Privacy Policy

1. Introduction

Welcome to Jam Room ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Austrian and European Union data protection laws. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application Jam Room (the "App").

2. Data Controller

The data controller responsible for your personal data is:

Daria Lazepko
Jam Room
Seyringer Straße 1/2/269
1210 Wien
Austria
Contact: support@jamroom.eu

3. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Authentication credentials (managed securely through Apple Sign-In, Google Sign-In, or email/password)

User Content

When you use the App, you may create and store:

• Song projects including lyrics, chords, and song metadata
• Voice recordings and audio memos
• Project folders and organizational data

Subscription Data

• Subscription status (Free or Pro)
• Feature usage limits (transcription minutes, AI suggestion count)

Within the App itself, we do not collect analytics, tracking data, device identifiers, or location data. Our marketing website (jamroom.eu) uses optional analytics cookies only if you consent — see Section 14: Cookies & Website Analytics.

4. Legal Basis for Processing (GDPR Art. 6)

We process your personal data based on the following legal grounds:

• Contract performance (Art. 6(1)(b)): To provide the App's core functionality — storing your projects, syncing data, managing your account and subscription.
• Consent (Art. 6(1)(a)): For optional features such as AI-powered line suggestions and rhyme generation, which send your lyrics content to third-party AI providers for processing. You activate these features voluntarily.
• Legitimate interest (Art. 6(1)(f)): To maintain security, prevent abuse, and improve the App.

5. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the App
• Sync your content across your devices (for Pro subscribers)
• Process voice recordings through on-device AI transcription
• Provide AI-powered features such as line suggestions and rhyme finding
• Manage your account and subscription
• Send transactional emails (e.g., email confirmation on sign-up)

6. Voice Recordings & AI Processing

When you use the voice transcription feature, your audio recordings are processed using on-device AI technology (WhisperKit). Voice data is processed locally on your device and is not sent to external servers for transcription. Transcribed text is stored as part of your project data and synced to our servers only if you are a signed-in Pro subscriber.

AI-powered features (line suggestions, AI rhymes) send your lyrics text to third-party AI providers (OpenAI) for processing. This data is used solely to generate suggestions. OpenAI may retain API data for up to 30 days for abuse and safety monitoring, after which it is deleted. Your data is not used to train AI models.

7. Data Storage & Security

Your data is stored securely using industry-standard practices:

• Local storage: Data is stored on your device using Apple's SwiftData framework. If you use the App without an account, your data never leaves your device.
• Cloud storage: Synced data (Pro feature) is stored on Supabase servers located in the European Union (Frankfurt, Germany), encrypted at rest and in transit.
• Authentication: Handled through secure third-party providers (Apple, Google) or encrypted credential storage via Supabase Auth.
• Email service: Transactional emails are sent via Resend, which processes your email address to deliver confirmation emails.

8. Third-Party Services & Data Processors

We use the following third-party services to operate the App. Each acts as a data processor under GDPR:

Service	Purpose	Data Shared	Location
Supabase	Cloud database, authentication, file storage	Email, projects, lyrics, chords, voice recordings	EU (Frankfurt)
Apple Sign-In	Authentication	Email (if shared by user)	Global
Google Sign-In	Authentication	Email	Global
OpenAI	AI line suggestions, AI rhymes	Lyrics text (per request, not stored)	USA
Resend	Transactional emails	Email address	USA
Apple (StoreKit)	Subscription payments	Managed by Apple, not accessible to us	Global

Data Processing Agreements (DPAs) are in place with Supabase and Resend. For transfers outside the EU (OpenAI, Resend), we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission. Apple and Google operate under their own GDPR compliance frameworks, including SCCs and approved transfer mechanisms for international data transfers.

9. Data Sharing

We do not sell, rent, or trade your personal information. We share your data only in the following circumstances:

• With your consent: When you choose to share a project via link with collaborators.
• Service providers: With the third-party processors listed above, solely to operate the App.
• Legal requirements: When required by law, court order, or to protect our legal rights.

10. Your Rights Under GDPR

As a user in the European Union, you have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate personal data.
• Right to erasure (Art. 17): Request deletion of your personal data. You can delete your account directly in the App under Settings → Delete Account. This permanently removes all your data from our servers.
• Right to restriction (Art. 18): Request that we limit how we process your data.
• Right to data portability (Art. 20): Request your data in a structured, machine-readable format. You can export your projects as text from within the App.
• Right to object (Art. 21): Object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7): Withdraw consent at any time for consent-based processing (e.g., stop using AI features).

To exercise any of these rights, contact us at support@jamroom.eu. We will respond within 30 days.

You also have the right to lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde): www.dsb.gv.at

11. Data Retention

We retain your data for as long as your account is active. When you delete your account:

• All personal data, projects, voice recordings, and associated content are permanently deleted from our servers within 30 days.
• Local data on your device is cleared immediately.
• Backups containing your data are purged within 90 days.

12. Automated Decision-Making

The App does not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects you (Art. 22 GDPR). AI-powered features (line suggestions, rhyme finder) provide creative suggestions only and do not make decisions on your behalf.

13. Children's Privacy

The App is not intended for children under the age of 14 (as set by the Austrian Datenschutzgesetz, implementing GDPR Art. 8). We do not knowingly collect personal information from children under 14. If we become aware that we have collected data from a child under 14, we will take steps to delete that information promptly.

14. Cookies & Website Analytics

This section applies to our marketing website (jamroom.eu), not the App. The App itself does not use cookies.

Strictly necessary

Our website uses no strictly necessary cookies. To remember your cookie choice, we store a single value in your browser's local storage (jamroom-cookie-consent); this is not a cookie and is not used for tracking.

Analytics cookies (consent required)

If you click "Accept" on our cookie banner, we load Google Analytics 4 to understand how visitors find and use our website (e.g. page views, traffic sources, country, device type). These cookies are not set unless you accept, and you can change or withdraw your choice at any time via the "Cookie settings" link in the website footer. We enable IP anonymization.

Cookie	Provider	Purpose	Duration
_ga	Google Analytics	Distinguishes unique visitors	2 years
_ga_<ID>	Google Analytics	Maintains session state	2 years

Legal basis: Consent (Art. 6(1)(a) GDPR and § 165(3) Austrian Telecommunications Act 2021 / ePrivacy). Google Analytics may transfer data to the United States; such transfers rely on Google's Standard Contractual Clauses and the EU–US Data Privacy Framework. You can read Google's practices at policies.google.com/privacy.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy within the App and updating the "Last updated" date above. Where changes affect processing based on your consent, we will seek your renewed consent before applying those changes.

16. Contact Us

If you have any questions about this Privacy Policy, your personal data, or wish to exercise your rights, please contact us at:

support@jamroom.eu