cloud Messaging so we can deliver them. You can turn push notifications off at any time in the app.
• Crash reports: Diagnostic data (stack trace, device model, OS version, app state) when the app crashes, not linked to your account. Deleted after 90 days.
• Access and security logs: When content is accessed, we log which account accessed it and from which IP address, for security and abuse prevention. Access logs are deleted after 35 days and system audit logs after 90 days. Sign-in uses a token stored locally on your device — we use no advertising or cross-site tracking cookies.

How We Use It

• Make the app work (store projects, sync, collaborate)
• Fix bugs and add features
• Send important announcements (no spam)
• Keep your account secure
• Comply with legal obligations and enforce our terms

Where the GDPR or similar laws apply, we process your data to perform our contract with you (running the service), for our legitimate interests (security, preventing abuse, improving the service), with your consent where required, and to comply with legal obligations.

We Don't Sell Your Data

Period. We're not an advertising company. Your music stays with you.

We only share with:

• Your teammates (the people you invite)
• Service providers who process data on our behalf under contract: Cloudflare (hosting, database, and file storage), Stripe (payments; we never see or store your full card details), RevenueCat (in-app purchase management), Resend (email delivery), and Google Firebase Cloud Messaging (push notification delivery)
• Legal authorities (if required by law, or to protect the rights, safety, or property of Elattoo or others)
• A successor entity, if Elattoo is involved in a merger, acquisition, or sale of assets — in which case this policy will continue to apply to your data

We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA), and we do not use your data for targeted advertising or profiling.

Data Retention

We keep your account data and uploads for as long as your account is active. When you delete content or your account, it is removed from our active systems promptly; residual copies in backups, if any, are purged as those backups expire. We may retain limited records longer where the law requires it (for example, payment and tax records) or to resolve disputes and enforce our terms. On a fixed schedule, crash reports and audit logs are deleted after 90 days, access logs after 35 days, and expired registration and rate-limit records within about a day.

Security

We use industry-standard measures to protect your data, including encrypted (HTTPS) connections and access controls, and your recordings are accessible only to authenticated members of your team. That said, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. Please use a strong, unique password and let us know immediately at privacy@elattoo.com if you suspect unauthorized access to your account. If a data breach affects your personal data, we will notify you and the relevant authorities as required by law.

International Transfers

Elattoo is operated from Canada, and your data may be processed in Canada, the United States, or other countries where our service providers (such as cloud hosting and payment providers) operate. We require comparable protection from our service providers wherever your data is processed, and where required (for example, for EU/EEA and UK users) we rely on appropriate safeguards such as standard contractual clauses for these transfers.

Your Rights

• Access and correct your data anytime
• Delete your account and your data
• Export your final mixes

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws (such as Quebec's Law 25). Depending on where you live, you may also have rights under other laws (for example the GDPR in the EU/EEA and UK, or the CCPA/CPRA in California), including the right to restrict or object to processing, the right to data portability, and the right not to be discriminated against for exercising your rights. To exercise any right, use the controls in the app or contact privacy@elattoo.com; we may need to verify your identity first, and we will respond within the time required by law. You may also lodge a complaint with the Office of the Privacy Commissioner of Canada or your local data protection authority.

Children's Privacy

Elattoo's app-store content rating reflects that its content is suitable for all ages. However, creating an account involves providing personal information (such as an email address), so we do not knowingly collect personal information directly from children under 13 (or the higher minimum age required in your country). If a musician under that age wants to use Elattoo, a parent or guardian must create and manage the account in their own name and supervise its use; the account remains the parent's or guardian's. If you believe a child has created an account or provided us personal information directly without parental consent, contact us at privacy@elattoo.com and we will delete it.

This Website

This site loads fonts from Google Fonts, which means your browser sends a request (including your IP address) to Google's servers; see Google's privacy policy. If you contact us by email, we receive your email address and message and use them only to respond to you.

Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above, and for material changes we will notify you in the app or by email. Continued use of Elattoo after a change takes effect constitutes acceptance of the revised policy.

Questions?

For privacy-related questions or concerns, contact us at privacy@elattoo.com