As of: July 2026 · Version 1.2 · pursuant to GDPR
Controller within the meaning of the GDPR:
Alexander Tannigel
Burgsteinstr. 29
83646 Wackersberg
Germany
Email: support@ai-music-organizer.com
The following data is processed in the course of operating AI Music Organizer:
The Service is operated on infrastructure provided by Replit, Inc. (USA). When the Service is accessed, the hosting infrastructure processes technically necessary data such as IP address, timestamps and connection data, and creates server logs. Replit processes this data as a Processor for the operation of the application. Further information can be found in the Privacy Policy of Replit.
Login and user management are handled via Clerk, Inc. (USA). Depending on the chosen login method, email address, name, profile picture or OAuth data are processed. Clerk manages authentication and stores corresponding identity data. Further information can be found in the Privacy Policy of Clerk.
Payments and subscriptions are processed via Stripe. The contracting entity for users in the European Economic Area is Stripe Payments Europe, Ltd. (Ireland). Payment data (e.g. credit card details) is not stored on own servers. The Service stores only the information necessary for subscription management: Stripe customer ID, subscription status, payment status, booked packages and storage limits.
The privacy information of Stripe additionally applies to payment processing.
Uploaded files are stored for the purpose of providing the Service. This includes audio files, cover art, reference images and other project-related files. Storage takes place in a Google Cloud Storage bucket provisioned via the Replit infrastructure. Files are served via time-limited, signed URLs. Access to files takes place only within the app functions or via deliberately activated share pages.
For individual AI features initiated by the user, content is transmitted to external AI providers. The providers are OpenAI and Google Gemini. Transmission takes place exclusively for the purpose of providing the respective feature:
Users should not enter or upload content for the processing of which by AI services they do not have authorization. The privacy policies of OpenAI and Google additionally apply.
Every uploaded, replaced or AI-generated cover image is automatically checked in the background for problematic content. For this purpose, the user's cover image file is transmitted to the OpenAI Moderation API. The upload is not delayed or blocked by the check.
If the check indicates potentially non-compliant content (sexual depictions, depictions of minors, or graphic violence), the cover is internally flagged and the relevant features (public share links, video creation) are temporarily suspended. A one-time notification is sent to internal support; this notification contains no image data, only technical metadata (song ID, timestamp, score). The cover is then manually reviewed by an administrator and either approved or deleted.
Transmission to OpenAI takes place solely for the purpose of content moderation. The OpenAI Privacy Policy applies.
AI mastering (analysis and audio processing of audio files) is performed entirely locally on the Service's own server infrastructure. No audio data or personal data is transmitted to external AI providers or other third parties in the process.
When a song is imported via a Suno or Flow share link, the server retrieves the publicly accessible share page of the respective provider and transfers content such as the audio file, cover art, title and lyrics into the Service's own storage. No personal data of the user is transmitted to Suno or Flow in the process; these providers are exclusively the source of the imported content, not recipients of user data.
Users may create public share pages for individual songs and for albums. These pages are accessible without login to anyone who knows the link. Only the content selected for sharing is displayed, e.g. cover art, primary audio, release lyrics, genre and language. The user activates and deactivates the share themselves; deactivated shares are no longer publicly accessible. Share pages may contain a notice "Shared via AI Music Organizer".
AI Music Organizer provides users with public artist pages and Artist Radio. When these pages are visited, technically necessary access data and, where provided, pseudonymous playback and usage data may be processed. Details on the purposes, legal bases, retention periods and recipients can be found in this Privacy Policy.
Users may voluntarily activate selected playlists as public stations in Artist Radio. Activation is triggered by an explicit confirmation in the app. The radio page is accessible without login via a public link and may, depending on the content provided, display or play the radio or artist name, playlist names and descriptions, song titles, artist details, cover art and audio. The user's personal login or email address is not displayed publicly; depending on the page, it may additionally contain the user's referral link.
Users may remove a playlist from Artist Radio at any time. After removal, it is no longer accessible through the public radio page. For the radio function, pseudonymous listener identifiers, playback and interaction events, and favorite actions are processed to provide playback, show current listener counts and evaluate radio usage. These usage and listener figures are not attributed to personal information for radio visitors.
Users are responsible for ensuring that the content published and publicly played by them in Artist Radio, including any personal data of third parties contained in that content, may lawfully be published and played publicly.
System emails (e.g. confirmation and welcome emails) and the newsletter are sent via Resend. Newsletter sign-up uses a double opt-in procedure: delivery only begins after confirmation via a link sent by email. The email address, sign-up and confirmation timestamps as well as confirmation tokens are stored. Users may unsubscribe from the newsletter at any time.
When the Service is accessed, technical data such as IP address, timestamps, pages visited and browser information is recorded in server logs. This data is used exclusively for error analysis, security, abuse prevention and the operation of the Service, and is stored only for as long as necessary for these purposes.
The Service uses technically necessary cookies and local storage for login, security and UI states. These are required for the operation of the Service.
With your express consent, we use Google Analytics to statistically analyze use of the Service. Google Analytics is loaded only after your consent and may use cookies or similar technologies and process pseudonymous usage and device data for this purpose. If you decline, Google Analytics is not loaded. Consent is voluntary and may be withdrawn with effect for the future.
The retention period for Google Analytics data is determined by the settings configured in the Google Analytics account and Google's requirements. We do not use advertising cookies.
Personal data is processed for the following purposes on the following legal bases:
An email address or a supported login method is required to create an account; without this data, no account can be created and the Service cannot be used. For a paid subscription, payment data is additionally required, which is entered directly with Stripe; without it, no subscription can be concluded.
All further information and content (e.g. uploaded files, lyrics, notes, newsletter sign-up) is voluntary. There is no statutory obligation to provide data.
Data is stored for as long as the user account exists or processing is necessary for the operation of the Service. Users may delete their content at any time. The entire account may be deleted by the user via the settings. Upon account deletion via the app, the project, audio, cover and metadata stored in the app, the associated files in cloud storage, the newsletter entry, the Stripe customer account and the login account at Clerk are deleted.
Payment and billing data may be retained for longer periods due to statutory retention obligations (e.g. pursuant to Sections 147 of the German Fiscal Code (AO) and 257 of the German Commercial Code (HGB)), including after account deletion. Server logs are deleted on a delayed basis as part of infrastructure operations.
If the login account is deleted directly with the login service (Clerk) without using the account deletion in the app, the content stored in the app is not automatically deleted as a result. In that case, a message to support@ai-music-organizer.com is sufficient to arrange complete erasure. There is currently no automatic deletion in the event of extended inactivity.
In the course of operating the Service, data is passed to the following third-party providers to the extent required for the respective function:
Data is not passed on to further third parties for advertising purposes.
Some of the providers mentioned process data in the USA or other third countries outside the EU/EEA. Depending on the provider, the transfer is based on the following safeguards:
Under the GDPR, users have in particular the following rights:
To exercise these rights: support@ai-music-organizer.com
Consents given may be withdrawn at any time with effect for the future. The right to lodge a complaint with a competent data protection supervisory authority remains unaffected — in particular with the authority in the EU Member State of habitual residence or place of work.
The supervisory authority responsible for the Controller is:
Bavarian State Office for Data Protection Supervision
(Bayerisches Landesamt für Datenschutzaufsicht)
Promenade 18
91522 Ansbach
Germany
This Privacy Policy may be updated in the event of material changes to the Service or the legal situation. The date of the last amendment is indicated above. Users will be informed of material changes.