This service is operated by Heymow Studio. The legal structure behind Heymow Studio is Khaled Chehab EI, sole proprietor (Entrepreneur Individuel) registered at 173 rue de Courcelles, 75017 Paris, France, SIREN 999208556.
Heymow Studio is the data controller for the personal data processed on this platform. The data protection contact is [email protected].
Last updated: 21 October 2026.
Your rights and how to exercise them
Under the General Data Protection Regulation (Regulation (EU) 2016/679, «GDPR») and the French Data Protection Act, you have:
Right of access (art. 15): get a copy of every personal-data record we hold about you.
Right to rectification (art. 16): correct inaccurate data from your settings page.
Right to erasure (art. 17): delete your account and personal identifiers, subject to the legal-retention exceptions described below.
Right to data portability (art. 20): a machine-readable JSON export.
Right to object / restrict (art. 18 / 21): limit specific processing or object to it.
Right to withdraw consent (art. 7.3): where a processing relies on your consent (optional opt-in features), you can withdraw it at any time, without affecting processing carried out before withdrawal.
The fastest way to use the access and erasure rights is the self-serve panel on /settings/profile (Privacy & data section). For anything else, write to [email protected]. We respond within one calendar month (extensible by two further months with notice, GDPR art. 12.3).
You may lodge a complaint with the CNIL (cnil.fr) or the data protection authority of your member state if you are dissatisfied with how we handle your data.
What we collect and why
Account identity: email address (sign-in via magic link or Google OAuth), display name, profile slug, optional avatar and bio. Legal basis: contract performance (art. 6.1.b).
Published text content: lyrics and liner notes you add to your tracks. These are free-text fields authored by you and displayed publicly on your release page. They may contain personal data about you or third parties you name. Legal basis: contract performance (art. 6.1.b).
Purchases and tips: amount, currency, Stripe payment intent identifier, party-discount marker, withdrawal-waiver timestamp under article L. 221-28 13° of the French Consumer Code. Legal basis: contract performance + legal obligation (10-year fiscal retention).
What the artist sees when you buy. When you buy or are gifted a release, you buy directly from the artist through their own Stripe account. Because the artist is the seller, they receive the information a seller needs to complete and account for the sale: the name and email address entered at checkout (this is your account email), the country of the payment, your card's brand and last four digits, and, when your card's verification requires it, elements of your billing address such as the postcode. The artist never receives your full card number, which stays with Stripe. For this information the artist is the data controller for their own sales, and our seller terms bind them to keep it confidential, use it only for the sale and their own legal duties, and never contact or market to you without your consent. Stripe processes the payment as a separate controller under its own terms. SynthCamp keeps its own record of the sale, such as the amount, currency and payment reference, to run the marketplace and meet its legal obligations. Misusing buyer data to expose, pressure or market to a buyer leads to permanent removal from SynthCamp under our Community Standards.
Social activity: follows, party attendance, party reactions, chat messages. Legal basis: contract performance.
Moderation records: reports filed and received, moderation decisions (DSA art. 14, 17, 23). Legal basis: legal obligation under the Digital Services Act.
DAC7 fiscal reporting (artists only): if you sell music on SynthCamp and your annual activity crosses the DAC7 threshold (30 transactions OR EUR 2,000 in gross revenue within a calendar year), French law (article 242 bis of the Code général des impôts, transposing EU Directive 2021/514) requires the platform to transmit your tax identification number, identity, full address, and quarterly revenue to the DGFIP each January for the previous fiscal year. The first SynthCamp filing covers fiscal year 2026 and is due January 2027. You will see a banner on /settings/profile?tab=payments once you approach the threshold so you can supply your TIN or, alternatively, your place of birth (the legal fallback when no TIN is available). Legal basis: legal obligation. Buyers are never reported under DAC7; only sellers are in scope.
Gift recipient email: when you buy a release as a gift, we process the recipient's email address for the sole purpose of sending them the private claim link (and, on request, resending it). Legal basis: our legitimate interest in letting you deliver a gift you have paid for (art. 6.1.f). We do not use this address for marketing and we do not build a profile from it. If the gift is never claimed, we delete the stored recipient address after 12 months.
Comp invitation email: if you send someone a free copy of your own release by email (a comp invitation), we process the recipient's email address for the sole purpose of sending them the private claim link. Legal basis: our legitimate interest in letting you share your release for free with someone (art. 6.1.f). We do not use this address for marketing and we do not build a profile from it. Claiming the invitation removes the stored address right away. An invitation nobody claims keeps it only until it expires, then we delete it at the next monthly purge run. An invitation expires 30 days after it was sent, or 30 days after the release date when that is later, so the link survives the wait on a record that is not out yet, and never more than 120 days either way. The invitation email states the exact date.
Backstage updates (in-app): when you follow an artist, we show you the updates they post on SynthCamp about their own work, because following them is a clear sign you expect to hear from them. Legal basis: the legitimate interest of the artist and of SynthCamp in connecting a creator with the audience that chose to follow them (art. 6.1.f). Artists can send at most two of these every seven days. You can object at any time: mute one artist's Backstage, or turn all in-app Backstage updates off in your settings. Both are separate from unfollowing, so you keep the follow while stopping the messages.
Backstage emails (optional): if you turn this on, we email you when an artist you follow posts a Backstage update about their own work. We send these for the artist, server-side: the artist never sees your email address. The artist can see which of their followers are on their email list, shown by public name and avatar only, the same name and avatar already visible across SynthCamp. In the same way, when you tap Wait on one of an artist's upcoming launch parties, that same public name and avatar appear on the artist's wait list for that party, so they can see who is looking forward to it (legal basis: the legitimate interest of the artist and of SynthCamp in connecting a creator with the people who chose to follow their work, art. 6.1.f). Legal basis for the emails: your consent (art. 6.1.a) and the applicable ePrivacy rules on electronic messaging. They also depend on your general email notifications setting: with that off, no Backstage emails are sent even while this stays on. You can withdraw at any time, either by muting a single artist from inside any email or by turning all of these off in your settings, and you then drop off the list.
Discord account link. If you connect your Discord account, we store your Discord user ID and the tokens needed to keep your community-server roles in sync, and we use the link to check whether you hold the alpha tester role. You can unlink at any time in Settings, which deletes what we hold.
Party announcements on SynthCamp's social accounts (optional, artists). If you say yes on your parties page, in the party scheduling form or from our email, SynthCamp announces your public launch parties on its Instagram, X and Facebook: the day before, and with an Instagram Story on the day. The posts use your release cover, cropped into a SynthCamp image with the party details, and your artist name. On the day, the Story can also use a few seconds of your release's preview. Legal basis: your consent (art. 6.1.a). Recipients: Meta (Instagram, Facebook) and X, which publish the posts under their own terms, and Buffer, which schedules them for us as a processor. We keep each answer you give (yes or no, the wording you saw, where and when you answered) as proof of consent. You can withdraw at any time from your parties page. Announcements already published are then deleted within 7 days.
Automated processing
At upload, SynthCamp runs automated checks: a perceptual audio fingerprint for duplicate detection and a metadata scan for AI-tool indicators and C2PA content credentials. A match routes a release to human pending review rather than removing it automatically (manifestly illegal content is the exception: it is removed promptly with a statement of reasons).
You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (GDPR art. 22). You can request human review and contest the outcome through the internal complaint procedure described in the Terms of Service (sections 4.8 to 4.10).
Retention
Personal data is kept only as long as necessary for the purpose it was collected. The dominant retention drivers:
Active account: kept while the account exists. We do not erase accounts on a fixed timer. You can delete yours at any time from your settings, which triggers the erasure pipeline described below.
Audio fingerprints: kept for as long as the release stays in the catalogue, so later uploads can be deduplicated against it (anti-duplication legitimate interest). They are removed from the recognition processor when you erase your account, not on a fixed timer.
Purchases / tips / fiscal records: 10 years from the end of the fiscal year of the transaction (article L. 123-22 of the French Code de Commerce). Personal identifiers are anonymised on erasure but the underlying transaction record is preserved.
Moderation records (reports, bans, decisions): actioned decisions (sanctions, statements of reasons, appeals) are kept for the life of the account plus ten years after closure (records-of-processing / DSA accountability). Unactioned reports are kept for three years. See the Moderation Policy section 9 and the Community Standards section 11.
Stripe tax identifiers (DAC7): kept until the year-end fiscal export to the DGFIP under article 242 bis of the French CGI, then archived.
Backstage messages and choices: messages an artist sends through Backstage are kept while the account stays open, so the artist and their followers keep their history. Your Backstage mutes and your email opt-in choice are kept while your account is open, and the opt-in and opt-out timestamps are kept as proof of consent. All of it is removed when you erase your account.
Party social answers: kept while the account is open as proof of consent, removed at erasure.
Mastering projects. The audio file and settings of a saved mastering project are kept while the project exists. They are removed when you delete the project and erased with your account. They are never publicly available.
Party Replay. Party chat, reactions and replay passes are deleted about 54 hours after a party ends.
Timed lyrics.The timed lyrics file is kept while the track is published, and deleted the moment you turn the feature off for that track or delete the track. The mono copy of the audio and the typed lyrics we send to Google to produce it travel inside the request and are never stored on Google's side at all. Nothing of the file survives erasing your account.
Connection identifiers (IP addresses, session timestamps, user-agent): retained for at most 1 year as required by French law (article L. 34-1 of the Code des postes et des communications électroniques, transposing the obligation to keep technical identifiers available to law enforcement on judicial request). Where SynthCamp stores hashed IPs inline on a database row (for fraud-history scoring on reports and refund requests), the connection identifier is removed from the row at 12 months while the row itself stays for the underlying audit. When a visitor follows a link to a community partner, SynthCamp keeps a hashed form of their IP address for the rest of that day only, to count each visitor once, then deletes the hash. The count itself (partner, page, day) holds no personal data. Where SynthCamp captures connection identifiers in log files (Caddy access logs on the VPS), the file rotation cycle is set under 12 months. The retention applies regardless of account state; erasing your account does not shortcut this window because it is a regulatory obligation, not a SynthCamp design choice.
What stays after account erasure
When you exercise your right to erasure (art. 17), we run a structured pipeline that deletes your social activity (notifications, follows, party engagement, playlists, party messages) and anonymises the data we are legally required to retain.
The anonymised records preserve their database row for legal accountability (purchases, tips, reports, moderation logs) but the row no longer carries your personal identifiers. Specifically: your display name reads «Deleted user», your email is replaced with a black-holed alias on the .invalid TLD, your Stripe Connect link is severed, and reports filed by you have your name and email overwritten.
A note on identifiers: to keep referential integrity across the database, we retain the internal account identifier (UUID) on the anonymised records. This identifier is not personally identifying on its own, but a person with read access to the moderation back-office could in principle correlate two anonymised records that share the same UUID. Read access to the moderation back-office is restricted to the SynthCamp moderation team. The data subject identifier is the same identifier that appears in the legally retained business records (purchases, fiscal exports), so retaining it is not a regression of the privacy posture.
Audio fingerprints uploaded to our duplicate-detection processor (ACRCloud, eu-west-1 / Frankfurt) are deleted from that processor as part of the erasure pipeline. Where a fingerprint cannot be targeted automatically (legacy uploads), it is removed by a manual backfill pass. The residual is logged in the moderation queue.
Sub-processors
We rely on the following sub-processors. Each operates under a data processing agreement and is restricted to the categories of data listed.
Stripe (payments + payouts): Stripe Payments Europe Ltd, Ireland, EU (with onward processing by Stripe, Inc. in the US under the EU-US Data Privacy Framework).
Cloudflare R2 (audio storage + DSAR archive bucket): Cloudflare Inc., US (with Standard Contractual Clauses).
Brevo (transactional email): Brevo SAS, France, EU.
ACRCloud (audio fingerprint matching, eu-west-1 / Frankfurt): ACRCloud Co. Ltd, with EU regional processing.
Railway (application hosting): Railway Corporation, US (with Standard Contractual Clauses).
Google(two uses, both named here): optional Google OAuth sign-in, used only if you choose it, and the Gemini API, to which we send a mono copy of a track's master audio and its typed lyrics to produce a timed lyrics file for live listening rooms. The audio travels inside the request and is never stored on Google's side, so there is nothing of it left there to delete. Google LLC, US (EU-US Data Privacy Framework).
Umami (aggregate, cookieless web analytics that sets no cookies and stores no individual visitor identifiers): Umami Software, Inc., US (with Standard Contractual Clauses).
Buffer(scheduling of SynthCamp's own social posts, only for artists who said yes to party announcements): Buffer, Inc., US (EU-US Data Privacy Framework, with Standard Contractual Clauses as a further mechanism).
Server-side mastering
When you use Auto in the mastering workbench, your track is processed by our mastering service on our own servers. We keep the auto-master outputs while the mastering project exists and remove them when you delete the project or your account. A reference track you upload for a match is analyzed only, no part of it ever appears in your master, it is never published, and it is deleted with the job.
Research on public posts about AI music
Beyond the platform, we study what people write in public about AI music, to shape SynthCamp and the way we talk about it. We read public posts and comments about AI music on Bluesky, X, Reddit, Hacker News, Lemmy, TikTok and YouTube.
A model labels each message, for example its view of AI music or the need it describes, and we count those labels week by week. Only our founder reads the results. We never use this research to write to anyone in private, to profile anyone or to make a decision about a person.
Our legal basis is our legitimate interest in understanding this young market without paying for a panel (art. 6.1.f).
What we keep:
X, Reddit, TikTok and YouTube: the labels, the date, a few counts such as likes and replies, and a link to the message. Its words are dropped once it is labelled, apart from small samples we check by hand and then delete.
Bluesky, Hacker News and Lemmy: the words too, for 12 weeks. After that, only the labels, the date, the counts and the link remain.
Who wrote it: we keep no username or display name next to a message. Handles, email addresses and phone numbers written inside a message are masked before we keep it. Still, a link leads to its author once opened, and every Bluesky link we keep carries the account ID of the person who posted, so the Bluesky messages of one account can be matched to each other. We never put them together to learn anything about that person.
Threads we may join: we also use these labels to list up to 30 threads opened in the last two weeks on Reddit, X, Hacker News and Lemmy that touch what SynthCamp works on, such as mastering, distribution or labelling AI music. Our founder reads some of them and may reply in public, under his own name, as the founder of SynthCamp. The list keeps a link to each thread, its date, how many of its messages we read and its topics, plus its title on Hacker News and Lemmy. It never keeps a username or any words from Reddit or X, and we rebuild it every day. For the same reason we read the popular threads of a few Reddit communities each week, and we delete that list within a week.
Technical providers in the United States fetch these public messages for us. To label each message, we send its words, with handles and contact details masked but without its link or its author, to OpenRouter, Inc. in New York, which passes them to the labelling model of TypeSafe AI, Inc. in San Francisco. Neither company is certified under the EU-US Data Privacy Framework, so this transfer relies on the European Commission's standard contractual clauses, in OpenRouter's data processing agreement with us and in TypeSafe's with OpenRouter, and you can ask us for a copy at [email protected]. Neither keeps the words once the label is returned, and neither trains a model on them.
If one of your posts is in this research and you would rather it was not, send its link to [email protected]. We reply within a month. The post leaves our data, your words leave any other message we kept that quotes them, and we never collect that post again.
You can also object for your whole account by sending us your profile link. On Bluesky we remove every message of yours we hold. On the other platforms we never store who wrote what, so your account alone cannot lead us to your past messages: send their links too if you want them gone. From then on, we leave out anything you post.
To see what we hold about one of your posts, write to us as well. We first check that the post is yours, because what we noted about a message says something about its author. Copies in our backups are gone within 30 days.
Cookies
We use strictly necessary cookies (session token, age verification marker) which do not require consent under article 5(3) of the ePrivacy Directive. We do not use tracking or advertising cookies.
Children
The service is not intended for users under 15, the minimum age for digital consent in France (Loi 78-17, art. 7-1). We do not knowingly collect data from children below that age and will delete any such account on discovery.
Changes
Material changes to this notice are announced by email and via an in-app banner at least 30 days before they take effect. Continued use of the service after that period constitutes acceptance.
Contact
For any privacy-related question, write to [email protected]. Postal address: Heymow Studio, 173 rue de Courcelles, 75017 Paris, France.