Privacy Policy

Last updated 2026. This explains what [LEGAL ENTITY] ("Cumbre") collects, why, and your choices. Data controller: [LEGAL ENTITY], [ADDRESS].

Our core promise

Your uploaded audio is deleted after analysis, and your lyrics are never stored. We keep the derived scores and feature metrics — never the audio file, and never verbatim lyric text.

What we collect

Email address — for your account, via our identity provider (AWS Cognito).
Uploaded audio — the recording you submit, processed transiently and then deleted (see retention).
Derived feature vectors & scores — the numeric audio/lyric metrics and the resulting grade and report, which we retain.
Stripe customer id & billing status — to manage your purchase or subscription (we do not store card numbers).
Basic usage/diagnostic logs — to operate and secure the service.

How we use it

To produce your craft report, provide and bill the service, prevent abuse and copyright infringement (an automated originality check runs before delivery), improve our models in aggregate using derived metrics (never your audio or lyrics), and meet legal obligations.

Sub-processors

We share the minimum data necessary with vetted processors:

Amazon Web Services (AWS) — hosting, storage, and Cognito identity.
Stripe — payments and subscription billing.
Anthropic — LLM-assisted lyric/craft feedback (derived inputs only).
OpenAI — transcription/moderation of audio during processing (transient).
ACRCloud — audio fingerprint / originality check.

Retention

Uploaded audio: ≤ 1 day — deleted promptly after analysis completes.
Lyrics / transcripts: never stored; transient and per-user during processing only.
Derived metrics, scores & reports: retained while your account is active, so your summit log persists, until you request deletion.
Account & billing records: retained as required for tax/accounting and fraud prevention.

Your rights

Subject to applicable law, you may request to access, export, correct, or delete your personal data, and object to or restrict certain processing. To make a request, email [DMCA AGENT NAME/EMAIL] from your account email; we will verify and respond within the timeframe the law requires. Deleting your account removes your derived metrics and report history (records we must keep for legal reasons excepted).

Lawful basis

Where required (e.g. GDPR/UK GDPR), we rely on: performance of a contract (to deliver the analysis you purchased), legitimate interests (securing the service, preventing abuse, improving models with derived data), consent (where specifically requested), and legal obligation (tax, accounting, responding to lawful requests).

Contact

Privacy questions or requests: [DMCA AGENT NAME/EMAIL], [LEGAL ENTITY], [ADDRESS].