Privacy policy

Data controller

The data controller is:

Personal data we process

We may process the following personal data:

• Identity and contact details: name, email, phone number, artist name and social links.
• Optional billing and contract details: company, tax ID, address, city, postal code and country.
• Privacy and communication preferences, including the acceptance date and optional marketing consent.
• Account data: login credentials, user role, permissions and invitations.
• Learning activity: portal access, course progress and lessons viewed or completed.
• Private music sends: invitations, access and interactions with shared audio.
• Information you provide in contact forms or emails.
• Contract and electronic signature details: signer's identity, date and time, document version and fingerprint, IP address and basic browser details.
• Booking information needed for mentoring or meetings when TidyCal is used.
• Basic technical data needed for site operation, security and abuse prevention.

How we use your data

• Create and manage user accounts.
• Keep the details you provide in sync with our internal contact records.
• Provide access to the portal and its content.
• Manage permissions based on purchased or assigned access.
• Record course progress.
• Send invitations, password recovery messages and transactional emails.
• Manage private music sends and collect private usage statistics.
• Respond to form submissions and emails.
• Manage bookings, mentoring and requested services.
• Prepare, send, sign, document and retain license agreements.
• Keep the platform secure and operational.
• Meet applicable legal obligations.

Legal bases

Depending on the purpose, we process data to perform a contract or requested service, with your consent, based on our legitimate interest in security and abuse prevention, or to meet a legal obligation.

How long we keep data

We keep data for as long as needed for these purposes, while our relationship with you continues or while legal liabilities may arise. You may request deletion when applicable.

Service providers and recipients

Technology providers may process data on UltraSonic's behalf:

• Supabase: authentication, profiles, permissions and course progress.
• Stripe: payment processing.
• Resend: transactional emails.
• Vercel: website hosting.
• Cloudflare: DNS, security, performance and private file storage.
• Gmail: day-to-day email management.
• YouTube, Spotify and TidyCal: when you accept or interact with external content.

We do not use third-party advertising analytics. Marketing messages are sent only with consent, which you can withdraw in Settings. Private music sends produce internal usage statistics accessible only to UltraSonic.

International transfers

Some providers may be outside the European Economic Area or process data on international servers. Appropriate safeguards will be used as required by applicable law.

Your rights

You may request access, correction, erasure, objection, restriction of processing and portability by writing to contact@ultrasonic.studio. You may also complain to the Spanish Data Protection Agency if you believe processing does not comply with the law.

Security

We apply reasonable technical and organizational measures to protect personal data and reduce the risk of unauthorized access, loss, alteration or misuse.

Children

UltraSonic is not intended for children under 14. If we learn that a child's data was collected without valid authorization, we will delete it where required.

Cookies and external content

Cookies and external content are covered by our cookie policy.

Changes to this policy

We may update this policy to reflect legal, technical or service changes. The current version is always the one published on this page.

Contact

For privacy questions or to exercise your rights, write to contact@ultrasonic.studio.