Your browser is out of date, so parts of this page may look broken. Please update to the latest Chrome, Edge, Firefox, or Safari.
Skip to content

SynthCamp

Privacy Notice

FREN

Who we are

This service is operated by Heymow Studio. The legal structure behind Heymow Studio is Khaled Chehab EI, sole proprietor (Entrepreneur Individuel) registered at 173 rue de Courcelles, 75017 Paris, France, SIREN 999208556.

Heymow Studio is the data controller for the personal data processed on this platform. The data protection contact is [email protected].

Last updated: 31 May 2026.

Your rights and how to exercise them

Under the General Data Protection Regulation (Regulation (EU) 2016/679, «GDPR») and the French Data Protection Act, you have:

  • Right of access (art. 15): get a copy of every personal-data record we hold about you.
  • Right to rectification (art. 16): correct inaccurate data from your settings page.
  • Right to erasure (art. 17): delete your account and personal identifiers, subject to the legal-retention exceptions described below.
  • Right to data portability (art. 20): a machine-readable JSON export.
  • Right to object / restrict (art. 18 / 21): limit specific processing or object to it.
  • Right to withdraw consent (art. 7.3): where a processing relies on your consent (optional opt-in features), you can withdraw it at any time, without affecting processing carried out before withdrawal.

The fastest way to use the access and erasure rights is the self-serve panel on /settings/profile (Privacy & data section). For anything else, write to [email protected]. We respond within one calendar month (extensible by two further months with notice, GDPR art. 12.3).

You may lodge a complaint with the CNIL (cnil.fr) or the data protection authority of your member state if you are dissatisfied with how we handle your data.

What we collect and why

  • Account identity: email address (sign-in via magic link or Google OAuth), display name, profile slug, optional avatar and bio. Legal basis: contract performance (art. 6.1.b).
  • Music uploads: audio files, encoded HLS streams, audio fingerprints, scan metadata (ISRC, C2PA content credentials, declared AI tools). Legal basis: contract performance + legitimate interest in anti-fraud / anti-duplication (art. 6.1.f).
  • Purchases and tips: amount, currency, Stripe payment intent identifier, party-discount marker, withdrawal-waiver timestamp under article L. 221-28 13° of the French Consumer Code. Legal basis: contract performance + legal obligation (10-year fiscal retention).
  • Social activity: follows, party attendance, party reactions, chat messages. Legal basis: contract performance.
  • Moderation records: reports filed and received, moderation decisions (DSA art. 14, 17, 23). Legal basis: legal obligation under the Digital Services Act.
  • DAC7 fiscal reporting (artists only): if you sell music on SynthCamp and your annual activity crosses the DAC7 threshold (30 transactions OR EUR 2,000 in gross revenue within a calendar year), French law (article 242 bis of the Code général des impôts, transposing EU Directive 2021/514) requires the platform to transmit your tax identification number, identity, full address, and quarterly revenue to the DGFIP each January for the previous fiscal year. The first SynthCamp filing covers fiscal year 2026 and is due January 2027. You will see a banner on /settings/profile?tab=payments once you approach the threshold so you can supply your TIN or, alternatively, your place of birth (the legal fallback when no TIN is available). Legal basis: legal obligation. Buyers are never reported under DAC7; only sellers are in scope.

Automated processing

At upload, SynthCamp runs automated checks: a perceptual audio fingerprint for duplicate detection and a metadata scan for AI-tool indicators and C2PA content credentials. A match routes a release to human pending review rather than removing it automatically (manifestly illegal content is the exception: it is removed promptly with a statement of reasons).

You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (GDPR art. 22). You can request human review and contest the outcome through the internal complaint procedure described in the Terms of Service (sections 4.8 to 4.10).

Retention

Personal data is kept only as long as necessary for the purpose it was collected. The dominant retention drivers:

  • Active account: kept while the account exists. We do not erase accounts on a fixed timer; you can delete yours at any time from your settings, which triggers the erasure pipeline described below.
  • Audio fingerprints: kept for as long as the release stays in the catalogue, so later uploads can be deduplicated against it (anti-duplication legitimate interest). They are removed from the recognition processor when you erase your account, not on a fixed timer.
  • Purchases / tips / fiscal records: 10 years from the end of the fiscal year of the transaction (article L. 123-22 of the French Code de Commerce). Personal identifiers are anonymised on erasure but the underlying transaction record is preserved.
  • Moderation records (reports, bans, decisions): actioned decisions (sanctions, statements of reasons, appeals) are kept for the life of the account plus ten years after closure (records-of-processing / DSA accountability); unactioned reports are kept for three years. See the Moderation Policy section 9 and the Community Standards section 11.
  • Stripe tax identifiers (DAC7): kept until the year-end fiscal export to the DGFIP under article 242 bis of the French CGI, then archived.
  • Connection identifiers (IP addresses, session timestamps, user-agent): retained for at most 1 year as required by French law (article L. 34-1 of the Code des postes et des communications électroniques, transposing the obligation to keep technical identifiers available to law enforcement on judicial request). Where SynthCamp stores hashed IPs inline on a database row (for fraud-history scoring on reports and refund requests), the connection identifier is removed from the row at 12 months while the row itself stays for the underlying audit. Where SynthCamp captures connection identifiers in log files (Caddy access logs on the VPS), the file rotation cycle is set under 12 months. The retention applies regardless of account state; erasing your account does not shortcut this window because it is a regulatory obligation, not a SynthCamp design choice.

What stays after account erasure

When you exercise your right to erasure (art. 17), we run a structured pipeline that deletes your social activity (notifications, follows, party engagement, playlists, party messages) and anonymises the data we are legally required to retain.

The anonymised records preserve their database row for legal accountability (purchases, tips, reports, moderation logs) but the row no longer carries your personal identifiers. Specifically: your display name reads «Deleted user», your email is replaced with a black-holed alias on the .invalid TLD, your Stripe Connect link is severed, and reports filed by you have your name and email overwritten.

A note on identifiers: to keep referential integrity across the database, we retain the internal account identifier (UUID) on the anonymised records. This identifier is not personally identifying on its own, but a person with read access to the moderation back-office could in principle correlate two anonymised records that share the same UUID. Read access to the moderation back-office is restricted to the SynthCamp moderation team. The data subject identifier is the same identifier that appears in the legally retained business records (purchases, fiscal exports), so retaining it is not a regression of the privacy posture.

Audio fingerprints uploaded to our duplicate-detection processor (ACRCloud, eu-west-1 / Frankfurt) are deleted from that processor as part of the erasure pipeline. Where a fingerprint cannot be targeted automatically (legacy uploads), it is removed by a manual backfill pass; the residual is logged in the moderation queue.

Sub-processors

We rely on the following sub-processors. Each operates under a data processing agreement and is restricted to the categories of data listed.

  • Supabase (database + auth): Hetzner Online GmbH, Germany, EU.
  • Stripe (payments + payouts): Stripe Payments Europe Ltd, Ireland, EU (with onward processing by Stripe, Inc. in the US under the EU-US Data Privacy Framework).
  • Cloudflare R2 (audio storage + DSAR archive bucket): Cloudflare Inc., US (with Standard Contractual Clauses).
  • Brevo (transactional email): Brevo SAS, France, EU.
  • ACRCloud (audio fingerprint matching, eu-west-1 / Frankfurt): ACRCloud Co. Ltd, with EU regional processing.
  • Railway (application hosting): Railway Corporation, US (with Standard Contractual Clauses).
  • Google (optional Google OAuth sign-in, used only if you choose it): Google LLC, US (EU-US Data Privacy Framework).
  • Umami (aggregate, cookieless web analytics; sets no cookies and stores no individual visitor identifiers): Umami Software, Inc., US (with Standard Contractual Clauses).

Cookies

We use strictly necessary cookies (session token, age verification marker) which do not require consent under article 5(3) of the ePrivacy Directive. We do not use tracking or advertising cookies.

Children

The service is not intended for users under 15, the minimum age for digital consent in France (Loi 78-17, art. 7-1). We do not knowingly collect data from children below that age and will delete any such account on discovery.

Changes

Material changes to this notice are announced by email and via an in-app banner at least 30 days before they take effect. Continued use of the service after that period constitutes acceptance.

Contact

For any privacy-related question, write to [email protected]. Postal address: Heymow Studio, 173 rue de Courcelles, 75017 Paris, France.