Privacy Policy
Last updated: October 9, 2026
Who we are
Soundtralize is a recording studio management app for Mac, operated in Québec, Canada. A Windows PC version is planned. Simon Dagenais is the person responsible for personal information protection. You can reach him at info@soundtralize.com or through our support form.
Account and license data
To manage accounts and licenses, Soundtralize stores an email address, a hashed password (never plain text), plan and subscription details, the studio workspace, team members and their roles, invitations, and the identifiers and names of activated devices. Beta invitation codes and password-reset codes are stored hashed; a reset code is valid for 30 minutes and can be used only once. Client Portal and Inter-Studio data is described separately below.
Studio data
Working data in the app — clients, projects, contracts, invoices, finances and files — stays on the studio’s computer or in a location it chooses, except for items it chooses to share through the Client Portal or Inter-Studio. Masters and final deliveries are not hosted on Soundtralize servers.
Finances and calendar (processed on the Mac)
Statements the studio imports (credit card, bank account or PayPal, as CSV, OFX or PDF) and the expenses created from them are read and saved on the studio’s Mac; they are not sent to Soundtralize servers. If the studio uses AI reading, it is done by Apple’s on-device AI directly on the Mac. To convert an amount in a foreign currency, the app requests the public Bank of Canada exchange rate, without any personal information. Choices remembered per vendor (category, personal purchase, taxes included) stay in the studio’s settings.
If the studio allows access to the Mac Calendar, the app shows the calendars it chooses and adds its sessions, follow-ups and release dates. These events stay in the user’s calendar and are synced by the user’s own provider (for example Google or iCloud), not by Soundtralize.
Client Portal
If a studio enables the Client Portal for a project, Soundtralize hosts the project title, studio name, client name and email address, date of the client’s last visit, MP3 or AAC/M4A listening versions, timecoded comments, approvals or change requests, messages and Google Drive or Dropbox delivery links. If the studio enables them, the portal also shows the PDF contract, project total, amount paid and balance. These items let the client listen, comment, approve and collect a delivery. The studio decides what to share and must have the right to do so. Masters are not hosted by Soundtralize.
The personal email invitation link is valid for 14 days, without a password. A new link requested from the portal is valid for 24 hours; the session lasts 30 days on the device. The strictly necessary st_portal cookie keeps that session open for 30 days. It cannot be read by scripts (HttpOnly) and is not used for advertising or analytics.
Listening files are automatically deleted 60 days after publication. Other portal items are deleted when the studio removes the portal or deletes its account. Storage is limited to 20 GB per studio during beta. Files are served through signed links that expire after one hour.
Hosting and service providers
The Soundtralize server (accounts, licenses, Client Portal and Inter-Studio) is operated by Soundtralize on its own equipment in Québec, Canada. Connections reach it over HTTPS through Cloudflare’s network (Cloudflare Tunnel), which protects the server and carries the traffic. Server backups are encrypted before leaving the server, stored with Cloudflare (R2) and kept for no more than four weeks.
Resend, in the United States, sends invitations, portal notifications and password-reset codes; it receives the recipient address and the email content.
If hosting changes, this policy will be updated before the move. The public server and automatic emails are not yet active. If you are a studio client, contact your studio first for access, correction or deletion of your information; you may also contact our support.
Subscriptions and payments — Paddle
Soundtralize subscriptions are sold by Paddle.com Market Limited (United Kingdom), our official reseller (Merchant of Record). Paddle collects and processes payment information, billing address and sales taxes under its own privacy policy; Soundtralize never receives your full card number. Paddle sends Soundtralize the email address, country, plan, subscription status and identifiers needed to activate the license. The payment page on soundtralize.com loads Paddle’s script.
Inter-Studio
Inter-Studio processes the studio and contact person’s names, email, DAW and version, operating system and skills. Partners see whether the studio is online or offline based on the date and time of its last connection. The service processes invitations sent, accepted or declined, and projects studios choose to share: title, requested role, status, progress and deadline. Partners can exchange messages and Drive or Dropbox file links. Contracts, finances, clients and Client Portal data are never shared with a partner through Inter-Studio. These data remain until the sharing or partnership is removed, or the account is deleted, subject to applicable legal obligations.
Dropbox (optional)
If the studio connects Dropbox, Soundtralize requests access only to Dropbox › Apps › Soundtralize (an “App folder”), not to the rest of the account. The app reads the account email to display it, uploads files the studio chooses and creates sharing links for them. In the current macOS version, tokens stay in Keychain, separately for each Soundtralize account, and are never sent to Soundtralize servers. Access can be revoked in Settings → Connected Services → Disconnect Dropbox or in connected apps at dropbox.com. Dropbox data is not sold, used for advertising or used to train AI. This connection is not yet publicly enabled.
Gmail — gmail.send
Only when the user clicks Send, Soundtralize uses gmail.send to send a contract, invoice or final delivery email (download link or .zip attachment) from the user’s Gmail account to the chosen recipient. The app does not read, list or delete email.
Google Drive — drive.file
Soundtralize creates a “Soundtralize” folder in the user’s Drive to store project files the user chooses to upload. The app can see and modify only files it created or uploaded itself; it cannot access the rest of the Drive.
Soundtralize may create a sharing link for deliveries it uploaded itself to the “Soundtralize › Deliveries” folder; the studio may share it with its client. Google data does not pass through the Soundtralize Client Portal.
Google identity and tokens
The openid and email permissions display the connected Google account’s email address. In the current macOS version, tokens are stored in Keychain on the Mac, separately for each Soundtralize account, and are never sent to Soundtralize servers.
Use of Google data
Google data is not sold, used for advertising or AI training, or shared with third parties. Soundtralize does not use any third-party AI service, and Google data is never processed by any AI model, including Apple’s on-device AI. Humans access it only at the user’s express request for support or if required by law.
Google Limited Use
Soundtralize's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Retention, deletion and revocation
Studio data remains under the studio’s control, including imported statements and the accounting files it exports. Request deletion of account data through support. To remove tokens from the Mac, disconnect Gmail or Drive in Settings → Connected Services before uninstalling the app. You may also revoke access in your Google Account.
Security
The website uses HTTPS and passwords are hashed. In the current macOS version, Google tokens are kept in Keychain. Access to account data is limited to people operating and supporting the service.
The Client Portal is designed with time-limited personal links, protected sessions, access controls and temporary links to listening files. These safeguards must be verified on public infrastructure before launch.
The portal is also designed with CSRF protection against fraudulent form submissions, rate limits on sign-in attempts and validation of accepted files: MP3 or AAC/M4A listening audio and PDF contracts. These safeguards must be verified on public infrastructure before launch.
Website data
The WordPress website processes data entered in its forms (support, beta application, beta tester report), plus technical data needed for operation and security: IP address, server logs, and session or login cookies. Form content is sent to info@soundtralize.com. This is separate from studio data in the app. The website does not use targeted advertising.
The soundtralize.com WordPress website is hosted by Dot Canada. This hosting is separate from the Soundtralize server.
Your rights in Québec
You may request access to or correction of your personal information, deletion where permitted by law, or withdrawal of consent to optional use. Contact Simon Dagenais, the person responsible for personal information protection, at info@soundtralize.com or through support.
The Soundtralize server is located in Québec. Some providers are outside Québec: Resend (United States), Paddle (United Kingdom) and Cloudflare (international network). A privacy impact assessment and required agreements must be completed before any transfer outside Québec. The public service is not yet active.
Children and updates
Soundtralize is intended for professionals, not children. We may update this policy; the date below identifies the current version. Last updated: October 9, 2026.