privacy policy

1. Who we are

This Privacy Policy explains how KobiMusic LLC, a Kentucky limited liability company (“kobimusic,” “we,” “us,” or “our”), collects, uses, shares, and retains personal information when you use the website at kobi.music, the kobimusic workspace, our tools, API, and agent integrations (the “Services”). kobimusic is the controller of the personal information described in this policy, except where we say that another company acts as an independent controller. Capitalized terms not defined here have the meaning given in our Terms of Service.

2. Information we collect

Account information. When you create an account, we collect a username, your email address, and your password, which we store only as a salted argon2id hash. If you sign in with Google, we receive your Google account identifier and email address from Google instead of a password. We also record whether your email address has been confirmed and when the account was created.

Your Content. We store the files you upload, the Output the Services produce, and the flows and settings you save in your workspace. Files are encrypted before they are written to storage. Our servers decrypt them when needed to show them to you or to run the tools you request.

Usage information. We count the credits each account (or, where the Services are open without an account, each IP address) uses in a day or week, to apply plan limits. The history of the tasks you run, and the usage page drawn from it, are kept in your browser on your device, not on our servers, and are cleared after 30 days or 200 runs. Our server logs record each request to a tool (the tool, the size of what was sent, the credits used, and the outcome) with a pseudonymous caller identifier, but not IP addresses or the contents of your files. We also keep daily totals of tool requests by tool, model, plan level and outcome. These totals are aggregated and are not linked to any account, IP address or device.

Analytics. We use Cloudflare Web Analytics to count visits to the pages of the Services and to see which pages are visited, the websites that referred visitors, and the countries, browsers and devices visits come from, in aggregate. Cloudflare Web Analytics does not use cookies or local storage, does not identify individual visitors, and does not track visitors across websites. We also receive, from search engines such as Google, aggregated reports of the search terms that led people to the Services.

Security records. To limit attempts to sign in, sign up, or reset a password, we keep the IP address each attempt came from for at least a day. We keep a record of account events (sign-ups, sign-ins, password changes, and account deletion) for 180 days, including after an account is deleted.

Payment information. Payments are processed by Polar, our merchant of record. We receive from Polar a customer identifier and the status and billing period of your subscription. We do not receive or store your payment card number.

Cookies and browser storage. We use a strictly necessary cookie to keep you signed in, which lasts up to 90 days, and two short-lived cookies during sign-in with Google. If you use the workspace without an account, your files and preferences are kept in your browser's own storage on your device and are sent to us only when you run a tool on them. Cloudflare may set cookies that are strictly necessary to protect the Services from abuse. We do not use analytics or advertising cookies, and we do not use advertising or cross-site tracking technologies on the Services. The analytics described above set no cookies.

Communications. If you email us, we keep the correspondence and the contact details you provide.

3. How we use information

We use personal information to:

• provide, operate, and maintain the Services, including storing your files and running the tools you request on them;
• create and secure your account, authenticate you, and confirm your email address;
• process subscriptions, apply plan limits and credits, and show you your usage;
• send transactional messages, such as email confirmations, password resets, and notices about your account or these policies;
• detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms;
• develop, train, evaluate, and improve our machine learning models and the Services, which may include using the Content and Output in your account;
• respond to your requests and provide support; and
• comply with legal obligations and enforce our rights.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

4. Legal bases for processing

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process personal information on the following legal bases: to perform our contract with you (to provide the Services and process payments); our legitimate interests (to secure the Services, prevent abuse, and improve the Services and our machine learning models, where those interests are not overridden by your rights); compliance with legal obligations; and your consent, where we ask for it, which you may withdraw at any time.

5. How we share information

We share personal information only as follows:

• Service providers that process information on our behalf and under our instructions: Cloudflare (network delivery, security, bot protection at sign-up, email routing, storage of encrypted copies of files, and the cookieless page analytics described above); Resend (delivery of transactional email); Google (sign-in, if you choose it, and the hosting of our email inbox); and RunPod (graphics processing servers on which some tool runs are performed, which receive the files needed for that run).
• Polar, which processes payments as merchant of record and acts as an independent controller of the information it collects for that purpose, under its own privacy policy.
• Legal and safety reasons, when we believe in good faith that disclosure is required by law or legal process, or is necessary to protect the rights, property, or safety of kobimusic, our users, or others.
• Business transfers, in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to this policy.
• With your consent or at your direction, such as when you connect an agent or another application to your account.

6. Data retention

• Files in your account are kept until you delete them or delete your account. Deleted files are removed from our storage within 3 days.
• Files submitted for processing without an account are deleted within 15 minutes.
• An account that never confirms its email address and holds no files is deleted after 7 days.
• Backup copies of account records are kept for 14 days. Backup copies of stored files are kept, in encrypted form, on a separate computer we control, and a file you delete may remain in those encrypted backups after it is removed from the Services. They cannot be read without keys that are kept apart from them.
• Content and Output copied into a dataset used to train or evaluate our models before you delete them may be kept in that dataset, and models trained with them are not altered when you delete them.
• Usage counters kept by account or IP address are deleted once the daily or weekly period they count has ended. Your task history stays in your browser and is cleared after 30 days or 200 runs.
• IP addresses kept to limit sign-in, sign-up and password-reset attempts are deleted after about a day, longer while an address is blocked. Records of account events are kept for 180 days.
• Server logs are rotated by size, and are kept for as long as that rotation allows. Aggregated daily totals of tool requests, which identify no one, may be kept indefinitely.
• Sign-in sessions expire after at most 90 days.
• We keep other information for as long as your account is active, and afterward only as long as needed to comply with legal obligations, resolve disputes, and enforce our agreements.

7. Security

We protect personal information with technical and organizational measures appropriate to the risk, including encryption in transit, encryption of stored files, password hashing, and session cookies that are not accessible to scripts on the page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your rights and choices

You can view, download, and delete your files, and manage your account, in the workspace. You can delete your account at any time from the settings page, which deletes your files and ends any paid plan.

Depending on where you live, you may have the right to request access to, correction of, deletion of, or a portable copy of your personal information; to object to or restrict certain processing; and to withdraw consent. If you are in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local data protection authority.

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to request deletion and correction of it; and not to be discriminated against for exercising these rights. The categories we collect are identifiers (such as username, email address, and IP address), commercial information (subscription status), internet or network activity (usage of the Services), and the content of the files you upload. We collect them from you, from your use of the Services, and from Google and Polar as described above, for the purposes in Section 3, and we disclose them only to the recipients in Section 5. We do not sell or share personal information as those terms are defined under California law.

To exercise any of these rights, email [email protected]. We may need to verify your identity before responding, and we will respond within the time required by applicable law. You may use an authorized agent to make a request on your behalf where the law allows.

9. International transfers

We are based in the United States, and our servers and those of our service providers are located in the United States and other countries. If you use the Services from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. Where required, we rely on appropriate safeguards, such as standard contractual clauses, for these transfers.

10. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us with personal information, please contact us at [email protected], and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on the Services and, where you have an account, by email before the changes take effect. The date at the top of this policy shows when it was last updated.

12. Contact

Questions about this Privacy Policy or our handling of personal information may be sent to KobiMusic LLC at [email protected].