Sonobolt Privacy Policy
Draft. Pending final legal review before launch.
Version 2026-11-09. Effective from the day it is published in the App.
1. Who we are
Sonobolt is a service of Quotesdone Technologies (كوتس دن للتكنولوجيا), a sole establishment licensed in Dubai, United Arab Emirates, under E Trader (Professional) licence no. 1633275 (Dubai DET) ("the Operator", "we" or "us"), which decides how your personal data is used. Our address is Botanica, Jumeirah Village Circle (JVC), Dubai, United Arab Emirates. For privacy questions and requests, write to our Privacy Officer at support@sonobolt.com.
We are based in the United Arab Emirates and offer the Service only to people who live there. The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies to what we do.
2. What we collect, why, and our legal basis
The last column gives the basis in Article 4 of the UAE law: performing your contract (Article 4(9)), bringing or defending legal claims (Article 4(3)), meeting another UAE law (Article 4(10)), or your consent (Article 6).
| What | Where it comes from | Why we use it | Legal basis |
|---|---|---|---|
| Account details: name, mobile number, email address and an account number we assign | You | To run your account, send your download links and service messages, contact you about an order, and keep one account per person so that suspensions and our repeat-infringer policy work | Contract |
| Date of birth | You | To check that you are 18 or over, and to show later that we checked. If you are under 18 we refuse the sign-up and do not keep it | Contract; legal claims |
| One-time code sent to your email | Our software | To confirm that the email address is yours. We store only a hash of the code | Contract |
| Sign-up record: the versions of our Terms and this policy, a SHA-256 hash of the exact text shown to you, the words of the box you ticked, your name and email address, the date of birth you gave, the time, your IP address and approximate location, and whether you used the website or the App | You, our software | To show that you accepted our Terms, and to bring or defend legal claims | Contract; legal claims |
| IP address and approximate location when you sign up and when you order. The location is a country and a city or emirate that our network provider works out from the IP address. It is approximate and often wrong, for example behind a VPN or on a mobile network. We never use your device's GPS or ask for location permission | Your connection, our network provider | To prevent fraud (fake or bulk sign-ups, stolen cards, people evading a suspension), to check that orders come from our service area, and as evidence of who accepted what | Contract (keeping the Service secure and within its area is part of providing it); legal claims |
| Order details: name, email, preset, any request you type, the length we estimated, the amount we hold on your card and the final price | You, our software | To make the mix, email you its download link and bill for it | Contract |
| Audio files you upload, with their file names and tags. These may contain voices and any personal data in the recording | You | To make the mix | Contract |
| Working files made from your audio: stems, transcribed words (the lyrics our software detects on our server), analysis and quality reports | Our software | To make and check the mix | Contract |
| Evidence record for each job: time, your account, IP address and approximate location, the Service you chose, the exact wording of each statement you ticked or were shown, the Terms version, and a SHA-256 hash of each upload | You, our software | To show who confirmed what, answer complaints about a job, enforce our repeat-infringer policy, and bring or defend legal claims | Contract (Terms 6.4 and 12); legal claims |
| Order record: name, email, IP address, song titles, file names, any request you typed, tracklist with times, tempo, key and energy values, quality-check result, mix reports, any error message, whether you withdrew | You, our software | To support your order, answer questions and complaints, and bring or defend claims | Contract, then legal claims |
| Invoice: name, email, order number, length, amounts, status | You, our software | To bill you and keep the records UAE law requires | Contract; UAE law |
| Payment status from Stripe once online payment is switched on (hold placed, charged, released or refunded), or from Apple or Google if you pay in the App. We do not receive your full card number | Stripe, Apple, Google | To record what was held, charged, released or refunded | Contract; UAE law |
| Your IP address and request details in server logs | Your browser | To run and secure the App | Contract: keeping the App working and secure is part of providing it |
| Job reference stored in your browser (section 11) | Our page | To bring you back to your job | Contract. Cookie rules require no consent because it is strictly necessary for what you asked for |
| Deletion log: job number, kind of file, SHA-256 hash, size and time of each file we delete. No audio and no file names | Our software | To prove that we deleted your audio when we said we would | Contract; legal claims |
| Your confirmation that you live in the UAE, and, if we check it, your country from your IP address or billing address and your billing name against public sanctions lists | You, Stripe, public lists | To serve only our service area and avoid people and places that sanctions laws or our payment provider bar | Contract; UAE law where it applies |
| Messages, complaints, takedown notices and counter-notices, including names, addresses and phone numbers | You, or the person complaining | To answer them and handle complaints properly | Contract; legal claims |
| SHA-256 hash of a file named in a valid copyright notice, on a block list | Our software | To refuse that identical file in later jobs | Legal claims |
| Usage data, only if you accept analytics: the pages of our website you view (address without anything after the path), the website you came from (its domain only), browser, operating system, device type, screen and window size, language, time zone, random visitor and session identifiers, and approximate location from your IP address. No clicks, typed text, errors or recordings of your session | PostHog, on our pages | To see how the website and App are used, find faults and improve them | Your consent, which you can withdraw at any time (section 11) |
If you opt in to anything optional, such as a feature the order page asks you to agree to, the basis is your consent, and you can withdraw it at any time for future jobs.
If you do not give us the details an order requires, we cannot make the mix.
We claim no ownership of the music you upload, and we keep no backup of it. We do not sell your personal data, share it for advertising, or show advertising. We do not use your audio, stems or mixes to train machine-learning models or to build a catalogue.
A keyed hash of an IP address cannot be reversed without our secret key, but we treat it as personal data. The SHA-256 hash of a file can only match an identical copy of that file. It does not tell us what song a file is, and we do not use it to recognise music.
Voices in your songs. We separate and transcribe vocals to find where songs can be cut and joined. We do not use voices to identify anyone, and we create no voiceprints. Please do not upload recordings that reveal sensitive information about people, such as health or religion, unless you have the right to.
Other people's data. If your upload contains other people's personal data, you are responsible for having the right to give it to us.
Automated decisions. Our software rates each mix and may hold it for review by a person. A held mix is about the audio's quality, and it has no legal or similarly significant effect on you. We make no solely automated decisions with such effects.
3. Who receives your data, and where
| Recipient | What they receive | Their role | Country |
|---|---|---|---|
| Microsoft Azure, data centre UAE North (Dubai), our hosting provider | Everything stored on or passing through our servers: the App, our records and your audio while we hold it | Processor, acting on our instructions | United Arab Emirates |
| The temporary machine that makes your mix: a graphics-processor (GPU) machine that we start for your order and delete when it ends, rented from Microsoft Azure in UAE North or, if Azure cannot supply one, from Amazon Web Services in its Middle East (UAE) region | Your audio files and the working files made from them, for the hours the mix takes. The machine and its disk are deleted when the job ends | Processor, acting on our instructions | United Arab Emirates |
| Cloudflare, which serves our website sonobolt.com | Your IP address and request details when you visit the website | Processor | United States and its global network |
| Stripe, when checkout is active | Payment details you give at checkout, order amount (the hold and the final charge). We use Stripe under the account of Quotesdone Technologies | Processor for payments. It also acts as a controller for its own purposes such as fraud prevention. See stripe.com/privacy | United States and other countries, using the safeguards in its policy |
| Apple or Google, if you get the App or pay in it through their stores | What their store needs to deliver the App and take payment. Not your audio, date of birth or mobile number | Independent controllers under their own policies | United States and other countries |
| Microsoft Azure Communication Services (data location UAE), our email provider, when we send you email from notify.sonobolt.com | Your email address and the message, including one-time codes and download links | Processor | United Arab Emirates |
| The people who run the Service | Order details and, for held mixes, the mix itself | Bound to confidentiality | Where we work |
| PostHog, only if you accept analytics | The usage data in section 2. Never your audio, file names, song titles, email address or download links | Processor, under a signed data processing agreement | Germany (PostHog EU Cloud, Frankfurt) |
| The other party to a copyright notice or counter-notice | The notice or counter-notice, including its sender's name and contact details (Copyright Policy 5 and 6) | Independent | Depends on the party |
| Courts, authorities and claimants | Records we hold, where the law requires it or we reasonably need it to bring or defend a claim. This can include the evidence record | Independent | Depends on the claim |
| A buyer of the business | Records needed to continue the Service, under this policy | Controller | Depends on the buyer |
Beat This!, Whisper and BS-Roformer are analysis models that run on servers we rent in the United Arab Emirates. Your audio is not sent to the makers of those models. The malware scanner, ClamAV, runs on our own server, so no file goes to an outside scanning service. Lyrics are detected only by our own software on our server: we use no outside lyrics source, and no title, artist or lyrics go to one.
We do not send your audio to any outside stem-separation provider. Your audio is stored and processed only in the United Arab Emirates. We develop and test our software with test audio, never with yours.
4. How long we keep it
| Data | How long |
|---|---|
| Uploads, stems, working files and reports that quote lyrics | Deleted as soon as the mix render is ready, including our automatic check of it (the Audio deletion rule in clause 9.1 of our Terms). If a job fails, is withdrawn or is stopped, they are deleted when it ends. A job not finished within 24 hours of your confirming the order fails (Terms 9.4). As a second safeguard, a rule in our audio storage deletes any audio older than 2 days, even if our own software does not |
| Finished mix | 24 hours from when we send its download link, and never beyond 24 hours after it was ready, then deleted. Your songs, stems and mix are gone no later than 48 hours after you confirm the order. If you withdraw or we stop the job, it is deleted then |
| Mix held for review | Until a person decides, within the 24 hours the job has from your confirming the order. If approved in time, it is delivered and the 24 hours above start when we send its link. If declined or undecided, it is deleted |
| Mix whose download link we cannot send | Held while we keep trying, for up to 24 hours after it was ready, then deleted and the order cancelled (Terms 9.9) |
| Files from an order that was interrupted before it started, and temporary files from the quality check | Deleted once they are older than 24 hours |
| The error file for a job that failed (no audio) | 24 hours. A short description of the error stays in the order record |
| Sign-up record | 6 years after your account is deleted or closed, for the reason given for the evidence record below |
| IP address in the sign-up, evidence and order records | 2 years from when it was recorded, to investigate fraud and card disputes and as evidence while claims about a job are most likely. Then we replace it with a keyed hash, which is pseudonymised and kept only to bring or defend legal claims, for the rest of that record's period. The approximate location stays with the record |
| One-time code | Until used, or 10 minutes |
| Date of birth of someone under 18 who tries to sign up | Not kept |
| Deletion log | 6 years from the deletion |
| Evidence record | 6 years from the date of the job, then deleted. Why 6 years: under UAE law a claim for harm can be brought up to 3 years after the claimant learns of it (Civil Transactions Law, Article 258), rights holders often learn late, and we need the record while a claim over the job is likely. If a claim or criminal case is pending when the 6 years end, we keep the record for it until it is over |
| Order record, including song titles, file names and the hashed IP address | 6 years from the date of the job, then deleted, for the same reason |
| Block-list hash of a file named in a valid copyright notice | 6 years from the notice |
| Invoice | 7 years after the end of the calendar year it belongs to, for tax and accounting law |
| Takedown notices, counter-notices and strike records | 6 years from the last event in the case |
| Account details | Until you delete your account or it is closed, then deleted within 30 days. After that we keep only the other records in this table. Your name, email and date of birth stay in the sign-up record for its period |
| Audio we must keep under a legal requirement or for a specific legal claim | Only for that purpose, until it ends |
| Server logs | Up to 30 days |
| Analytics events from PostHog | 12 months, then deleted |
| Encrypted backup of records that hold no audio | 14 copies. Each new copy replaces the oldest, so a record we have deleted leaves the backups within 14 days |
| Automatic deletion | A task retries about every 10 minutes if a file cannot be removed at the first attempt, so deletion can happen shortly after the times above |
| Support messages | 2 years after the conversation ends, longer if they relate to a pending claim |
| Job reference in your browser | Until you clear it or start a new mix in the App |
5. Deleting your account
You can delete your account in the App's account settings, on our website, or by writing to support@sonobolt.com. Deleting it cancels unfinished jobs, deletes all audio we still hold for you, including a mix you have not downloaded, and cancels every download link at once. We delete your account details within 30 days. We keep the sign-up record (which holds your name, email and date of birth), evidence record, order record, deletion log and invoice for the periods above, because the law requires it or because we need them to bring or defend claims (Article 15(3)(b) and (c) of the UAE law). This is the main limit on the right to erasure in our Service, and we want you to know it before you order.
6. Transfers outside the UAE
Our hosting, our email service and the machine that makes your mix are in the UAE, so sending them your data is not a transfer outside the UAE. If a provider's own staff outside the UAE have to reach that data to run or support the service, they do so under the provider's processor contract.
Cloudflare, Stripe, Apple, Google and PostHog in section 3 are outside the UAE. We send them only what is needed to make and deliver your mix or to run the App, which Article 23(1)(d) of the UAE law allows, and where we can we bind them by contract to protect it as that law requires (Article 23(1)(a)). Analytics data goes to PostHog in Germany only with your explicit consent (Article 23(1)(b)), which you give in the analytics banner. Ask us at support@sonobolt.com for details.
7. Security
Here is what we do and what we do not do.
- Traffic between your browser and the App is encrypted with HTTPS.
- Each job has its own storage area. No files are shared between jobs.
- Uploads go from your browser straight to our audio storage through a link that lasts 15 minutes and can only create one file. It cannot read, replace or delete anything.
- Every file you upload, and every song inside a zip you upload, is checked for malware by a scanner (ClamAV) that runs on our own server before we process it. The file is not sent to any outside scanning service. If a file is flagged or cannot be checked, we refuse the order and delete what you uploaded.
- Each job has a long random reference, and each emailed download link has its own long random token. When the mix is deleted we cancel its token. Anyone who has either link can open your mix until it is deleted. After that, the job link still shows the job's status and invoice, without your name or email, until those records are deleted. Treat both links like a password.
- Audio is stored in cloud object storage and on the disks of temporary machines, all in the UAE, encrypted at rest by the provider. The App adds no encryption of its own.
- Deletion removes files from storage. It does not overwrite the disk. We switch off soft delete, versioning and snapshots for the audio storage, so deleting a file does not leave a copy behind.
- We keep no backup or snapshot of audio, stems or mixes. The storage that holds them is left out of every backup and snapshot. Our cloud provider keeps copies inside its data centre to guard against hardware failure. Those are not backups we can restore from.
- A rule in the audio storage deletes any audio older than 2 days, as a backstop in case our own software fails to. The rule runs about once a day.
- A deletion log records each file we delete. It holds no audio and no file names.
- Our logs hold no audio, no lyrics and no file names.
- Records that contain no audio (section 4) may also be kept in an encrypted backup in the UAE, which follows the same periods. We keep 14 copies and each new one replaces the oldest, so a record we delete leaves the backups within 14 days. Only the owner holds the key, offline.
No system is fully secure. If a breach is likely to put your rights at risk, we will tell you and the relevant authorities as the law requires.
8. Your rights
To use any right below, write to support@sonobolt.com. You can also delete your account yourself (section 5). We may need to confirm that the request is yours. There is no charge unless a request is plainly excessive. Rights are not absolute: for example, we can refuse to erase the evidence record while we need it to bring or defend claims.
UAE (Federal Decree-Law No. 45 of 2021, Articles 13 to 18). You can ask for information about how we process your data, access and a portable copy, correction, erasure, restriction and stopping of processing, and you can object to automated decisions. You can complain to the UAE Data Office, or the authority that replaces it (Article 24). If you deal with us from the DIFC or ADGM and their data laws apply, you have the rights those laws give.
If you are elsewhere. The Service is not offered outside the UAE. If a foreign privacy law still applies to you, use the same address and we will honour the rights it gives.
9. Children
The Service is for adults: 18 or older, the age of majority under UAE law. We ask for your date of birth when you sign up and refuse the sign-up if you are under 18, without keeping that date. We do not aim the Service at children and do not knowingly collect data from them. If we learn that someone under age has used it, we will close the account and delete the data we can delete. If you think this has happened, write to support@sonobolt.com.
10. Marketing
We send service messages about your orders and account. We send marketing only if you have agreed to it, and you can opt out at any time (Federal Decree-Law No. 14 of 2023, Article 6(4)).
11. Cookies, browser storage and app permissions
We use no advertising cookies, and no third party tracks you across other websites through our pages. Without your consent, our pages use only what is strictly needed for what you ask them to do:
- a job reference kept in your browser's local storage and shown in the page address, so that you can come back to your job, which you can clear by starting a new mix in the App or in your browser settings; and
- when you are signed in, a session cookie on the website, or a sign-in token kept in your device's secure storage in the App, that keeps you signed in.
The App asks for no access to your location, contacts, camera or microphone. It reads only the audio files you pick to upload.
Strictly necessary storage does not require consent. Stripe sets its own cookies on its own pages when you pay.
Analytics are off until you accept them. Our banner asks first, with "Accept" and "Reject" given equal weight. Only if you accept do our pages load PostHog, which stores an identifier in a cookie and in local storage and sends the usage data in section 2 to PostHog's EU Cloud in Frankfurt, Germany. We make no recordings of your session, and nothing you type or click is sent. Your audio, file names, email address and download links never go to PostHog. You can withdraw at any time through the "Cookie settings" link at the foot of every page, and we then stop. We treat a "Do Not Track" or Global Privacy Control signal as a refusal.
12. Changes to this policy
If we change this policy, we will publish the new version with a new date. If the change is material, we will tell you by email or in the App before it applies. For a change to how we use data we already hold, we will ask for consent where the law requires it.
13. Contact
The Operator, at the address in section 1. Privacy Officer: support@sonobolt.com