Privacy Policy

Laintone (“Laintone”, “we”, “us”) runs the website and app at laintone.com: a private beat library for music producers, Outreach (sending beats to artists by email from the producer’s own Gmail account), public producer stores, a beat marketplace and auctions.

We are the controller of the personal data described here. You can reach us about anything in this policy at [email protected].

We only collect what the service needs to work:

• Account data: your email address, a password (stored only as a salted hash by our authentication server) or your Google sign-in, your display name, handle, profile picture and settings. If you turn on two-factor authentication we store what it needs to check your codes.
• Google account data: when you sign in with Google or connect Gmail, your name, email address, profile picture and Google account ID, the email address of the connected Gmail account, the permissions you granted and an encrypted Gmail access token. See section 3.
• Content you upload: audio files, stems, voice tags, cover images, beat titles, BPM, key, tags, notes, sample disclosures, prices and license terms. We create processed versions (MP3s, tagged previews, waveforms and loudness readings) from your audio.
• Contacts: the names, email addresses, roles and companies of artists and other people you add to your contacts or groups. You are responsible for having a legitimate reason to store and contact them.
• Outreach: the emails you write and send, their recipients, the beats attached, delivery status and each recipient’s private link. When a recipient opens their link we record what happened (page view, play started, 30 seconds played, play completed, download) and when. We do not record their IP address, device or location, and Outreach emails contain no tracking pixels.
• Marketplace and stores: your public store profile, listings, auctions, bids, offers, orders, purchases, license requests, comments, likes, saves and messages between buyers and producers. To count unique store visits we store a random ID that the visitor’s browser generates; it is not linked to a name, IP address or device.
• Payments: handled by Stripe. We store your Stripe customer, subscription and payout account IDs, your plan, payment and payout status and order amounts and fees. We never see or store card numbers or bank details.
• Usage and safety records: plays of marketplace beats, notifications, counters that enforce plan and rate limits, content reports, moderation results and the emails we have sent you (to avoid repeats).
• Support: what you send us when you email [email protected].

We do not use advertising or third-party analytics trackers, and we do not buy data about you from anyone.

Laintone asks Google for these permissions:

• openid, email and profile (userinfo.email, userinfo.profile): to sign you in with Google and show your name, email and picture in your account.
• Send email on your behalf (https://www.googleapis.com/auth/gmail.send): so Outreach can send the emails you compose in Laintone, from your own Gmail address, to the recipients you choose.

How we use it. Laintone uses the Gmail permission only to send a message when you send an Outreach email or a scheduled send you set up runs. Each message goes only to the recipients you selected and contains the text you wrote plus the links to the beats you attached. The permission we request can only send mail: Laintone cannot read, search, list, modify or delete the emails, contacts, drafts or labels in your Gmail account, and it never does.

What we store. The connected Gmail address, the permissions granted, and the refresh token Google gives us, encrypted with AES-256-GCM. The token is kept on our servers only and is used only by the part of Laintone that sends your Outreach emails. We keep a copy of the Outreach messages you send in Laintone (subject, text, recipients, status) so you can see your send history.

Sharing. We do not sell Google user data, share it with third parties, use it for advertising, or use it to develop, improve or train generalized or non-personalized AI or machine learning models. No person at Laintone reads it, except with your explicit permission for a specific support request, when needed for security (for example investigating abuse), or to comply with the law.

Removing access. You can revoke Laintone’s access at any time in your Google Account under Security › Your connections to third-party apps & services. Outreach then stops sending until you connect Gmail again. Deleting your Laintone account revokes the access and deletes the stored token.

Limited Use. Laintone’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• To provide the service: store and play your beats, process audio, send your Outreach emails, run private links, stores, the marketplace and auctions, and show you who listened.
• To process payments, subscriptions and payouts, and to handle refunds and disputes.
• To send you service emails: notifications you can turn off in Settings, account and security emails, and a few product emails about using Laintone (each with an unsubscribe link).
• To keep Laintone safe: enforce limits, prevent spam and fraud, review reported content and check uploaded pictures for prohibited images.
• To answer your support requests and to meet legal obligations (for example tax and accounting records).

Our legal bases (where the GDPR applies) are performing our contract with you, our legitimate interest in keeping the service secure and working, your consent (for example connecting Gmail, which you can withdraw at any time) and legal obligations.

We run Laintone on servers we operate. We share data only with these service providers, and only what each needs:

• Google: sign-in, and the Gmail API to send your Outreach emails.
• Stripe: subscriptions, marketplace payments and producer payouts (Stripe Connect). Stripe processes payment data under its own privacy policy.
• Resend: delivers Laintone’s own notification and account emails (not Outreach emails, which go through your Gmail).
• OpenAI: new cover images and profile pictures are sent to OpenAI’s moderation API to detect prohibited images. Audio, messages and Google data are not sent. Under OpenAI’s API terms this data is not used to train their models.
• Google Fonts: pages load fonts from Google’s servers, which receive your IP address as part of the request.

Some things are visible to others because you choose to publish or send them: your store, public listings, auctions, comments and your profile are public; Outreach recipients see your Gmail address, name and the beats you sent; buyers and sellers see what they need to complete an order.

We may disclose data if the law requires it, to protect people or the service, or as part of a merger or sale of Laintone (you would be told first). We never sell personal data.

Laintone does not use advertising or analytics cookies. Your browser stores a few things the app needs: your login session, your cart, which tips you dismissed, a referral code if you arrived through a referral link, the random store-visit ID described above, and one cookie that remembers whether the sidebar is open.

• We keep your data while your account exists. You can delete beats, contacts, sends and other content at any time.
• When you delete your account (Settings › Delete account) we delete your profile, beats and files, contacts, Outreach history, store, listings and messages, and revoke and delete your Gmail token.
• Records of completed purchases are kept for the other party and for tax and accounting obligations. Stripe keeps its own payment records.
• Database backups are made daily and kept for 14 days, so deleted data disappears from backups within 14 days.

Connections use HTTPS. Access to your data is restricted by database permissions so other users can only see what you publish or send. Private files are served through short-lived signed links, Gmail tokens are encrypted, and you can turn on two-factor authentication. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

• Access and export: Settings › Export downloads your beats’ details, contacts and Outreach history as a file.
• Correction: edit your profile, beats and contacts in the app.
• Deletion: Settings › Delete account, or email us.
• Gmail access: revoke it in your Google Account at any time (see section 3).
• Emails: turn notifications off in Settings or use the unsubscribe link in any Laintone email.

Depending on where you live you may also have the right to object to or restrict processing, to data portability and to complain to your data protection authority. To use any right, email [email protected]; we answer within 30 days.

Laintone is not meant for children. You must be at least 16 years old to create an account. If you think a child has given us personal data, email us and we will delete it.

Some of our service providers (Google, Stripe, Resend, OpenAI) process data in the United States and other countries. Where required, these transfers rely on safeguards such as the European Commission’s Standard Contractual Clauses.

We will update this page when what we collect or how we use it changes, and change the date at the top. For significant changes we will also notify you by email or in the app before they take effect. See also our Terms of Service.