Privacy policy
The short version. We collect what we need to run your account, train and deliver your signatures, take payments, pay creators and keep the service safe. We don't sell your data, we don't use advertising or tracking cookies, and your audio is used for your signatures, not to train anyone else's. Our servers are in the EU (Stockholm). You can access, correct, download or delete your data.
1. Who is responsible for your data
DigMusiK Ltd (company number 16671712), Shrewsbury, SY4 3LD, United Kingdom, is the controller of personal data processed through digmusik.com, app.digmusik.com and the DigMusiK plugin. Contact us about privacy at support@digmusik.com.
2. What we collect
| Data | Where it comes from |
|---|---|
| Account: name, display name, email, password (stored only as a secure hash), country, date of birth (to give under 18s a teen account), plan | You, at sign-up and in your account |
| Captures: audio renders, chain descriptions and credits, control settings, attestations (with date, time and IP address), training results | You and the capture assistant |
| Audio you upload for previews or AI matching, including clips Match records in the plugin when you press Record (the track it's on, and its sidechain if you use that as the reference) | You |
| Re-dial checks: a short dry and print pass you record in your session to get a unit back to a recall's settings | You |
| Capture setup: the name of the audio interface and driver, the outputs and inputs used, the sample rate and the DAW (or standalone DigMusiK) a capture was recorded with | The capture assistant |
| Print Recall: the dry track and print you upload, short listening clips made from them, a one-way fingerprint of each file, your answer about your setup, any settings you enter, the result, and, if you agree, the settings you really used | You and our servers |
| Approvals and Handover: mixes and stems you upload, the controls you offer, the versions rendered, notes (with the name the writer gives and where in the mix), sign-offs (the name given, the version, the date and time, and the IP address), and handover packs. Your clients, collaborators and mastering engineers give us their name when they leave a note or sign off | You, and the people you share with |
| Credits and splits: for each person an engineer lists on a song, their name, roles, shares, email address (to ask them to confirm), and any writer numbers (IPI, ISNI), collecting society and publisher entered; and, when they confirm, the name they type, the date and time and their IP address, or the change they ask for | The engineer, and the person themselves |
| Paid delivery: quotes, the client's name and IP address when they accept, and payment records from Stripe (amount, date, the payer's email; never card numbers) | You, your clients and Stripe |
| Session Vault and Rack Recall: the audio, chains, settings and notes you choose to keep | You |
| Studio manager: rooms, prices, gear and maintenance logs, and for each booking the client's name, email, times, message, and deposit payments | The studio, its clients and Stripe |
| Find engineers and studios: listings (name, location, services, links), enquiries passed on by email, and reviews (the reviewer's name, rating and words) | You, people who enquire, and reviewers |
| Pages (for you, your band, venue or studio): what you put on them (about, photos, videos, news, work, songs and writers' shares, members and team, services, dates, links); the town or postcode you give and an approximate map position worked out from it; your social links, follower numbers you state, and the follower numbers and latest public posts we read from Bluesky, Mastodon, YouTube and Spotify for the links you add. Band members you add: their name, role and, if you give it, email address | You, and those platforms' public information |
| Enquiries, date and hire requests sent from a page: the sender's name, email, date and message | The person sending it |
| Bookings: the two sides, the booking type, every version of the terms, signatures (the typed name, date, time and IP address), the night's figures for a settlement, payments (from Stripe, never card numbers) and payments recorded as received | The two members and Stripe |
| Tickets: the buyer's name and email, the tickets bought, what was paid (from Stripe, never card numbers), and when each ticket was scanned at the door. The organiser sees the buyer's name and email, to run the door and contact them about the event | The buyer, the organiser's door scans, and Stripe |
| Messages: conversations, messages and photos you send, requests, blocks, mutes and what you've read | You and the people you message |
| Session Check: measurements of each stem made in your browser as it uploads (format, length, peak and loudness, silence, clipping); the audio itself is uploaded as before | Your browser |
| Automatic Recall: the history of prints is kept in your DAW session on your computer; only prints sent as a Print Recall reach us (as above), with the song stamp (title, songwriter, tempo, time signature, key, and where the print sits in the song) | The plugin and you |
| Plugin devices: device name you choose, plugin version, operating system, licence checks (date, time, IP address), an anonymous device identifier | The plugin |
| Payments: plan, invoices, purchase history, partial card details (brand, last four digits, expiry) and billing country | Stripe and you |
| DigMusiK Originals: the licences your devices hold, a mark in your copy of each Original's protected data that identifies your account, and (for members who bought them before 10 November 2026) Originals Pack purchases and ownership | Our servers and the plugin |
| Creators: payout and identity verification status, tax details we must report, ownership evidence (photos of a unit's serial number with a verification code), sales and payouts | You and Stripe |
| Profile (Pro): bio, photos, links, your units' stories | You |
| Partner programme: the partner code you joined with; for people we invite, the name and email address we invite; for partners, your code, channel, commission and payouts. Visits to partner links are counted with a daily-changing one-way code made from the visitor's address, which can't be turned back into the address | You and the link you used |
| NAM captures you choose to upload: the file, its fingerprint, the description inside it (such as its name and author) and whether you share it with your session collaborators. Captures you only load in the plugin stay on your computer and aren't sent to us | You |
| Communications: emails and messages with us, reports you make or that concern you | You and other users |
| Technical: IP address, browser, security logs, error reports | Your browser and our servers |
| Feedback and problem reports: what you write, a screenshot if you add one, the replies on it, and what was recorded with it: the page you were on, your browser, screen size, language and time zone; from the plugin, its version, format, the DAW, your computer's system, the audio settings and the plugin's recent log of its own messages. When a page fails, a record of the error: the page, the time, your account and technical details | You, your browser, the plugin and our servers |
| Testing: that your account is a test account, the invite you joined with, and the testing checklist steps you tick | You |
| Free plugin downloads (such as Kerb): a count of downloads only; your IP address is used for an hour to stop abuse | Your browser |
We don't ask for identity documents. Where identity checks are needed for payouts, Stripe carries them out and tells us only the outcome.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Provide your account, captures, training, signatures, plugin sign-in and licence checks | Contract |
| Provide Print Recall: work out a unit's settings from your files, make the sheet, twin and listening clips | Contract |
| Keep the credits and splits of songs, ask the people listed to confirm them, and keep a record of their confirmations | Legitimate interests (the engineer's and the people credited, in an accurate, agreed record of who did what, so they're credited and paid) |
| Show an engineer the notes and sign-offs their clients, collaborators and mastering engineers leave on their work | Legitimate interests (the engineer's, and yours, in a clear record of what was asked for and approved) |
| Use the settings you really used, with a recall's result, to test and improve Print Recall | Consent (you can withdraw it at any time) |
| Take payments, sell creators' plugins, pay creators, keep accounting records | Contract; legal obligation |
| Report sellers' details and earnings to HM Revenue & Customs under the digital platform reporting rules | Legal obligation |
| Verify ownership of hardware offered for sale | Contract; legitimate interests (preventing fraud and protecting rights holders) |
| Protect signatures and plugins (encryption, device limits, invisible owner marks), detect misuse and abuse, keep the service secure | Legitimate interests |
| Handle reports, takedowns and disputes | Legitimate interests; legal obligation |
| Show your page, pass on enquiries, run bookings and agreements, and deliver messages | Contract |
| Check follower numbers and show latest public posts for the social links you add; work out an approximate position from your town or postcode for distance search | Legitimate interests (yours, in showing an accurate reach and being found nearby; you choose which links to add) |
| Keep under 18s safe: teen accounts, keeping teens and adults apart, automatic checks of pictures, and acting on reports of messages and pages | Legal obligation (Online Safety Act 2023); legitimate interests |
| Service emails (receipts, training finished, renewal reminders, security) | Contract; legal obligation |
| Running the partner programme: crediting partners, calculating and paying commission, preventing self-referral and fraud | Contract (with partners); legitimate interests (for referred members) |
| Store and render NAM captures you upload, for your chains, mix deliveries and sessions | Contract |
| Read and answer feedback and problem reports, and fix problems, with the help of automated tools including AI that rate each report and draft replies and changes, reviewed by a person | Legitimate interests (a working, improving service); contract |
| Product news and offers | Consent (you can opt out at any time) |
| Improve the engine and service using aggregated statistics | Legitimate interests |
| Train shared models on your renders | Only with your opt-in consent |
4. Who we share it with
We use these service providers, who process data only on our instructions under contracts that protect it:
- Amazon Web Services (servers, storage and GPU training, in the EU: Stockholm, Sweden);
- Stripe (payments, payouts, identity verification and tax calculation);
- postcodes.io (we send the town or postcode on a page to find its approximate position; nothing else);
- Bluesky, Mastodon servers, YouTube (Google) and Spotify (for the social links you add to a page, we ask their public services for the follower count and latest public posts of that account; we send only the link's account name);
- Anthropic's Claude AI models, run for us by Amazon Web Services (Amazon Bedrock) in the EU: we send the content of feedback and problem reports (what you wrote, what was recorded with it and the replies so far) to help us read and answer them. Screenshots, your email address and payment details aren't sent. Amazon Bedrock doesn't use it to train models;
- GitHub (Microsoft), where our code is kept: when a report needs a change, the report's text, what was recorded with it and our assessment are copied, without your name or email address, to the private system where the change is drafted and tested;
- Hostinger (our website and email);
- our email delivery provider, for service emails.
Partners see only totals (how many people joined with their code, started a trial or pay, and the commission earned). We never tell a partner who you are.
Other people see what you choose to make visible: published signatures show your display name and the chain credits; Pro profiles show what you put on them; buyers of your plugin see your creator name. We share data with authorities when the law requires it, and with professional advisers, insurers or a buyer of our business under confidentiality. We never sell personal data.
5. International transfers
Our servers are in the EU, which the UK recognises as providing adequate protection. Stripe and GitHub may process data in the United States; transfers are protected by the UK International Data Transfer Addendum or the UK-US data bridge, as applicable.
6. How long we keep it
| Data | Kept for |
|---|---|
| Account data | While your account is open, then 30 days (backups 60 days) |
| Capture renders | 30 days after training, unless you choose to keep them for retraining; deleted with the capture |
| Signatures | Until you delete them (copies sold within a creator's plugin remain licensed to buyers) |
| Preview and matching audio | Up to 24 hours |
| Print Recall files (dry track and print), and re-dial check passes | Until the job finishes, and no more than 24 hours |
| Print Recall listening clips | Up to 24 hours |
| Print Recall results (settings, sheet, fit, file fingerprints) and capture setup | Until you delete the recall or capture, or your account |
| Settings you shared with consent | Until you withdraw consent, or 2 years |
| NAM captures you upload | Until you delete them, or your account |
| Approvals: mixes, stems, versions, notes, and handover packs | Until the delivery expires (60 days) or you delete it (backups 60 days) |
| Credits, splits and confirmations | With their delivery: until the engineer deletes it, or their account. A person who was listed can ask us to remove their email address at any time |
| Quotes, acceptances and payment records | 6 years after the end of the financial year (UK tax law), kept with the delivery's record |
| Session Vault | Until you delete it, or your account |
| Bookings and deposits | 6 years after the end of the financial year for payments; otherwise until the studio deletes them or its account |
| Directory listings and reviews | While listed; reviews until removed or the listing is deleted |
| Pages, news, work, social links and follower numbers | Until you delete them, or your account |
| Enquiries and requests sent from a page | 2 years, or until the page is deleted |
| Tickets and door scans | 6 years after the end of the financial year (UK tax law) |
| Bookings, agreements and signatures | 6 years after the booking (the time for claims under a contract), and 6 years after the end of the financial year for payments |
| Messages | Until the conversation is deleted by everyone in it, or their accounts close; reported messages with the report, for up to 3 years |
| Sign-off records | With their delivery: until the engineer deletes it, or their account |
| Shared session stems | Until you close the session (backups 60 days) |
| Ownership evidence | While the unit is listed for sale, then 2 years (to handle disputes) |
| Attestations, reports and takedown records | 6 years |
| Payments, invoices, payouts and tax records | 6 years after the end of the financial year (UK tax law) |
| Security and licence-check logs | 12 months |
| Feedback, problem reports, screenshots and their replies | 2 years after the last message on the report |
| Error records | 12 months |
7. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you or another provider in a portable format. You can withdraw consent at any time. Most of this is available directly in your account (including downloading your captures and closing your account); otherwise email us. We'll respond within one month. You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), though we'd appreciate the chance to help first.
8. Automated decisions
Automated tools, including AI, help us read feedback and problem reports and draft our replies and fixes. A person reviews them, and you can ask for a person to look at your report at any time. They don't decide anything about your account.
Pictures on pages, in news and in messages are checked automatically when uploaded: some are refused, and some wait for a moderator before anyone else sees them. You can ask for a person to look again. Our capture checks automatically accept or reject renders (for example, if a render is silent or time-stretched) and tell you why; you can re-upload or contact us for a human review. Quality ratings and AI matching suggestions don't have legal or similarly significant effects on you.
9. Children
DigMusiK isn't intended for anyone under 16. If we learn an account belongs to someone under 16 we'll close it and delete its data. Members aged 16 and 17 have a teen account: they can't publish a public page, be listed, book or be booked, or message adults, and adults can't find or contact them through DigMusiK. Their date of birth is used only for this, and the account becomes an ordinary one on their 18th birthday.
10. Security
We encrypt data in transit and at rest, store passwords only as salted hashes and plugin sign-in tokens only as hashes, restrict staff access to what each role needs, and test our backups. If a breach puts your rights at risk we'll tell you and the ICO as the law requires.
11. Cookies
See our cookie policy. In short: essential cookies only, no tracking.
12. Changes
We'll post updates here and tell you by email about significant changes before they take effect.