Privacy Policy

This Privacy Policy describes how GuitarMap, LLC ("GuitarMap," "we," "us," or "our") collects, uses, and shares information about you when you use our website, web application, and related services (collectively, the "Service"). By using the Service, you agree to the collection and use of information in accordance with this Policy.

This Privacy Policy is incorporated by reference into our Terms of Service.

1. Information We Collect

1.1 Information You Provide

We collect information you provide directly to us, including:

• Account information — when you create an account, we collect your email address, display name, and password (stored as a salted hash).
• Profile information — optional avatar, display name, and account preferences.
• Payment information — when you make a purchase, our payment processor collects payment card details on our behalf. We do not store complete credit card numbers on our servers; we only store a non-sensitive customer identifier and the last four digits of your card for reference.
• Audio and video files — when you use the transcription service, you upload audio or video files that are stored on our servers for processing and playback.
• URL submissions — when you submit a URL for processing, we collect the URL, submission timestamp, and your certification that you have rights to process the content.
• Transcription content — the tab data, annotations, edits, and exports you create within the Service.
• Communications — when you contact us via email or in-app bug report, we collect the content of your message, your email address, and any attachments you provide.
• Bug reports — when you submit a bug report through the Service, we collect the description you provide and may collect technical context (browser, screen size, recent actions) to help diagnose the issue. Bug reports may be converted to internal issue tracker entries.

1.2 Information Collected from URL Submissions

When you use our URL processing feature, we collect:

• The URL itself — the full URL you submit for processing
• Submission metadata — timestamp, your user ID, IP address at time of submission
• Certification records — your acknowledgment that you have rights to process the content
• Processing metadata — duration of content, processing status, completion time, and any errors encountered
• Content metadata— title and duration of the audio (as provided by the source platform's public metadata)

We do NOT collect:

• Your YouTube account credentials or login information
• Your browsing history on YouTube or other platforms
• Any information about your YouTube account, subscriptions, or watch history
• Content from URLs you do not explicitly submit

Important: We do not have any data-sharing relationship with YouTube, Google, or any other third-party content platform. Submitting a URL to the Service does not grant us access to your account on that platform, and that platform is not informed that you have used the Service.

1.3 Information Collected Automatically

When you access or use the Service, we automatically collect certain information:

• Device information — hardware model, operating system, browser type, screen resolution, and language settings
• Log information — access times, pages viewed, IP address, referring URL, and the actions you took in the Service
• Location information — we may infer your approximate location based on your IP address (typically city or region level)
• Usage information — features you use, transcriptions you create, edits you make, and playback patterns
• Performance and error data — information about crashes, slow page loads, or errors that occur in the Service, used to improve reliability

1.4 Abuse Prevention

We may use technical measures, including IP-based heuristics, to detect and prevent the creation of multiple accounts intended to circumvent our trial offers, credit grants, or usage limits. We do not use this information for advertising purposes.

2. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Service, remember your preferences, and understand how the Service is used.

2.1 Types of Cookies We Use

• Essential — required for authentication, security, and session management (session or up to 1 year)
• Preference — remember your settings such as theme, language, and playback preferences (up to 1 year)
• Analytics — help us understand how visitors interact with the Service (up to 26 months)

We do not currently use third-party advertising cookies or sell behavioral data to advertising networks.

2.2 Cookie Management

You can control cookies through your browser settings. Disabling essential cookies will prevent you from being able to log in or use the Service. For more information about managing cookies, visit allaboutcookies.org.

3. Analytics

We use first-party and third-party analytics services to understand how the Service is used. These services collect information such as how often users visit the Service, what pages they visit, and what actions they take, primarily for the purposes of improving the Service.

Analytics data is anonymized or pseudonymized to the extent practical. We do not combine analytics information with personally identifiable information for advertising purposes.

4. How We Use Your Information

We use the information we collect to:

• Provide and maintain the Service — process your audio and video files, generate transcriptions, store your tabs, and synchronize playback
• Process payments — complete transactions and send related receipts
• Communicate with you — send service-related notices, respond to inquiries, and provide product updates
• Improve the Service — analyze usage patterns, troubleshoot issues, and develop new features
• Improve our AI models — use anonymized, de-identified transcription data to train and evaluate our AI models (subject to your opt-out preference; see Section 15)
• Personalize your experience — customize the Service based on your preferences, transcription history, and Shed activity
• Prevent fraud and abuse — detect, investigate, and prevent fraudulent transactions, multi-account abuse, and other terms violations
• Comply with legal obligations — respond to lawful requests, comply with applicable laws and regulations, and enforce our Terms of Service
• Respond to copyright matters — review copyright concerns and cooperate with rights holders pursuant to valid legal process

4.1 How We Use URL Submission Data

When you submit a URL for processing, we use the collected information to:

• Process your request — download and process the audio at the URL you specified
• Maintain records — keep logs of submissions for abuse prevention, repeat-infringer enforcement, and legal compliance
• Respond to legal process — provide information in response to valid subpoenas, court orders, or copyright requests
• Enforce our Terms — identify and terminate accounts that violate our Terms of Service
• Prevent repeat infringement — track and terminate users who repeatedly process content they do not have rights to

We do NOT use URL submission data to:

• Build profiles of your music preferences for advertising
• Share your submission history with YouTube, Google, or other platforms (except as required by valid legal process)
• Sell or rent your URL submission history to third parties
• Target advertisements based on specific URLs you have submitted

5. How We Share Your Information

We share information only as described below. We do not sell your personal information.

5.1 Service Providers

We share information with third-party service providers who perform services on our behalf and are bound by contractual confidentiality and data-protection obligations. These categories include:

• Payment processors — to process transactions and manage subscriptions
• Cloud hosting and infrastructure providers — to host our application, database, and storage
• AI processing partners — to perform stem separation and audio analysis
• Email service providers — to deliver transactional and account-related emails
• Error monitoring and analytics providers — to detect and diagnose issues and improve the Service
• Customer support tools — to manage and respond to user inquiries

These providers are authorized to use your personal information only as necessary to provide their services to us.

5.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (such as a court or government agency), including to meet national security or law enforcement requirements.

5.3 Copyright and Rights Holder Inquiries

We may disclose information about your URL submissions and account to:

• Copyright owners and their authorized representatives in response to valid subpoenas or court orders
• Law enforcement agencies investigating potential copyright infringement or other illegal activity
• Third-party platforms (such as YouTube or Google) in response to valid legal process

Information we may disclose in response to valid legal process includes:

• Your account information (email, display name, registration date)
• URLs you have submitted for processing
• Timestamps of your submissions
• IP addresses associated with your submissions
• Your certification records (acknowledgment that you had rights to process content)

We will not voluntarily disclose your information to rights holders without valid legal process, except where we have a good-faith belief that disclosure is necessary to prevent imminent harm or illegal activity.

5.4 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

5.5 With Your Consent

We may share your information with third parties when you give us explicit consent to do so.

5.6 Administrative Access

A small number of authorized GuitarMap personnel may access user accounts, transcriptions, and stored content for legitimate operational purposes including customer support, abuse investigation, billing inquiries, and platform maintenance. Administrative access is logged. Material administrative actions (such as credit grants, plan overrides, and security-status changes) are recorded in an internal audit log. We do not access user content for any purpose unrelated to operating the Service.

6. Data Retention

6.1 Uploaded Audio and Video Files

Audio and video files you upload directly to the Service are retained for the lifetime of the associated Transcription so that you can replay your tab synchronized to the original recording. When you delete a Transcription, the associated audio and video files are deleted from active storage within 30 days, subject to backup retention.

6.2 URL-Submitted Content

• Source audio downloaded from URL — retained while the associated Transcription exists, for synchronized playback; deleted within 30 days of Transcription deletion
• Transcription output (tab data) — retained until you delete the Transcription or close your account
• URL submitted — retained for 3 years for abuse prevention, repeat-infringer enforcement, and legal compliance
• Submission metadata (timestamp, IP, user ID) — retained for 3 years
• User certification records — retained for 3 years for legal compliance

We may retain URL submission records and certification data longer if required by law, legal process, or to respond to claims related to copyright infringement.

6.3 Account Information

We retain your account information for as long as your account is active or as needed to provide you the Service. If you request account deletion, we will delete your personal information within 30 days, except where we are required to retain it for legal, fraud-prevention, or billing record purposes.

6.4 Bug Reports and Communications

Bug reports, support communications, and related metadata are retained for up to 3 years to help us diagnose recurring issues and respond to follow-up inquiries.

6.5 Analytics Data

Analytics data is retained according to the retention policies of our analytics providers, typically 14 to 26 months.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS/SSL)
• Encryption of data at rest where supported by our storage providers
• Row-level security policies that prevent users from accessing each other's content
• Access controls and authentication for administrative personnel
• Logging of administrative access to user accounts
• Regular security review of our codebase and dependencies

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

8. International Data Transfers

Your information may be transferred to and processed in the United States or other countries where our service providers operate, which may have data protection laws different from the laws of your country of residence.

When we transfer your information internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or similar mechanisms recognized under applicable law to protect that information.

9. Your Rights and Choices

9.1 Account Information

You may access, update, or delete your account information at any time by logging into your account settings. To delete your account entirely, use the account-deletion option in settings or contact us at privacy@guitarmap.ai.

9.2 Marketing Communications

You may opt out of receiving promotional communications from us by following the unsubscribe instructions in those messages. If you opt out, we may still send you non-promotional communications, such as those about your account, billing, or material changes to the Service.

9.3 AI Model Training Opt-Out

You may opt out of the use of your anonymized transcription data for AI model training at any time by toggling the "Model data opt-out" setting in your account settings. Opting out excludes your data from future training runs.

9.4 Cookies

Most web browsers are set to accept cookies by default. You can usually set your browser to remove or reject cookies. Disabling essential cookies will prevent you from using the Service.

9.5 Do Not Track

Some browsers include a "Do Not Track" (DNT) feature. The Service does not currently respond to DNT signals because there is no industry consensus on how such signals should be interpreted.

10. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to know — request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for which we use it, and the categories of third parties with whom we share it.
• Right to delete — request that we delete your personal information, subject to certain exceptions.
• Right to correct — request that we correct inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell your personal information and do not share it for cross-context behavioral advertising.
• Right to limit use of sensitive personal information — we do not use sensitive personal information for purposes that require this right to be offered.
• Right to non-discrimination — we will not discriminate against you for exercising your CCPA/CPRA rights.

To exercise your rights, contact us at privacy@guitarmap.ai. We may need to verify your identity before fulfilling your request. You may also designate an authorized agent to make requests on your behalf.

11. European Privacy Rights (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have certain rights under the General Data Protection Regulation and equivalent UK law:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate personal data
• Right to erasure — request deletion of your personal data
• Right to restrict processing — request restriction of processing of your personal data
• Right to data portability — receive your personal data in a structured, commonly used, machine-readable format
• Right to object — object to processing of your personal data on grounds relating to your particular situation
• Right to withdraw consent — where we rely on consent, withdraw it at any time

To exercise your rights, contact us at privacy@guitarmap.ai. You also have the right to lodge a complaint with a supervisory authority in your country of residence.

Legal bases for processing. We process your personal data based on the following legal grounds:

• Contract — processing necessary for the performance of our contract with you (providing the Service)
• Legitimate interests — processing necessary for our legitimate interests (improving the Service, preventing fraud and abuse, enforcing our Terms), provided those interests are not overridden by your rights
• Consent — where you have given consent to specific processing activities (such as AI model training, where applicable)
• Legal obligation — processing necessary to comply with legal requirements (such as responding to copyright notices or tax obligations)

12. Children's Privacy

The Service is not directed to children under 13 years of age (or 16 years of age in the European Economic Area, the United Kingdom, or Switzerland). We do not knowingly collect personal information from children under these ages.

If we learn that we have collected personal information from a child under the applicable age, we will take steps to delete that information promptly. If you are a parent or guardian and believe that your child has provided personal information to us, please contact us at privacy@guitarmap.ai.

For users between 13 and 17 (or, in the EEA/UK/Switzerland, between 16 and 17), use of the Service requires the consent of a parent or legal guardian as described in our Terms of Service.

13. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party sites you visit.

14. YouTube and Third-Party Platform Privacy

14.1 No Data-Sharing Relationship

We have no data-sharing relationship with YouTube, Google, or any other third-party content platform. When you submit a YouTube URL to the Service:

• We do not send your personal information to YouTube or Google
• We do not receive any information from YouTube about you or your YouTube account
• YouTube does not know that you have used the Service
• We do not have access to your YouTube account, subscriptions, or watch history

14.2 What YouTube May Observe

When our processing servers access a URL you submit, YouTube's servers may log:

• The IP address of our processing servers (not your IP address)
• The time of access
• The video or audio being accessed

This is standard web-server logging by YouTube and is governed by YouTube's own privacy policy, not ours.

14.3 Your YouTube Privacy

Your use of the Service's URL processing feature does not affect your privacy settings on YouTube or any other platform. We encourage you to review YouTube's Privacy Policy and Terms of Service. We are not responsible for how YouTube or other platforms collect, use, or share information.

15. AI Training and Model Data

To improve the accuracy of our transcription models, GuitarMap may use anonymized, de-identified transcription data to train, evaluate, and improve our AI models. This data consists of:

• Tab output (notes, timings, technique annotations)
• Derived audio features used during transcription

This does not include your original audio or video files, your account information, or any other personally identifiable information.

You may opt out of this use at any time via the "Model data opt-out" setting in your account. Opting out excludes your data from future training runs. Previously processed anonymized data may already be incorporated into existing model weights and cannot be individually removed.

We do not sell anonymized model data to third parties.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Privacy Policy in the Service and updating the "Effective date" above. For material changes, we will provide additional notice (such as email notification) where appropriate. You are encouraged to review this Privacy Policy periodically.

17. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

GuitarMap, LLC
600 Congress Ave, Austin, TX 78701
Email: privacy@guitarmap.ai

For data-protection inquiries from users in the European Economic Area or the United Kingdom, direct correspondence to privacy@guitarmap.aiwith subject line "EU/UK Data Protection Inquiry."