SuccessSubliminals

Privacy Policy

This policy describes what Subliminal Studio (studio.successsubliminals.com) does with your data. Short version: editable projects sync to your account, and finished audio saved to your Library is stored with its script and mix details. Script text is sent for AI writing, voice suggestions and speech generation. We run no advertising or third-party tracking, and you can delete your account yourself at any time.

While you are signed in, your current script is sent to Anthropic after you pause editing or finish generating it to check which voice suggestions fit its wording. This includes scripts you paste or write yourself. The check uses no credits. Results expire after 7 days and are removed during hourly cleanup. A text fingerprint lets us avoid repeat checks without saving another copy of your script. These results belong to your account and are removed when you delete it. Script text and content categories are excluded from product analytics.

Controller

Andreas Breuninger, SuccessSubliminals, Hausäckerstraße 6, 78166 Donaueschingen, Germany: Info@SuccessSubliminals.com (see the Imprint).

What we process, and why

• Account: your email address and, if you sign in with Google, your Google account id, name and profile picture. If you sign in by email instead, we send a short-lived one-time code to your address and store only a hashed copy of it until it expires. Purpose: providing your account, credit balance and projects. Legal basis: Art. 6(1)(b) GDPR (contract).
• Invitations and wait list: while access is invite-only we store the email addresses we invite (and, if you join the wait list, the address you enter) together with the invite's status, solely to send and manage your invitation. Wait-list entries are deleted on request and when your account is erased. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering a contract, at your request).
• Your content: the affirmation topics and scripts you enter, and your project settings. Projects are stored in your browser and synced to your account so your work survives a device change (Art. 6(1)(b) GDPR). Audio saved or imported into your Library is stored with your account. Finished renders can be saved there automatically. When you choose a studio render, your script lines and mix settings are sent to our server, which produces the file and holds it for up to 48 hours so you can download it, after which the file is deleted automatically. Deleting your account removes those renders and their scripts. A separate copy saved to your Library follows the Library retention described below.
• Library and community. We store saved audio, its script snapshot, mix details, playlists and playback positions to provide your Library. Your own programs start private. Link sharing lets anyone with that link listen. A reviewed public release exposes the audio, complete script, title, description, topic, language and creator profile in Discover. Your chosen display name and handle appear on your public profile. You can also add a bio. The profile does not expose your account email or private Library. We store follow relationships to provide your Following feed and a public follower count. We do not publish a list of your followers or whom you follow. Listening notes, reports and blocks are stored for the community features you use; reports and block lists are not public. These functions use the same account-service legal basis, Art. 6(1)(b) GDPR. Private script text and content categories remain excluded from product analytics.
• Billing: credit purchases and the membership are processed by Stripe. If you choose PayPal at checkout, Stripe routes that payment through PayPal, so PayPal also keeps a record of it under its own privacy policy. We store a record of each purchase (pack, amount, Stripe session id) and your credit ledger; we never see or store card numbers or PayPal credentials. Legal bases: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (statutory retention of accounting records).
• Usage records: a log of paid actions (generation and synthesis counts, characters, credit cost) for accounting and abuse prevention, and to resolve support requests, and a small set of first-party product events (for example, creating a personal program, returning to it, starting a download, confirming a save or share, viewing credit packs and opening checkout) so we can see where people succeed or need help. Project references join these steps without including your script or topic. No third-party analytics, no advertising identifiers. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in running and improving the service).
• Error reports: if the app hits an error in your browser, a short technical report (error message, stack trace, page path, browser details and app version) is sent to us so we can fix it. Legal basis: Art. 6(1)(f) GDPR.
• Visit counting: we count page visits ourselves, without cookies and without any identifier stored on your device. Each visit records the page path, the referring site, a coarse device class, the browser language and a technical key that changes every day, so visits on different days can never be linked to each other or to you. These counts are deleted after at most 180 days. No third-party analytics service is involved. Legal basis: Art. 6(1)(f) GDPR.
• Server logs: our web server records each request (time, IP address, requested URL, response status, browser identifier) so we can keep the service secure and diagnose technical problems. These logs are deleted automatically after about 7 days. Legal basis: Art. 6(1)(f) GDPR.

What stays on your device

The audio engine runs on your device. Synthesized voice clips, your listening copies and rendered tracks can be held in your browser's local storage (IndexedDB). Music imported into the editor stays on that device. When a finished mix is saved to your Library, that mix includes its music and voices and is uploaded with its script snapshot. Importing a finished audio into the Library also uploads that file. Studio renders are produced on our server as described above.

Processors and recipients

• Google Ireland Ltd.: Sign-In (authentication).
• Stripe Payments Europe Ltd.: payment processing.
• PayPal (Europe) S.à r.l. et Cie, S.C.A.: payment processing when you choose PayPal at checkout.
• Cloudflare Inc.: content delivery and DDoS protection (sees request metadata / IP address).
• Hetzner Online GmbH: server hosting.
• BunnyWay d.o.o. provides audio storage and delivery when cloud Library storage is enabled. Audio delivery requests include technical request data such as the listener's IP address.
• AI providers: the script text you submit is sent to the provider needed for your request: Anthropic (affirmation writing and script checks for voice suggestions) and, depending on the voice you pick, OpenAI, Google, xAI or ElevenLabs (text-to-speech). To check that a voice actually read your line instead of replying to it, the generated audio for those voices is also sent to OpenAI for automatic transcription, and the transcript is compared with your line and then discarded. This happens for every newly generated clip from those voices, whichever of them you picked. Only the text and that audio are transmitted, not your name or email. The Budget voice runs locally on our own server and sends nothing to third parties.

Some of these providers process data in the United States. Where they do, transfers rely on the EU-U.S. Data Privacy Framework and/or EU standard contractual clauses.

Cookies

Studio uses a cookie to keep you signed in. Signing in through an email link also uses a temporary cookie. After a verified sign-in, an essential security cookie remembers this browser for up to 180 days to help prevent repeated claims of free welcome credits, including after logout or a change of network. It contains a random value and gives no access to your account. We store only its hash. We use no advertising cookies or third-party tracking cookies. To review repeated welcome-credit claims, we combine existing credit and purchase records with recent network observations and this browser history. We also compare email-address patterns with retained network and browser evidence of confirmed account bans or repeated unpaid welcome-credit use. An email pattern or browser type alone does not trigger this additional check.

Retention

• Account data: until you delete your account.
• Library audio and snapshots: until you remove them or delete your account. Removed versions stay in private Trash for up to 30 days unless you delete them permanently sooner. Removing or making a release private revokes public access; a previously issued playback link can remain usable for up to 2 minutes. Files already downloaded by a listener cannot be recalled. Follow relationships are removed when either account is erased.
• Purchase and credit-ledger records: 10 years (§ 147 AO, German fiscal law), in anonymized form after account deletion.
• Login sessions: expire automatically.
• Welcome-credit protection: browser hashes and their account links expire after 180 days without a verified observation. For confirmed account bans and relevant unpaid welcome-credit use, matching network and browser-signature hashes are kept for up to 180 days from the actual observation. We keep up to 64 such grant-use observations per account. Older network evidence needs additional matching account or mailbox signals before it can hold a new grant. Buying credits or receiving an operator clearance excludes an account from this grant-use history; cleanup runs hourly. Account deletion removes these account links. If an unpaid account has spent welcome credits, has an unresolved or denied welcome grant, or has a confirmed ban, an expiring browser hash remains without an account reference to prevent repeated grants after deletion. These records are used only for abuse prevention. A match can hold a new account's free welcome credits for review; it does not automatically ban the account or remove purchased credits. Contact Info@SuccessSubliminals.com to request a review. Legal basis: Art. 6(1)(f) GDPR (preventing abuse).
• Server logs: about 7 days.
• Studio renders: the script is removed when rendering finishes; the downloadable audio file is kept for up to 48 hours. Job history (track title, format, length, credit cost and timestamps) remains until you delete your account. Account deletion removes all of these immediately.
• Error reports and product events: deleted with your account; error reports are additionally pruned automatically. Critical creation events may be queued in session storage for up to 15 minutes to recover a failed delivery. The queue is tied to your signed-in account.
• Creation-attempt records: kept for up to 90 days and deleted with your account. Aggregate performance measurements and collection counters: 14 days. Daily totals without account identifiers: up to 400 days.
• Visit sources: short source, campaign, channel and link-placement labels, plus the public entry page, may be associated with your account to understand which links bring people to the studio and which bring them back. Signup and return sources are kept separately. These labels can travel through links between our website and studio. For email signup, they are kept with the temporary login code until you use it or it expires. We do not store the referring page's full address or search query. The labels are deleted with your account.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to complain to a supervisory authority: for us that is the LfDI Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

You can delete your account yourself at any time: account menu → “Delete account”. This erases your identity and projects immediately, along with events and reports. Purchase records are kept in anonymized form as required by fiscal law. For anything else, email Info@SuccessSubliminals.com.