Dubload is a media management and collaboration platform for musicians and creators: you upload recordings, organize them in workspaces, annotate them with comments, collaborate with your bandmates, and optionally publish a public artist page. This policy covers the website (including artist pages on their own domains) and the BandEdit apps for iPhone, iPad and Mac. It explains what data we collect, why, who helps us process it, how long we keep it, and the choices you have.
Who we are
BandEdit is operated by Michel Maldonado-Pavlis, who is responsible (the “controller”) for the personal data described here. You can reach us about anything in this policy at privacy@bandedit.com.
Data we collect
- Account details — your email address and password (stored hashed), your name, your date of birth (to confirm you are 16 or older), the roles you pick (such as artist or producer), your profile photo, and optional details such as gender, country and city. Signing in with Google, Apple or GitHub adds what is described below.
- Your public profile — your name, username, photo, country, city, the date you joined and your public posts are shown on a public profile page that anyone can see and search engines can index.
- Your content — the audio, video, image and document files you upload and the information inside them (such as audio tags, and the camera and location data in photos), and what you create around them: workspaces, folders, comments, segments, tags, playlists, projects, boards, transcripts, lyrics, riders, stage plans, press kits, gigs, posts and public page content, and what you ask our AI features. Files you publish are published as they are, including the information inside them.
- Collaboration and activity — your connections, workspace memberships, invitations, follows, likes, chats and mentions, and what you recently played or opened (shown to you as Recents).
- People you invite — when you invite someone, we store their email address and send them an invitation.
- Sign-ins, devices and account activity — for each device you are signed in on: the device and browser or app name, when it was last used, and its IP address, so you can see and sign out your devices and we can secure your account. Your account activity (sign-ins and actions such as uploads and invitations) is recorded with its time, device and IP address and shown in your dashboard.
- Shared links — when someone opens a link you shared, we record the visit (IP address, browser, device, screen size, time zone, language, referring page, and their account if they are signed in) so you can see that it was opened.
- Notifications — if you allow push notifications, your browser's push subscription, and a record of each notification we send, including its text.
- Visits to public artist pages — a short-lived log used to keep the pages reliable and to prevent abuse: your IP address in shortened form (the last part removed), your account if you are signed in, the referring page, your browser, operating system, device type, screen size, time zone and language, and a device signature (a one-way hash of some of these characteristics). For aggregate statistics we derive an approximate country from your IP address and count visitors with a daily hash; we do not store your precise location.
- Rights declarations — when you publish a recording, what you declared about its rights (your own work, a licensed cover, or a cover with written permission), whose song a cover is, and who declared it when. We keep this with the file so we can show it to a rights holder who asks.
- Reports — when you report content through our report form (or the copyright page), your name, email address, the content you report, your explanation and, for a copyright notice, the rights holder you act for and the work concerned. We use this to handle the notice and may share it with the person who published the content, so that they can respond.
- Server logs — our servers keep technical logs, which can contain IP addresses, for security and troubleshooting.
Signing in with Google, Apple or GitHub
When you sign in with Google we receive your email address, your Google account ID and your profile picture (and, for Google Workspace accounts, your organisation's domain). On public pages, Google's “One Tap” sign-in is offered to visitors who are not signed in: this loads Google's sign-in script, which connects to Google. If you import files from Google Drive, we access only the files and folders you pick.
Dubload's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not transfer it to third parties except as needed to provide the service.
When you sign in with Apple (in the BandEdit apps) we receive an identifier for your Apple Account, the email address you choose to share and — the first time only — your name. If you use Apple's “Hide My Email”, we receive a private relay address that forwards to you. When you sign in with GitHub we receive your email address and your public GitHub profile. We use this data only to create and secure your account.
The BandEdit apps
The apps keep your sign-in on your device, in the system keychain or keyring. They talk to Dubload and to the services it uses: Cloudflare for your files and downloads, and Google or Apple when you sign in with them. They send what the app needs to work: the files you upload, your likes and organizing, and which item you play, for your Recents. On a computer with the BandEdit audio engine, the browser and the apps exchange what is playing directly on your own computer; this does not leave your device. The apps contain no advertising, analytics or crash-reporting tools.
How we use your data
- To provide the service: storing, streaming and processing your media.
- To enable collaboration you start: sharing within workspaces, invitations, mentions and notifications.
- To publish only what you explicitly publish: public artist pages, your public profile and the media you mark as public.
- To run the features you ask for, such as stem separation, transcription, video rendering, designing your page with AI and the editing assistant.
- To secure accounts, prevent abuse and keep the service reliable.
- To understand, in aggregate, how the website is used (see Cookies).
- To send you notifications and, occasionally, announcements about Dubload.
We do not sell your data and we do not show third-party advertising. Your uploads stay private to you and the workspace members you share them with, unless you publish them. Published media is served from a public address and stays reachable until you unpublish it or delete it permanently.
Our legal bases are: the agreement with you (to provide the service you signed up for); our legitimate interest (security, preventing abuse, improving the service, and announcements, which you can unsubscribe from); and your consent (analytics cookies and push notifications, which you can withdraw at any time).
AI and your content
AI features run only when you start them. We do not train AI models on your uploads, and the AI providers we use receive your content only to run the feature you asked for, under their business terms, which exclude using it to train their models. How we protect your files and your music overall is described on Your data, protected.
Who processes data for us
We use these service providers, each only for the purpose named:
- Leaseweb — the servers that run Dubload and store its database.
- Cloudflare — storage and delivery of uploaded and published files, speech-to-text for transcriptions you start, and the Turnstile check that tells people from bots on our public forms (it looks at your browser, never at what you type).
- RunPod — processing power for stem separation, song structure analysis and video rendering you start; it receives the files to process.
- Anthropic — the AI features you use: page design (your prompt and the page's name, description, design and text), the editing assistant (your request and your project's track and clip names) and Clean up with AI in your library (your request and the names, tags and dates of the files and folders concerned). No audio goes to Anthropic.
- Resend — sending our emails.
- Google — Sign in with Google and One Tap, Google Drive import, and Google Analytics (see Cookies).
- Apple and GitHub — signing in with them.
- Your browser's push service (such as Google, Mozilla or Apple) — delivering push notifications you allowed.
- Bunny Fonts and YouTube — public artist pages may load fonts from Bunny Fonts and show embedded YouTube videos (in privacy-enhanced mode); your browser then connects to these services.
- Université Côte d'Azur — the editor loads some of its audio plugins from the university's server, so your browser connects to it when you use them.
- MaxMind — a location database we use on our own servers; no data is sent to MaxMind.
International transfers
Some of these providers are based outside the European Economic Area, for example in the United States. Where data is transferred there, we rely on appropriate safeguards such as the EU–U.S. Data Privacy Framework, the European Commission's Standard Contractual Clauses, or an adequacy decision.
Retention
- Your account, profile and content are kept for as long as your account exists.
- Files and folders you delete go to the Trash, which is not emptied automatically. They are removed when you empty the Trash or delete them permanently; a published file you move to the Trash stays published until then.
- A device's sign-in record (with its IP address) is removed when you sign out of that device or remove it from your devices, and otherwise once that sign-in has ended.
- The IP address and device details in your account activity are removed after 90 days; the record of what happened stays.
- The log of visits to public artist pages is deleted after 30 days, aggregate statistics after 90 days.
- Records of push notifications are deleted after 30 days.
- Visit records of a shared link are kept as long as the share exists.
- Invitations, and a sign-up that was never activated, are kept until they are used or removed.
- Reports and copyright notices are deleted three years after they came in; until then we keep them to show how a report was dealt with.
- Server logs are rotated and overwritten as they grow.
Deleting your account
You can delete your account under Your Profile → Account on the website, in the BandEdit app, or by emailing us. Deleting it signs you out on every device at once and removes your name, email address, username, photo, date of birth, gender, country, city, password and Google or Apple link from your account. Your public profile page goes offline, and in member lists, comments and activity you are shown as “Unknown user”. Your name stays where others wrote it, such as in @mentions in their messages.
Workspaces that only you owned are closed, and the files they published go offline. Files, comments and posts you added to workspaces and pages you share with others stay available, shown as “Unknown user”, because they are part of their work. Artist pages you managed stay online until you or another member removes them; email us if you want one taken down. We keep a record of who the account belonged to, so that we can answer questions about it and restore it at your request.
If you want this record and your uploads erased as well, email privacy@bandedit.com and we will erase them within one month.
Cookies
We use functional cookies to keep you signed in, to keep live updates working and to remember interface preferences such as your theme. We use Google Analytics to understand, in aggregate, how the website is used: it sets analytics cookies only after you agree in the cookie banner; before that, Google receives only cookieless signals without identifiers (Google Consent Mode). Your dashboard and shared links are not measured. We remember your choice in a cookie for one year; to change it, remove that cookie in your browser and the banner asks again. Google's One Tap sign-in may set a cookie to remember whether you closed it. We do not use advertising cookies.
Emails
We send emails you need for your account (such as invitations and password resets) and notifications about activity in your workspaces. You choose which notifications you receive by email in your notification settings, and announcements contain an unsubscribe link.
Children
You must be at least 16 to use Dubload. It is not directed at children, and we do not knowingly collect data from anyone younger; if you believe a child has signed up, let us know and we will delete the account.
Your rights
You can see and correct your profile at any time in your account, and delete your account as described above. You also have the right to ask for a copy of your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format — email privacy@bandedit.com and we will answer within one month. You can also lodge a complaint with your data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens.
Terms of Service
Using Dubload is also governed by our Terms of Service, which explain what you may upload and publish and how we handle copyright notices.
Changes
When our data practices change, we update this policy and the date at the top. For significant changes we let you know by email or in the app.
Contact
Questions about this policy or your data? Contact us at privacy@bandedit.com.
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.