SuccessSubliminals

Privacy Policy

This policy describes what Subliminal Studio (studio.successsubliminals.com) actually does with your data. Short version: uploaded music and rendered tracks stay on your device, script text is sent for AI writing, voice suggestions and speech generation. We run no advertising or third-party tracking, and you can delete your account yourself at any time.

While you are signed in, your current script is sent to Anthropic after you pause editing or finish generating it to check which voice suggestions fit its wording. This includes scripts you paste or write yourself. The check uses no credits. Results expire after 7 days and are removed during hourly cleanup. A text fingerprint lets us avoid repeat checks without saving another copy of your script. These results belong to your account and are removed when you delete it. Script text and content categories are excluded from product analytics.

Controller

Andreas Breuninger, SuccessSubliminals, Hausäckerstraße 6, 78166 Donaueschingen, Germany — Info@SuccessSubliminals.com (see the Imprint).

What we process, and why

• Account — your email address and, if you sign in with Google, your Google account id, name and profile picture. If you sign in by email instead, we send a short-lived one-time code to your address and store only a hashed copy of it until it expires. Purpose: providing your account, credit balance and projects. Legal basis: Art. 6(1)(b) GDPR (contract).
• Invitations and wait list — while access is invite-only we store the email addresses we invite (and, if you join the wait list, the address you enter) together with the invite's status, solely to send and manage your invitation. Wait-list entries are deleted on request and when your account is erased. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering a contract, at your request).
• Your content — the affirmation topics and scripts you enter, and your project settings. Projects are stored in your browser and synced to your account so your work survives a device change (Art. 6(1)(b) GDPR). Your audio is normally created on your own device and never reaches us. The one exception is when you choose a studio render: then your script lines and mix settings are sent to our server, which produces the file and holds it for up to 48 hours so you can download it, after which the file is deleted automatically. Deleting your account removes those renders and their scripts immediately.
• Billing — credit purchases and the membership are processed by Stripe. If you choose PayPal at checkout, Stripe routes that payment through PayPal, so PayPal also keeps a record of it under its own privacy policy. We store a record of each purchase (pack, amount, Stripe session id) and your credit ledger; we never see or store card numbers or PayPal credentials. Legal bases: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (statutory retention of accounting records).
• Usage records — a log of paid actions (generation and synthesis counts, characters, credit cost) for accounting, support and abuse prevention, and a small set of first-party product events (for example, creating a personal program, returning to it, starting a download, confirming a save or share, viewing credit packs and opening checkout) so we can see where people succeed or need help. Project references join these steps without including your script or topic. No third-party analytics, no advertising identifiers. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in running and improving the service).
• Error reports — if the app hits an error in your browser, a short technical report (error message, stack trace, page path, browser details and app version) is sent to us so we can fix it. Legal basis: Art. 6(1)(f) GDPR.
• Visit counting — we count page visits ourselves, without cookies and without any identifier stored on your device. Each visit records the page path, the referring site, a coarse device class, the browser language and a technical key that changes every day, so visits on different days can never be linked to each other or to you. These counts are deleted after at most 180 days. No third-party analytics service is involved. Legal basis: Art. 6(1)(f) GDPR.
• Server logs — our web server records each request (time, IP address, requested URL, response status, browser identifier) so we can keep the service secure and diagnose technical problems. These logs are deleted automatically after about 7 days. Legal basis: Art. 6(1)(f) GDPR.

What stays on your device

The audio engine runs on your device. Synthesized voice clips, your listening copies and your rendered tracks live in your browser's local storage (IndexedDB) and are not transmitted to our servers. Music you upload is never sent to us. The exception is a studio render, which you start deliberately: that file is produced on our server and deleted after 48 hours (see above).

Processors and recipients

• Google Ireland Ltd. — Sign-In (authentication).
• Stripe Payments Europe Ltd. — payment processing.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. — payment processing when you choose PayPal at checkout.
• Cloudflare Inc. — content delivery and DDoS protection (sees request metadata / IP address).
• Hetzner Online GmbH — server hosting.
• AI providers — the script text you submit is sent to the provider needed for your request: Anthropic (affirmation writing and script checks for voice suggestions) and, depending on the voice you pick, OpenAI, Google, xAI or ElevenLabs (text-to-speech). To check that a voice actually read your line instead of replying to it, the generated audio for those voices is also sent to OpenAI for automatic transcription, and the transcript is compared with your line and then discarded. This happens for every newly generated clip from those voices, whichever of them you picked. Only the text and that audio are transmitted, not your name or email. The Budget voice runs locally on our own server and sends nothing to third parties.

Some of these providers process data in the United States. Where they do, transfers rely on the EU-U.S. Data Privacy Framework and/or EU standard contractual clauses.

Cookies

Two essential cookies, and only if you use them: one holds your login session, and signing in by email link sets a short-lived cookie (30 minutes) on the browser that requested the link, so only that browser can complete the sign-in. There are no advertising, tracking or third-party cookies, and no cookie banner is needed for strictly necessary cookies.

Retention

• Account data: until you delete your account.
• Purchase and credit-ledger records: 10 years (§ 147 AO, German fiscal law), in anonymized form after account deletion.
• Login sessions: expire automatically.
• Server logs: about 7 days.
• Studio renders: the script is removed when rendering finishes; the downloadable audio file is kept for up to 48 hours. Job history (track title, format, length, credit cost and timestamps) remains until you delete your account. Account deletion removes all of these immediately.
• Error reports and product events: deleted with your account; error reports are additionally pruned automatically. Critical creation events may be queued in session storage for up to 15 minutes to recover a failed delivery. The queue is tied to your signed-in account.
• Creation-attempt records: kept for up to 90 days and deleted with your account. Aggregate performance measurements and collection counters: 14 days. Daily totals without account identifiers: up to 400 days.
• Visit sources: short source, campaign, channel and link-placement labels, plus the public entry page, may be associated with your account to understand which links bring people to the studio and which bring them back. Signup and return sources are kept separately. These labels can travel through links between our website and studio. For email signup, they are kept with the temporary login code until you use it or it expires. We do not store the referring page's full address or search query. The labels are deleted with your account.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to complain to a supervisory authority — for us that is the LfDI Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

You can delete your account yourself at any time: account menu → “Delete account”. This erases your identity, projects, events and reports immediately; purchase records are kept in anonymized form as required by fiscal law. For anything else, email Info@SuccessSubliminals.com.