Privacy Policy

Sinuose (“we”, “our”, “us”) operates the Sinuose web application and mobile application (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this policy carefully. By using Sinuose, you agree to the collection and use of information in accordance with this policy.

Account Information: When you create an account, we collect your email address, display name, and profile avatar selection. If you sign in via Google or Apple, we receive your name and email from those providers. We do not receive or store your Google or Apple password. Audio Files: When you upload an MP3 file for enhancement, the file is temporarily processed on our servers. We do not permanently store your original audio files after processing is complete. Enhanced audio files that you save to your library are stored in our cloud database (Convex) and associated with your account. Usage Data: We collect information about how you use the Service, including enhancement mode selections, daily usage counts, enhancement scores, and queue activity. This data is used to enforce usage limits and improve our service. Payment Information:Subscription payments are processed through Apple's In-App Purchase system (for iOS) or through our payment processor Adapty. We do not directly collect, store, or have access to your credit card number or payment details. Payment processing is handled entirely by Apple and Adapty in accordance with their respective privacy policies.

When you enhance an audio file, it is sent from your device to our API server (hosted on Vercel), which forwards it to our audio processing server (hosted on Railway). The audio is processed using FFmpeg, an open-source audio processing tool — we do not use artificial intelligence or machine learning to process your audio. The processing applies equalization, compression, loudness normalization, and stereo enhancement using deterministic digital signal processing algorithms. Your audio file is temporarily stored during processing (typically 5-15 seconds) and is deleted from the processing server immediately after the enhanced version is returned to you. If you choose to save the enhanced track to your library, it is stored in our database (Convex, hosted in the United States) until you delete it.

Sinuose uses the following third-party services that may process your data: • Clerk(clerk.com) — Authentication and user management. Processes your email, name, and login credentials. Privacy policy: https://clerk.com/legal/privacy • Convex(convex.dev) — Cloud database. Stores your profile, tracks, and usage data. Servers located in the United States. Privacy policy: https://www.convex.dev/legal/privacy • Vercel(vercel.com) — Hosts our web application. May log IP addresses and request metadata. Privacy policy: https://vercel.com/legal/privacy-policy • Railway(railway.app) — Hosts our audio processing server. Audio files pass through Railway's infrastructure during enhancement. Privacy policy: https://railway.app/legal/privacy • Adapty(adapty.io) — Manages in-app subscriptions and payment processing. Privacy policy: https://adapty.io/privacy • Apple— Handles In-App Purchase transactions and Sign in with Apple authentication. Privacy policy: https://www.apple.com/legal/privacy • Google— Provides Sign in with Google authentication. Privacy policy: https://policies.google.com/privacy Each service processes only the data necessary for their function. Audio files sent to Railway for processing are not permanently stored by Railway.

We process your personal data on the following legal bases: • Performance of a contract(Art. 6(1)(b)) — account data, uploaded and enhanced audio, library contents and subscription records. We cannot provide the Service without processing these. • Legitimate interests(Art. 6(1)(f)) — security logging, abuse and rate-limit enforcement, and aggregate usage statistics used to diagnose faults and improve the Service. You may object to processing based on legitimate interests at any time. • Legal obligation(Art. 6(1)(c)) — retention of payment and accounting records under Danish law. • Consent(Art. 6(1)(a)) — where you explicitly opt in, for example by making a track public on your profile. You may withdraw consent at any time. We do not sell your personal data, and we do not use it for automated decision-making or profiling with legal effects.

Sinuose does not use advertising or third-party tracking cookies, and we do not run any analytics SDK. • Authentication cookies— set by Clerk to keep you signed in and to protect against cross-site request forgery. These are strictly necessary for the Service to function and cannot be disabled while you are signed in. • Local storage— used on your own device to remember your theme choice, playback and app preferences. This data never leaves your device and is not personal data we receive. Because we set only strictly necessary cookies, no consent banner is required under the ePrivacy Directive or the Danish Cookie Order (cookiebekendtgørelsen). You can clear cookies and local storage at any time through your browser or by deleting the app.

Your data is stored and processed on servers located in the United States. Convex, Vercel, Railway, Clerk and Adapty are all US-established processors, so using Sinuose involves a transfer of personal data outside the European Economic Area. Transfer mechanism:These transfers are made under the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) pursuant to Article 46(2)(c) GDPR, incorporated into our agreements with each processor, or — where the processor is certified — under the EU-U.S. Data Privacy Framework adequacy decision of 10 July 2023. We rely on our processors' published transfer terms and review them when they change. Data Processing Agreements: Each processor listed in section 4 acts as a sub-processor under a Data Processing Agreement meeting the requirements of Article 28 GDPR, which restricts them to processing your data only on our documented instructions, obliges them to maintain appropriate security measures and confidentiality, and requires deletion or return of the data at the end of the engagement. Supplementary measures: Audio is transmitted over TLS, is not retained by our processing server after enhancement completes, and no processor is granted access to your data for its own purposes. You may request a copy of the relevant transfer terms by contacting support@sinuose.app.

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically: • Account information: retained until account deletion • Enhanced audio files: retained until you delete them or your account • Usage data: retained for 24 months for analytics purposes • Payment records:retained for 5 years as required by Danish accounting law (bogføringsloven) Audio files uploaded for enhancement are deleted from our processing servers immediately after processing. You may request deletion of your data at any time by contacting support@sinuose.app, or delete your account directly through Settings → Danger Zone. We will process deletion requests within 30 days.

As a data subject under the EU General Data Protection Regulation (GDPR), you have the right to: • Access: request a copy of your personal data • Rectification: correct inaccurate personal data • Erasure:request deletion of your personal data (“right to be forgotten”) • Portability: receive your data in a machine-readable format • Objection: object to processing of your data for direct marketing • Restriction: request restriction of processing in certain circumstances To exercise any of these rights, contact: support@sinuose.app You also have the right to lodge a complaint with the Danish Data Protection Authority (Datatilsynet) at www.datatilsynet.dk.

Sinuose is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete that information promptly.

We use commercially reasonable measures to protect your personal information, including encrypted connections (HTTPS/TLS) for all data transmission, secure authentication through Clerk, and access controls on our databases. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

If a personal data breach occurs, we will notify the Danish Data Protection Authority (Datatilsynet) without undue delay and, where feasible, within 72 hours of becoming aware of it, as required by Article 33 GDPR. Where notification is made later than 72 hours, it will be accompanied by reasons for the delay. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay, in clear and plain language, describing the nature of the breach, the likely consequences, the measures taken or proposed, and a point of contact — as required by Article 34 GDPR. We maintain an internal record of all personal data breaches, including those that do not meet the notification threshold. Our processors are contractually required to notify us without undue delay of any breach affecting your data.

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the “Last updated” date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or your data, contact us at: Email: support@sinuose.app Sinuose v/ Samuel Stecher Copenhagen, Denmark CVR-nr. 46545990 — sole proprietorship (enkeltmandsvirksomhed), Denmark Data controller for the purposes of the GDPR.