Privacy Policy

1. Data Controller

The data controller is an individual residing in Switzerland, reachable at: [email protected]

2. Categories of Data Collected

2.1 Registration and authentication data

• Email address (provided by the user at sign-up)
• Password (stored in hashed form, never in plain text)

2.2 Audio files

Audio files uploaded by the user for frequency verification and pitch conversion to 432 Hz. Rephase processes files exclusively in a technical manner (spectral analysis and frequency transposition) and does not analyse their artistic content or verify rights ownership. Responsibility for the legality of uploaded files rests exclusively with the user.

Audio files are automatically deleted from the servers within 60 (sixty) seconds of the completion of processing. Deletion is carried out by a certified automated process on the server side. No copy is retained on disk, in persistent memory, or in backups. Files are never transmitted to third parties or used for any purpose other than the processing requested by the user. As confirmation of deletion, the system records an anonymous log containing only the deletion timestamp and an anonymous technical file identifier (UUID), with no reference to the audio content or the user's identity.

2.3 Payment data

Payments are handled by Stripe Inc. Rephase does not collect or store credit card data. Stripe may process data under its own privacy policy: stripe.com/privacy

2.4 Referral program data

• Referral code assigned to the user
• Number of sign-ups generated via the referral code

3. Purposes of Processing

• Providing the 432 Hz audio conversion service
• User account management and authentication
• Payment processing and subscription management
• Referral program management
• Sending transactional communications (e.g. registration confirmation, payment receipt)
• Compliance with legal obligations

4. Legal Basis

• Art. 6(1)(b) GDPR — performance of a contract
• Art. 6(1)(c) GDPR — legal obligations
• Art. 6(1)(f) GDPR — legitimate interest (service security)

For users residing in Switzerland, the Swiss Federal Act on Data Protection (nFADP, in force since 1 September 2023) also applies.

5. Retention Periods

• Audio files: automatically deleted within 60 seconds of the completion of processing via a certified server-side process. An anonymous deletion log (timestamp + technical UUID, no personal data) is retained for 30 days for internal technical verification purposes only.
• Account data: retained for the duration of the contractual relationship and for 3 additional years after account deletion.
• Payment data (Stripe): subject to Stripe's own retention policy.

6. Data Transfers

Personal data is processed on servers located in the European Union (Infomaniak, Geneva, Switzerland). Stripe Inc. is based in the United States; data transfers are governed by Standard Contractual Clauses approved by the European Commission.

7. User Rights

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure ("right to be forgotten", Art. 17 GDPR)
• Right to object or restrict processing (Arts. 18-21 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to lodge a complaint with the competent supervisory authority

To exercise your rights: [email protected]

8. Cookies and Tracking Technologies

Rephase uses only strictly necessary technical cookies required for the service to function. No profiling or third-party advertising cookies are used.

9. Changes to This Policy

The data controller reserves the right to update this policy. In case of material changes, users will be notified by email or in-app notice at least 15 days in advance.

10. Contact

For any privacy-related request: [email protected]

11. Users Outside the EU and Switzerland

Users residing outside Switzerland and the European Union access the service at their own responsibility and are solely responsible for verifying compliance with the data protection laws applicable in their country of residence.