Privacy notice

Data controller

VaultFM. For any request about your data, write to tiberio.bozotti@gmail.com.

What data we process

• Account: email, name, stage name, city and website if you provide them, linked sign-in methods (Google), settings.
• Library: the audio files you upload, their tags and the data we derive from them (BPM, key, audio features, AI profile), sets, tags, ratings and roles you assign; with Sync USB, the list of playlists and tracks on the sticks you sync.
• Security: active sessions with IP address and browser, second authentication factor if you enable it.
• Payments: handled by Stripe, which stores your card details; we receive the outcome of payments and your billing details (name, address, Italian tax code or VAT number, SDI code or PEC).
• Vault AI: the messages you write and the replies.

Why, and on what legal basis

• Providing the service you requested (contract): storing and cataloguing your music, letting you sign in, managing your plan.
• Legal obligations: invoicing and accounting.
• Legitimate interest: service security, abuse prevention, handling of reports.

Your files stay private: we don’t share them, publish them or use them to train models for other users. Your personal role model is trained only on your own choices. If you share a set, the DJs you invite see your stage name (or your name) and the set’s tracklist; we use their email address only to send the invite.

Providers (data processors)

• Hetzner Online (Germany): application servers.
• Neon (EU): database.
• Cloudflare (R2 storage with EU jurisdiction, network).
• Stripe: payments and invoices.
• Brevo (France): transactional emails.
• OpenRouter and the model providers: AI interpretation of tracks and Vault AI. They receive audio features, metadata and your messages, never the audio files. They may be located outside the EU: transfers take place under the standard contractual clauses.
• Google: only if you choose to sign in with Google.

How long

• For as long as your account is active.
• Deleted tracks: 30 days in the trash, then erased with all their versions. A file's previous version: 30 days; with Studio up to 5 versions for 90 days and the original upload as long as you keep the track (30 more days if you leave Studio).
• ZIPs and data exports: 24 hours.
• After your account is deleted: data and files are erased immediately from the database, and from storage within a few hours. Invoices remain with Stripe for the period required by tax law.

Your rights

You can access your data and take it elsewhere with “Export my data”, and erase it with “Delete account”, both in Profile & account. You can also request rectification or restriction of processing, or object to processing, by writing to the contact above, and lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).