Privacy Policy

Effective 25 September 2026. Version 2.1.

Data controller

Optimum Paweł Kowalski

ul. Pozytywistów 4/4, 20-639 Lublin, Poland

Tax ID (NIP): 712-031-17-46, REGON: 430325730

Email: support@countin.band

The short version

1. What we process and why

Audio files

When you add a song, the file is sent to our server, where its tempo and downbeat are detected and previews and exports are rendered. Server copies are deleted automatically within 24 hours. A copy of the song and your settings is kept in your browser (see section 3). Legal basis: providing the Service you asked for (Art. 6(1)(b) GDPR).

Purchases

Payment happens on Stripe's payment page. We receive from Stripe your email address, the amount paid, a payment reference and the kind of payment method used (for example card or PayPal). We do not receive card details. We store your email with your access key and the number of exports, send you a confirmation email with your access link, and keep the transaction for accounting. Legal bases: the contract (Art. 6(1)(b)) and our legal obligations under tax and accounting law (Art. 6(1)(c)).

Messages you send us

If you use the contact form or email us, we receive your email address, your name if you give it, and your message, and we use them to reply. The form also records your IP address for up to an hour to stop spam. Legal basis: our legitimate interest in answering you (Art. 6(1)(f)).

Visit statistics without cookies

We count visits with our own simple measurement. Each page view gets a random identifier that is not stored in your browser. We record the page, where the visit came from (for example a search engine or a link, taken from the referrer), how long the page was in view, and which features were used. To tell one visit from the next, a short-lived fingerprint made from a one-way hash of your IP address and browser type is kept for 30 minutes. Legal basis: our legitimate interest in knowing how the Service is used (Art. 6(1)(f)).

Security

To protect the Service from abuse we count requests per IP address for up to 24 hours, and our hosting providers keep short technical logs (IP address, time, request). Legal basis: legitimate interest in security (Art. 6(1)(f)).

Google Analytics, only with your consent

If you click Accept on the cookie banner, Google Analytics records how the Service is used, with cookies that tell visits apart. Until you accept, analytics cookies are not set; Google may receive cookieless signals without identifiers. You can withdraw consent at any time on the Cookies Policy page. Legal basis: consent (Art. 6(1)(a)).

Session recordings and heatmaps with Microsoft Clarity, only with your consent

If you click Accept on the cookie banner, Microsoft Clarity records how you use the pages: mouse movement, scrolling, clicks and taps, and the parts of the page in view, and builds heatmaps from many visits. The recordings show the page as you saw it, which can include the names of the files you add; anything you type into a form is masked. Clarity also receives your IP address, browser and device type, and sets cookies that tell visits apart (listed in the Cookies Policy). Microsoft acts as our processor and stores the data in its Azure cloud; recordings are kept for 30 days, a small sample of recordings and the heatmaps for up to 9 months. Until you accept, Clarity is not loaded at all. You can withdraw consent at any time on the Cookies Policy page. Legal basis: consent (Art. 6(1)(a)).

2. How long we keep data

DataHow long
Audio files and renders on our serverDeleted automatically within 24 hours
Your library and settings in your browserUntil you remove them or clear the site's data
Purchase record (email, access key, export count)As long as your export access stays active, then until claims expire
Accounting records of payments5 years from the end of the year of payment
Emails and contact form messagesUp to 3 years
Visit statistics per visit45 days; totals without identifiers are kept longer
Security counters and visit fingerprint30 minutes to 24 hours
Hosting provider logsThe providers' short technical retention, typically days
Google Analytics dataUp to 14 months
Microsoft Clarity session recordings30 days; a sample of recordings and the heatmaps up to 9 months

3. What stays in your browser

Songs you add, their settings and your export preferences are kept in your browser's own storage (IndexedDB and localStorage) on your device, so they are there on your next visit. So is your access key after a purchase. We cannot see or restore this data. Clearing the site's data removes it, and Safari on iPhone may remove it after a period without visits. The Cookies Policy lists every item.

4. Who else processes data

We use service providers who process data only on our instructions and under data processing agreements:

We will tell you the name of any provider on request at support@countin.band. Some providers are in the USA. Transfers rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses; you can ask us for details of the safeguards.

We do not sell personal data and we do not make decisions about you by automated means.

5. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting what happened before. Write to support@countin.band. If you bought export access, please use the email you paid with so we can find your record. We answer within one month.

You can also complain to a data protection authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa), or the authority in the country where you live.

Providing data is voluntary. Without an email address a purchase cannot be completed, and without a file there is nothing to process.

6. Security

All connections are encrypted (HTTPS). Payment details never reach our servers. Uploaded files are deleted automatically, and we keep only the data listed above.

7. Children

The Service is not intended for children under 16. If you believe a child has given us personal data, write to us and we will delete it.

8. Changes

We may update this policy when the Service or the law changes. The current version and its effective date are always at this address, and significant changes are announced in the Service.