/dpa · version av-2026-10-12

Data processing addendum

This addendum is part of the Terms of Service between you and AudioLaunch, KvK 54871204, Eindhoven, trading as AudioLab.tools. It applies from the moment what you send to the hosted API or the MCP server contains personal data, and it settles what Article 28 of the GDPR requires. A recording with a voice in it usually is personal data, so in practice this applies to most audio you send us.

1. Roles and duration

You are the controller: you decide which audio you send and why. We are the processor: we analyse it on your instruction and for no other purpose. This addendum runs for as long as you have an account or a key, and ends when your account is deleted.

The browser labs are outside it: they analyse on your own device and send us no audio at all.

2. What we process, and what we do not keep

• The audio itself is not kept. On a direct API call it is decoded, measured and discarded inside the request. A WAV file is decoded in memory; a compressed file (MP3, FLAC, M4A and so on) is first written to the function’s temporary scratch space, which is deleted as soon as decoding is done. On the signed-upload route the file lands in EU storage for a moment, because a browser cannot stream it straight into the function; a sweep that runs every fifteen minutes removes every upload older than 45 minutes, so it is gone within the hour, analysed or not. It used to be deleted the instant the analysis read it; that changed on 22 September 2026 so a second question about the same file does not need a second upload.
• Measurements and metadata are kept for your history, your usage limits and abuse prevention: which tool you used, the duration, a few measurements, and the file name if you chose not to anonymise it. Your account setting decides that, and with anonymising on the name never reaches us.
• Never: we do not use your audio or your results for our own purposes, not to improve the engine, not to train models, not for advertising, and we do not sell or share them.

Who the data is about is up to you: usually the speakers in the recordings you send, and yourself as the account holder. Special categories of data (Article 9) may be in there if you send them; you decide whether that is lawful, and you need a basis for it before you send it.

3. Instructions

We process only on your instruction: the calls you make and these terms. If we think an instruction breaks the GDPR, we tell you and may hold it until you confirm. If a law obliges us to process beyond your instruction, we tell you first unless that law forbids it.

4. Confidentiality and security

• Everyone with access is bound to confidentiality.
• Connections run over TLS; the database is encrypted at rest.
• Tables are closed to clients by default (row level security without exceptions); only the server API reaches them, and it checks on every request that the key or session belongs to the account.
• API keys are stored only as a hash, and you can revoke a key at any time.
• Uploads go to a bucket with a size limit, through one-shot signed links tied to your account.
• Error reports carry no audio and no file contents.

5. Sub-processors

You give general permission for these sub-processors:

• Supabase Inc.: database, authentication and the upload bucket, hosted in the EU (Frankfurt, AWS eu-central-1).
• Vercel Inc.: hosting of the site and the API; the functions that decode and measure audio run in the EU (region fra1).

Both are US companies. The data sits and is processed in the EU; for any access from the United States the safeguards those parties offer apply (the EU-US Data Privacy Framework and the European Commission's standard contractual clauses). We impose the same obligations as in this addendum on every sub-processor and stay fully liable to you for what they do. A new sub-processor is announced at least 30 days in advance; you may object within that period and, if it is not resolved, end the agreement.

6. Helping you with people's rights

Since we do not keep the audio, a request about a recording is answered from your own records. For what we do hold, your account gives you access, export and deletion, and we help you with a request we receive that is clearly about your data.

7. Data breaches

We report a personal data breach to you without undue delay and at the latest within 48 hours of discovering it, with what we know at that moment, and we add to it as we learn more. You decide about reporting to a supervisory authority and to the people involved.

8. Retention, deletion and the end

Audio is deleted as described in section 2. Measurements and history stay until you delete them or delete your account; deleting your account removes your keys, your history and your saved analyses. At the end of this agreement we delete what is left, except what we must keep by law, such as invoices for the tax authority.

9. Information and audit

On request we give you the information you need to show that we meet this addendum, and we cooperate with an audit by an independent expert, after reasonable notice and at your cost. We help where needed with a data protection impact assessment.

10. Liability, law and contact

Liability is governed by section 06 of the Terms of Service; nothing here limits what people can claim under Article 82 GDPR. Dutch law applies. A new version of this addendum has to be accepted before you can keep using the service. Questions: privacy@audiolab.tools.

In het Nederlands

Dit is de verwerkersbijlage (artikel 28 AVG) bij de voorwaarden, voor klanten die audio naar de API of de MCP-server sturen. Kort: jij bent verwerkingsverantwoordelijke, AudioLab.tools is verwerker, het geluid zelf wordt niet bewaard (bij een directe aanroep helemaal niet, bij een upload tot de analyse het bestand leest), metingen en geschiedenis blijven tot jij ze of je account verwijdert, alles staat in de EU met Supabase en Vercel als subverwerkers, en een datalek melden we binnen 48 uur. De Engelse tekst hierboven is de bindende versie.