1. What we collect

We collect only what the service needs to work:

• Account data: email address, the display name you choose, your language preference, sign-in timestamps and your plan.
• Content you create: audio you upload, artwork, sets, crates, mixes, cue points, playlists, blog posts and submissions.
• Measurements derived from your audio: tempo, key, Camelot position, energy, duration and waveform.
• Usage data: which features you open, actions such as generating or saving a set, and error reports.
• Transaction data: what you bought, the amount, currency, provider, status and a provider reference. We never receive or store your full card number.
• Support data: the messages you send us and the conversation history in the support area.
• Booking data: the contact details, date, venue and requirements you submit in a booking request.
• Identity verification data, only if you take part in a programme that requires it: the documents, the selfie and the biometric face comparison are handled by Sumsub, our verification provider, and we receive the result and its references rather than your document images or biometric data. Section 6 explains this in full.
• Technical data: IP address, browser and device type, and security logs such as rate-limit and sign-in events.

2. Why we use it, and our legal basis

To perform our contract with you: run your account, store and analyse your library, generate and save sets, process purchases, deliver what you bought and answer support requests.

For our legitimate interests: keeping the service secure, preventing fraud and abuse, enforcing plan limits, understanding aggregate feature usage and improving the product.

To comply with legal obligations: accounting and tax records, and responding to lawful requests.

With your consent: optional cookies, marketing emails and any feature that asks you first. You can withdraw consent at any time.

3. Your uploaded music

Audio you upload is stored privately and is readable only by your own account. Row-level access rules in our database and signed, time-limited links for audio files enforce that separation.

We process your audio to measure it and to play it back to you. We do not publish it, sell it, hand it to advertisers or use it to train models for third parties. It becomes visible to a reviewer only if you yourself submit it for catalogue inclusion or sale.

4. Who we share data with

We do not sell personal data. We share it only with the service providers we need to run the platform, each under a contract that limits them to our instructions:

• Hosting, database, storage and authentication providers that run the application.
• Payment providers, which handle card and wallet details directly and return only a status and reference to us.
• Music-data providers, which supply catalogue metadata and preview clips. We send them search terms and track identifiers, not your personal data.
• Email delivery, error monitoring and analytics providers.
• Sumsub (Sum and Substance Ltd), our identity verification provider, and only for programmes that require verification and only after you consent.
• Authorities or advisers, where the law requires it or where we need to establish or defend a legal claim.

5. International transfers

We operate from Panama and our providers operate in several countries, so your data may be processed outside the country where you live. Where data covered by European or UK rules is transferred, we rely on the appropriate safeguards, such as standard contractual clauses with the provider concerned.

6. Identity verification and biometric data

Some programmes, such as VIP, require identity verification. We use Sumsub (Sum and Substance Ltd) as our verification provider. You start the check yourself and give explicit consent first; we store the fact that you consented, the consent version and the time it was given.

The check itself happens in Sumsub's flow. You present an identity document and, depending on the level, a selfie that Sumsub compares with the document to confirm it is a live person and the same person. That facial comparison is biometric processing, its only purpose is to confirm your identity, and it is carried out on the legal basis of your explicit consent.

Your document images and biometric data are held by Sumsub as our processor under its own retention rules. We do not receive them, we do not store them and we do not use them for anything else — not for advertising, profiling, training models or tracking you across the service.

What we keep in our own database is limited to the verification record: your account identifier, the provider name and environment, the provider applicant and inspection references, the status and its reason category, the level name, the country you declared, and the consent, start, verification, rejection and re-verification timestamps.

Verification is voluntary. You can refuse it, and you can withdraw your consent at any time by writing to us: we will close the verification, delete the verification record and ask the provider to delete the material it holds for you, subject to any period it must keep for its own legal obligations. Withdrawing consent ends access to the programmes that depend on verification, and it does not affect processing carried out before you withdrew it.

7. How long we keep it

Account data, uploads, sets and library content: while your account is open, and deleted or anonymised after you close it.

Transaction and invoice records: kept for the period our accounting and tax obligations require, even after the account closes.

Security and audit logs: kept for a limited period proportionate to detecting and investigating abuse.

Identity verification records: the outcome and consent record are kept while your VIP or programme status is active and for up to five years afterwards, so we can show a check was properly carried out; they are deleted sooner if you withdraw consent, unless a legal obligation requires us to keep them. Document images and biometric data are never held by us; the provider deletes them under its own retention schedule.

Support conversations: kept while they are useful for handling your requests and any related dispute.

8. Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, export it in a portable format, restrict or object to certain processing, or withdraw a consent you previously gave. You can also object to any automated decision that has a significant effect on you.

Write to legal@afroflowdj.ai and we will respond within one month. If you are not satisfied, you can complain to the data protection authority where you live.

9. Security

We encrypt data in transit, store uploads in private buckets served through signed, expiring links, restrict database rows to their owner, encrypt payment provider credentials at rest, apply rate limits, and keep administrative actions in an audit trail. No system is perfect; if a breach affects your data and the law requires notice, we will tell you and the relevant authority.

10. Children

The service is not intended for children under 16, or under the higher minimum age of digital consent where that applies. If we learn that we hold a child's data without the required consent, we delete it.

11. Cookies

Cookies and browser storage are covered in a separate Cookie Policy, linked from the footer of every page.

12. Changes to this policy

We may update this policy. The version and effective date at the top of the page show the current one, and we notify account holders of material changes before they take effect.

13. Contact

Privacy questions and data requests: legal@afroflowdj.ai. Postal address: Coyle AI Fintech S.A., Tower Financial Center, Office 28-F, Calle 50, Ciudad de Panamá, Panamá, 08501, Republic of Panama.