Privacy Policy

1. Who is responsible, and how to reach us

DefyAudio is operated by Nicolas Le Falher (DefyLabs), an individual entrepreneur registered in France under SIRET 999 981 475 00018, at 60 rue François 1er, 75008 Paris, France, who is the data controller. For any question about this policy or your data, write to contact@defyaudio.com.

2. What we collect

• Your audio and video files: nothing.They are processed in your browser and never uploaded. Nothing read from inside a file — contents, name, tags or cover art — ever reaches us.
• Your account: your email address, a password (hashed, never seen by us), and your name if you give one. For Google sign-in, see section 4.
• Usage counters: how many operations each account ran each day, to apply plan limits.
• Your subscription: whether a plan is active, and your invoice references. Payment is handled by Stripe; we never see your card or bank details.
• Fault reports: technical error reports, without file names or contents.
• Audience measurement: see section 10.

3. Why, and on what legal basis

• Account, sign-in, plan limits and contacting you about your account — performance of our contract.
• Invoices — compliance with French accounting and tax obligations.
• Fault reports, to fix faults and prevent abuse — our legitimate interest in a working service.
• Audience measurement, to improve the product — our legitimate interest.

We do not profile you or make automated decisions about you.

4. Google Sign-In and Google user data

Signing in with Google is optional. If you choose it, Google shares with us through OAuth:

• your email address, and whether Google has verified it;
• your name and profile picture URL, if your Google profile has them;
• the identifier Google uses for your account.

We request no other scope. We use this data only to create your DefyAudio account, sign you in, and contact you about your account. It is kept for as long as your account exists and deleted with it — delete your account from your account page at any time, or ask us at contact@defyaudio.com. We share it with no one beyond the providers in section 5, never sell it, and never use it for advertising.

DefyAudio’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can review or revoke DefyAudio’s access to your Google account at any time at myaccount.google.com/permissions.

5. Who we share it with

Only the providers we need, each acting on our instructions:

• Supabase: authentication and the account database.
• Stripe: payment, subscription and invoicing.
• Cloudflare: website hosting and delivery.
• Google: sign-in, only if you choose it.
• Fault-reporting and audience-measurement services: technical data only, never account details or file contents.

We never sell your data or share it with advertisers or data brokers.

6. Where it is processed

Account data is stored in the European Union, in Ireland. Stripe and Cloudflare may process data outside the EEA, under the European Commission’s standard contractual clauses, an adequacy decision or an equivalent safeguard.

7. How long we keep it

• Account data and usage counters: until you delete your account.
• Invoices: ten years, as French accounting law requires, even after the account is closed.
• Fault reports and audience measurement: short-lived, never linked to your account, deleted automatically.

8. How we protect it

The site is served over HTTPS only, account data is encrypted at rest, and administrative access is limited to the operator of DefyAudio.

9. Your rights

Under the GDPR you can access, correct, erase, port or restrict your data, and object to processing based on legitimate interest. You can delete your account and all its data yourself from your account page; for anything else, write to contact@defyaudio.com and we answer within one month. You can also complain to the CNIL or to your country’s supervisory authority.

10. Cookies and audience measurement

We only set cookies strictly necessary for the site to work (your login session), so there is no consent banner. Our audience measurement records which pages are visited and which tools are used in which formats. It is cookieless, truncates your IP address, is never linked to your account, and never records anything from your files.

11. Changes to this policy

We will update this page and its date when this policy changes, and email account holders before any material change or any change to how we use Google user data.