SuccessSubliminals

Privacy Policy

This policy describes what Subliminal Studio (studio.successsubliminals.com) actually does with your data. Short version: uploaded music and rendered tracks stay on your device, script text is sent only when an AI writing or voice request needs it, we run no advertising or third-party tracking, and you can delete your account yourself at any time.

Controller

Andreas Breuninger, SuccessSubliminals, Hausäckerstraße 6, 78166 Donaueschingen, Germany — Info@SuccessSubliminals.com (see the Imprint).

What we process, and why

• Account — your email address and, if you sign in with Google, your Google account id, name and profile picture. If you sign in by email instead, we send a short-lived one-time code to your address and store only a hashed copy of it until it expires. Purpose: providing your account, credit balance and projects. Legal basis: Art. 6(1)(b) GDPR (contract).
• Invitations and wait list — while access is invite-only we store the email addresses we invite (and, if you join the wait list, the address you enter) together with the invite's status, solely to send and manage your invitation. Wait-list entries are deleted on request and when your account is erased. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering a contract, at your request).
• Your content — the affirmation topics and scripts you enter, and your project settings. Projects are stored in your browser and synced to your account so your work survives a device change (Art. 6(1)(b) GDPR). Your audio is normally created on your own device and never reaches us. The one exception is when you choose a studio render: then your script lines and mix settings are sent to our server, which produces the file and holds it for up to 48 hours so you can download it, after which the file is deleted automatically. Deleting your account removes those renders and their scripts immediately.
• Billing — credit purchases and the membership are processed by Stripe. We store a record of each purchase (pack, amount, Stripe session id) and your credit ledger; we never see or store card numbers. Legal bases: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (statutory retention of accounting records).
• Usage records — a log of paid actions (generation and synthesis counts, characters, credit cost) for accounting, support and abuse prevention, and a small set of first-party product events (for example “exported a track”) so we can see which features work. No third-party analytics, no advertising identifiers. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in running and improving the service).
• Error reports — if the app hits an error in your browser, a short technical report (error message, stack trace, page path, browser details and app version) is sent to us so we can fix it. Legal basis: Art. 6(1)(f) GDPR.
• Server logs — our web server records each request (time, IP address, requested URL, response status, browser identifier) so we can keep the service secure and diagnose technical problems. These logs are deleted automatically after about 7 days. Legal basis: Art. 6(1)(f) GDPR.

What stays on your device

The audio engine runs on your device. Synthesized voice clips, your listening copies and your rendered tracks live in your browser's local storage (IndexedDB) and are not transmitted to our servers. Music you upload is never sent to us. The exception is a studio render, which you start deliberately: that file is produced on our server and deleted after 48 hours (see above).

Processors and recipients

• Google Ireland Ltd. — Sign-In (authentication).
• Stripe Payments Europe Ltd. — payment processing.
• Cloudflare Inc. — content delivery and DDoS protection (sees request metadata / IP address).
• Hetzner Online GmbH — server hosting.
• AI providers — the script text you submit is sent to the provider needed for your request: Anthropic (affirmation writing) and, depending on the voice you pick, OpenAI, Google, xAI or ElevenLabs (text-to-speech). Only the text itself is transmitted, not your name or email. The Budget voice runs locally on our own server and sends nothing to third parties.

Some of these providers process data in the United States. Where they do, transfers rely on the EU-U.S. Data Privacy Framework and/or EU standard contractual clauses.

Cookies

One essential cookie holds your login session. There are no advertising, tracking or third-party cookies, and no cookie banner is needed for strictly necessary cookies.

Retention

• Account data: until you delete your account.
• Purchase and credit-ledger records: 10 years (§ 147 AO, German fiscal law), in anonymized form after account deletion.
• Login sessions: expire automatically.
• Server logs: about 7 days.
• Studio renders: the script is removed when rendering finishes; the downloadable audio file is kept for up to 48 hours. Job history (track title, format, length, credit cost and timestamps) remains until you delete your account. Account deletion removes all of these immediately.
• Error reports and product events: deleted with your account; error reports are additionally pruned automatically.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to complain to a supervisory authority — for us that is the LfDI Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

You can delete your account yourself at any time: account menu → “Delete account”. This erases your identity, projects, events and reports immediately; purchase records are kept in anonymized form as required by fiscal law. For anything else, email Info@SuccessSubliminals.com.