Privacy Policy

1. Who the data controller is

BasicSinging is a service operated by Signal Harbor, a French société par actions simplifiée unipersonnelle (SASU) with share capital of €1, registered with the Registre national des entreprises under SIREN 130 183 650 (SIRET 130 183 650 00014), whose registered office is at 62 Rue Gabriel Péri, 93430 Villetaneuse, France.

Signal Harbor is the data controller (responsable de traitement) for the personal data described in this policy. Where this policy says "we", it means Signal Harbor. All data protection questions and requests go to contact@basicsinging.com.

2. Scope of this policy

This policy covers the website at basicsinging.com and the BasicSinging application. It is written to meet Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR) and French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as amended.

3. Personal data we collect

• Your email address — given at checkout and passed to us by our payment processor. There is no registration form, no password and no profile: the email address is the only identifier we hold, and it is what receipts and renewal notices are sent to.
• Uploaded audio — the vocal recordings and backing tracks you upload for processing.
• Processing settings and project history — the key you chose, slider positions, saved presets and the list of tracks in your account.
• Billing information — handled by our payment provider, which acts as merchant of record. We receive confirmation of payment, the plan, the country used for tax purposes and the last four digits of the card. We never see or store your full card number.
• Technical data — IP address, browser and device type, operating system, and the pages and actions recorded in usage logs.
• Cookies — as described in the Cookie Policy.

4. Your voice recordings

A recording of a person's voice is personal data, and the recordings you upload are the most sensitive thing we hold. Here is exactly what happens to them.

• Recordings are processed solely to produce your own output — the cleaned, tuned and mixed files you download.
• No voiceprint, biometric template or speaker identification is created or stored. The system works on the audio signal. It does not build a model of who you are, and nothing it produces could be used to recognise your voice elsewhere. We carry out no processing of biometric data for the purpose of uniquely identifying a person within the meaning of Article 9 of the GDPR.
• Recordings are not used to train voice models, ours or anyone else's. Our processing providers are engaged under terms that prohibit training on customer content.
• Recordings are not sold, licensed, published or shared with anyone other than the processors listed in section 8, and only to the extent needed to produce your output.
• Uploaded audio and rendered output are deleted automatically 30 days after processing, and you can clear them sooner from the processor.

5. Lawful bases under the GDPR

We rely on the following lawful bases, in the terms of Article 6(1) of the GDPR:

• Performance of a contract (Article 6(1)(b)) — for the core service: opening and maintaining your access to the processor, processing the audio you upload, delivering your downloads and taking payment.
• Legitimate interests (Article 6(1)(f)) — for keeping the service secure, preventing abuse and fraud, diagnosing faults, and improving how the service works. We balance those interests against your rights and freedoms, and use the least intrusive method that achieves the purpose.
• Consent (Article 6(1)(a)) — for non-essential cookies and for marketing email. You can withdraw consent at any time, without affecting processing carried out before withdrawal.
• Legal obligation (Article 6(1)(c)) — for accounting and tax records relating to payments, which French law requires to be kept.

6. Commercial email

We send service messages — receipts, renewal notices, access restored on request, incident notices — because they are needed to run the service. Marketing email about features or offers is sent only where you have given prior consent, as Article L. 34-5 of the French Postal and Electronic Communications Code requires, and every marketing message carries an unsubscribe link that works immediately. You can also write to contact@basicsinging.com to opt out at any time.

7. How long we keep data

• Uploaded audio and rendered output — deleted automatically 30 days after processing.
• Project settings and history — kept while your plan is running, so your presets and track list remain available.
• Your email address — deleted within 90 days of your last plan ending, apart from accounting records, which French commercial and tax law requires us to keep for up to ten years and which are limited to transaction dates, amounts and the details needed on an invoice.
• Security logs — kept for 12 months.

You can clear any track or project from the processor yourself at any time, and ask us to erase your email address by writing to contact@basicsinging.com. Deleted material is removed from active storage immediately and purged from backups within 30 days.

8. Processors we use

We use a small number of processors, each bound by a contract meeting Article 28 of the GDPR and acting only on our instructions:

• a payment provider, which acts as merchant of record for subscriptions and billing;
• a hosting and storage provider, for the application, database and uploaded audio;
• an audio processing infrastructure provider, which runs the cleanup, tuning and mixing;
• a transactional email provider, for receipts, resets and service notices;
• an analytics provider, if you have consented to analytics cookies.

The current list, with the identity and location of each provider, is available on request from contact@basicsinging.com.

9. Transfers outside the European Union

Some of these processors are located outside the European Union and the European Economic Area, including in the United States and the United Kingdom, so your personal data — including uploaded audio — may be transferred outside the EU.

You can ask us for a copy of the safeguards relied on for a particular transfer by writing to contact@basicsinging.com.

10. Security

Data is encrypted in transit with TLS and encrypted at rest. There are no passwords to store: access is recorded in a cookie set in your own browser when payment succeeds. Downloads and previews are served through signed links that expire, so a link to your recording cannot be shared or guessed after it lapses. Administrative access is restricted, logged, and protected by multi-factor authentication.

No system is perfectly secure. Because access lives in the browser you paid from, keep that browser locked when you are away from it, tell us at contact@basicsinging.com if a device with access is lost or shared with someone who should no longer have it, and clear your cookies on any browser you no longer use for this.

11. Your rights

Under the GDPR and French Law No. 78-17 you have the right to:

• access your personal data and obtain a copy (Article 15);
• rectification of data that is inaccurate or incomplete (Article 16);
• erasure, in the circumstances the law allows (Article 17);
• restriction of processing while a question about it is resolved (Article 18);
• portability — to receive data you provided in a structured, commonly used, machine-readable format (Article 20);
• object to processing carried out on the basis of legitimate interests, and to direct marketing at any time (Article 21);
• withdraw consent where we rely on it (Article 7(3));
• give directives about what happens to your personal data after your death, generally or specifically, as Article 85 of French Law No. 78-17 provides. You can register general directives with a trusted third party certified by the CNIL, or send specific directives about this service to us.

12. How to exercise your rights

Write to contact@basicsinging.com from the email address you paid with and tell us what you want to do. We may ask a question or two to confirm your identity, particularly for erasure requests.

We respond within one month of receiving the request, as Article 12(3) of the GDPR requires. If a request is complex or you have made several, we may extend that by up to two further months, and we will tell you within the first month if that happens. There is no charge unless a request is manifestly unfounded or excessive.

13. Complaining to the CNIL

If you are unhappy with how we have handled your personal data, you can lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), the French supervisory authority, at 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at cnil.fr. If you live in another EU or EEA country, you may instead complain to the supervisory authority of your habitual residence or place of work. We would appreciate the chance to put things right first, but you are not required to contact us before complaining.

14. Age requirement

BasicSinging is not intended for children under 16, and access is not knowingly sold to them. If we learn that we hold personal data of a child under 16, we will end the access, refund the current period and delete what we hold. If you believe a child is using a plan, tell us at contact@basicsinging.com.

15. Cookies

Cookies and similar technologies are covered in full in the Cookie Policy, which lists every cookie, its purpose and its duration. Non-essential cookies are set only with your consent, as Article 82 of French Law No. 78-17 requires.

16. Personal data breaches

If a personal data breach occurs, we will assess it without delay. Where it is likely to result in a risk to the rights and freedoms of individuals, we will notify the CNIL within 72 hours of becoming aware of it, as Article 33 of the GDPR requires. Where it is likely to result in a high risk to you, we will tell you directly and without undue delay under Article 34, describing what happened, what data was involved, what we have done and what you can do.

17. Changes to this policy

If this policy changes, the "last updated" date at the top changes with it. For changes that materially affect how your personal data is handled, we will email everyone with a running plan at least 30 days before the change takes effect.

18. Contact

Data protection questions, requests and complaints go to: