Last Updated: January 15, 2025
Circle Room ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our audio collaboration platform and related services (the "Service").
Introduction
This Privacy Policy applies to all users of Circle Room, regardless of location. We are committed to complying with applicable data protection laws, including:
- United States: Various federal and state privacy laws
- California: California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
- European Union: General Data Protection Regulation (GDPR)
- United Kingdom: UK GDPR and Data Protection Act 2018
- Canada: Personal Information Protection and Electronic Documents Act (PIPEDA)
- Australia: Privacy Act 1988 and Australian Privacy Principles (APPs)
By using the Service, you consent to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our practices, please do not use the Service.
Information We Collect
We collect several types of information to provide and improve our Service:
Account Information
When you create an account, we collect:
- Email address
- Password (stored in encrypted form)
- Display name or alias
- First and last name
- Profile photo (optional)
- Location (country, state/province)
- Website URL (optional)
- Phone number (optional)
- Professional bio (optional)
- Account type (Artist, Engineer, or Producer)
Audio Files and Project Data
When you use our collaboration features, we collect:
- Audio files you upload
- Project metadata (song titles, BPM, musical key, project stage)
- Waveform data generated from your audio files
- Revision history and version information
- Collaborator lists and permissions
Usage Data
We automatically collect certain information when you use the Service:
- Features you access and actions you take
- Collaboration activity (invitations sent, feedback given)
- Upload and download activity
- Storage usage statistics
- Session duration and frequency
Device and Technical Information
We collect technical information to ensure security and optimize performance:
- IP address
- Browser type and version
- Operating system
- Device identifiers
- Time zone and language settings
- Referring URLs
Payment Information
When you subscribe to a paid plan, Stripe (our payment processor) collects:
- Payment card details
- Billing address
- Transaction history
Circle Room does not directly store your full credit card number. Payment processing is handled entirely by Stripe in accordance with their privacy policy and PCI-DSS compliance requirements.
How We Use Your Information
We use the information we collect for the following purposes:
Providing the Service
- Create and manage your account
- Store and transmit your audio files to authorized collaborators
- Generate waveform visualizations for the feedback interface
- Enable time-stamped feedback and collaboration features
- Process subscription payments and manage billing
Improving the Service
- Analyze usage patterns to improve features
- Identify and fix technical issues
- Develop new features based on user needs
- Optimize system performance and reliability
Communication
- Send account-related notifications (password resets, security alerts)
- Notify you of project activity and collaboration invitations
- Provide customer support
- Send storage and retention alerts
- Send marketing communications (with your consent)
Security and Compliance
- Prevent fraud and unauthorized access
- Enforce our Terms of Service
- Comply with legal obligations
- Respond to legal requests and protect rights
Audio Files & User Content
Audio as Personal Information
We recognize that audio recordings may contain personal information, including:
- Voice recordings that can identify individuals
- Musical performances that are personal creative works
- Conversation or vocal content
Under GDPR, CCPA, and similar regulations, such audio content is treated as personal information entitled to privacy protection.
How We Handle Your Audio Files
Storage: Your audio files are stored securely on servers provided by Supabase, our infrastructure provider. Files are encrypted at rest and in transit.
Access: Your audio files are only accessible to:
- You (the uploader)
- Collaborators you have explicitly invited to the project
- Circle Room personnel only when necessary for technical support (with your consent) or legal compliance
Processing: We process your audio files only to:
- Store them on our servers
- Generate waveform visualizations for the feedback interface
- Transmit them to authorized collaborators
- Create backup copies for data integrity
We do NOT use your audio files to train machine learning models, sell to third parties, or any purpose other than providing the Service.
File Retention Policies
Audio files are automatically deleted based on your subscription tier:
| Tier | Retention Period | |------|------------------| | Free | 24 hours | | Professional | 96 hours (4 days) | | Studio | 14 days (2 weeks) |
After the retention period, audio files are permanently deleted from our servers. Metadata and feedback comments may be retained to preserve your collaboration history.
Deleting Your Audio Files
You can delete your audio files at any time through the project interface. Deleted files are removed from active storage immediately and from backup systems within 30 days.
To request deletion of all your data, visit Settings > Data Export in your account.
Third-Party Sharing
We share your information with the following third parties:
Service Providers
Supabase (Database, Storage, and Authentication)
- Hosts our database and file storage infrastructure
- Provides authentication services
- Data processed in accordance with their privacy policy and GDPR compliance
Stripe (Payment Processing)
- Processes subscription payments
- Stores payment method information securely
- PCI-DSS compliant
- Data processed in accordance with Stripe's privacy policy
Resend (Email Delivery)
- Delivers transactional and notification emails
- Receives your email address for delivery purposes
- Data processed in accordance with their privacy policy
Collaborators
When you invite collaborators to a project, they will have access to:
- Your display name and profile information
- Audio files within shared projects
- Feedback and comments on shared projects
You control who has access to your projects. We recommend only inviting trusted collaborators.
Legal Requirements
We may disclose your information if required to do so by law or in response to:
- Valid legal process (subpoenas, court orders, search warrants)
- Requests from law enforcement or government agencies
- Protection of our legal rights or defense against legal claims
- Emergency situations involving potential harm to individuals
Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change and any choices you may have regarding your information.
No Sale of Personal Information
We do not sell your personal information to third parties. This includes not selling data for monetary consideration or for other valuable consideration under CCPA definitions.
Your Rights
Depending on your location, you may have the following rights regarding your personal information:
Access and Portability
You have the right to:
- Access the personal information we hold about you
- Receive a copy of your data in a portable format
- View and download your profile information, projects, and feedback history
How to exercise: Visit Settings > Data Export to download your data in JSON format.
Correction
You have the right to:
- Correct inaccurate personal information
- Update incomplete information
How to exercise: Edit your profile information directly in Settings.
Deletion
You have the right to:
- Request deletion of your personal information
- Delete your audio files and projects
- Close your account and remove all associated data
How to exercise: Visit Settings > Data Export to request account deletion. Audio files can be deleted individually through project settings.
Restriction and Objection
You have the right to:
- Restrict processing of your personal information in certain circumstances
- Object to processing based on legitimate interests
How to exercise: Contact us at [Circle Room Contact Email] with your request.
Opt-Out of Marketing
You have the right to:
- Opt out of marketing communications at any time
- Manage notification preferences
How to exercise: Use the unsubscribe link in any marketing email or adjust preferences in Settings > Notifications.
California Residents (CCPA/CPRA)
If you are a California resident, you have additional rights:
- Right to Know: Request disclosure of personal information collected, used, and disclosed
- Right to Delete: Request deletion of personal information (subject to exceptions)
- Right to Correct: Request correction of inaccurate personal information
- Right to Opt-Out: We do not sell personal information, so this right does not apply
- Right to Non-Discrimination: We will not discriminate against you for exercising these rights
To exercise these rights, contact us at [Circle Room Contact Email] or use the Data Export feature in Settings.
European Union and UK Residents (GDPR)
If you are located in the EU or UK, our lawful bases for processing your personal information are:
- Contract Performance: Processing necessary to provide the Service you requested
- Consent: Processing based on your explicit consent (e.g., marketing communications)
- Legitimate Interests: Processing for our legitimate business interests where not overridden by your rights
- Legal Obligation: Processing required to comply with applicable laws
You have the right to lodge a complaint with your local data protection authority if you believe we have violated your rights.
Canada Residents (PIPEDA)
Canadian residents have the right to access, correct, and request deletion of personal information. We will respond to valid requests within 30 days.
Australia Residents (APPs)
Australian residents have the right to access, correct, and request deletion of personal information under the Australian Privacy Principles.
International Data Transfers
Circle Room is based in the United States. Your information may be transferred to and processed in the United States or other countries where our service providers maintain facilities.
Safeguards
When we transfer personal information internationally, we implement appropriate safeguards:
- Standard Contractual Clauses approved by the European Commission
- Data processing agreements with all service providers
- Security measures consistent with industry standards
Supabase Infrastructure
Our infrastructure provider, Supabase, maintains data centers in multiple regions. Your data may be processed in the region most appropriate for service delivery and reliability.
Data Security
We implement technical and organizational measures to protect your personal information:
Technical Measures
- Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security)
- Encryption at Rest: Stored data, including audio files, is encrypted on our servers
- Access Controls: Role-based access controls limit who can access your data
- Row-Level Security: Database-level security ensures users can only access their own data
- Secure Authentication: Password hashing and optional two-factor authentication
Organizational Measures
- Limited employee access to personal information on a need-to-know basis
- Regular security training for personnel
- Incident response procedures for security breaches
- Regular security assessments and vulnerability testing
Your Responsibilities
You are responsible for:
- Maintaining the security of your account credentials
- Using strong, unique passwords
- Enabling two-factor authentication for enhanced security
- Reporting any suspected unauthorized access to your account
Breach Notification
In the event of a data breach affecting your personal information, we will:
- Notify you without undue delay (within 72 hours where required by GDPR)
- Notify relevant supervisory authorities as required by law
- Take steps to mitigate the impact of the breach
Children's Privacy
Circle Room is not intended for use by children under:
- 13 years of age (United States)
- 16 years of age (European Union)
- The age of majority in other jurisdictions
We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information.
If you believe a child has provided personal information to Circle Room, please contact us at [Circle Room Contact Email].
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
Notification of Changes
We will notify you of material changes by:
- Posting the updated Privacy Policy with a new "Last Updated" date
- Sending an email notification to your registered email address
- Displaying a prominent notice within the Service
Your Continued Use
Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated Privacy Policy. If you do not agree with the changes, you should stop using the Service.
Reviewing Changes
We encourage you to periodically review this Privacy Policy for the latest information on our privacy practices.
Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:
Email: [Circle Room Contact Email]
Data Protection Officer: For GDPR-related inquiries, you may contact our Data Protection Officer at the email address above.
Response Time: We will respond to privacy-related inquiries within 30 days, or sooner where required by applicable law.
Complaints: If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.