Privacy Policy

What we collect and why

We process account email, internal user ID, authentication/session information, project names, uploaded media, audio metadata, clip boundaries, order, fades, volume, exported mixes, saving timestamps, audio-rights confirmations and Terms acceptance records to provide the service you request. Optional sign-in providers may supply an existing display name; QuickMix does not require your name, address, telephone, date of birth, gender or location.

Uploaded audio or video may contain voices, names, conversations and other personal information. Treat it as private personal content and upload only content you are entitled to use.

Purposes and legal bases

• Account creation, authentication, private projects, audio editing and exports: performance of the service contract.
• Essential security, unauthorised-access prevention and abuse investigation: legitimate interests where appropriate, subject to balancing individual rights.
• Responding to statutory privacy rights and valid legal obligations: legal obligation where applicable.
• Copyright/support administration: legitimate interests or applicable legal obligations depending on the request.
• Optional analytics requiring consent: only with valid consent; optional QuickMix analytics is currently disabled.

Privacy acknowledgment and audio-rights confirmation are not consent to marketing or unrelated processing. No newsletter signup, promotional email subscription or behavioural advertising is implemented.

Commercial account settings

QuickMix records account plan entitlements and administrator-granted complimentary access, including the affected account ID, limits, optional expiry and an internal reason. These settings provide and administer your requested access; internal administrator notes are not published or included in your self-service export. Paid billing and AI Credit purchases are not enabled in this version, and QuickMix does not collect card details.

Private content and local processing

Projects are owner-restricted and have no public sharing, public profile or public audio page. Files are encrypted in the browser before private storage upload; the decryption key is stored in the protected project. Authorized operational access to stored keys may be possible, so this is not end-to-end encryption against the operator. Temporary signed links grant access to encrypted stored files and may remain usable until expiry; decrypted playback/download links stay in your browser.

Audio Mix continues to decode, cut, fade, mix and export on your device without AI analysis. Reel Mix uses optional AI processing only when you explicitly choose Auto Create or Remix, as described below. QuickMix does not profile your musical choices, use your files for advertising or import external music URLs.

Reel Mix Auto Create and AI processing

When you choose Auto Create, your browser decrypts only the sources needed to prepare low-resolution analysis images. For photos it normally uses the existing thumbnail; for videos it samples up to three representative frames with source timestamps. JPEG derivatives are limited to a 512-pixel longest edge and stored privately, separately from the encrypted originals. They are not public files and are not protected by the original project encryption key. Up to 32 derivatives per request are shared with Base44’s built-in AI integration through signed access links requested to expire after five minutes. The AI receives your optional brief, style, duration, source dimensions and timestamps, and the selected music’s timing and volume settings. Original full-resolution video, photos and audio are not sent to the model. Music is not acoustically analysed and edits are not claimed to be beat-synchronised.

The AI first describes the supplied visuals, then plans a sequence using those observations. Remix normally reuses saved observations and sends the current edit and your requested change, rather than resending all images. Analysis derivatives and observations are retained with the project for reuse; removing media or deleting the project queues its derivative references through the existing provider-cleanup process. Physical file erasure remains subject to the limitations described below. Private signed URLs cannot revoke copies already retrieved by a processor.

QuickMix requests AI processing only to provide the edit you asked for, not for unrelated training, advertising or identity recognition. The integration uses automatic model routing; the underlying AI provider can vary. The operator must verify and document the applicable AI processors, their retention and training terms, international-transfer safeguards and processor agreements before public launch of AI processing. No zero-retention, no-provider-training or EEA-only AI processing guarantee is made without that verification. Do not include sensitive personal information in your brief or media.

Recipients, processors and international processing

Base44 provides hosting, accounts, authentication, database and private storage, and handles infrastructure requests and logs. If you use an external identity provider, that provider also handles your sign-in under its own terms. When needed, your browser downloads the FFmpeg engine from jsDelivr; the application does not upload your audio to that CDN. Authorized administrators can handle privacy/copyright requests. Information may also be disclosed where a valid legal obligation requires it.

Base44 documents storage of uploaded media in the United States, regardless of the database residency setting. EEA-only hosting is not claimed. The operator has not yet published confirmation of this app’s database region. The operator has not yet published the applicable international transfer safeguards; these require review of the actual processor agreement.

Retention and deletion

Active project content is kept to provide your saved workspace. Deleting a project removes its metadata and encryption key from the active service. Account deletion removes your profile, projects, account metadata, Terms records and application privacy requests, and queues associated media references for provider cleanup. Encrypted blobs are not physically erased by this version’s deletion action; a verified processor erasure path is still outstanding. Removing a key is not a claim that all stored personal data has been erased, and existing downloads or cached keys cannot be recalled.

Temporary conversion input/output files are removed from the browser’s audio engine after processing, and temporary playback URLs are released when no longer needed. Files on your device remain under your control. Deletion-reference records remain necessary until processor erasure is verified; verified queue entries have their storage references cleared.

Backups: the actual provider backup retention has not yet been confirmed and published. Security logs: the actual justified infrastructure log retention has not yet been confirmed and published. Privacy and copyright requests: a justified operator retention period and purge procedure still require review. Where records are required for a legal purpose, retention must be limited to that purpose and necessary period; backups must not reintroduce deleted data into normal service.

Cookies, browser storage and analytics

Authentication/session storage is used to keep you signed in and protect access. QuickMix optional custom-event collection and SDK analytics are disabled, and no app advertising pixels or marketing trackers are installed. Essential hosting/authentication events may still be processed by the platform. The operator must verify the actual published-domain cookie/storage inventory and platform settings; no unverified cookie names or consent claims are made here. If optional tracking is introduced, it must stay off until required consent, with equally easy acceptance, rejection and withdrawal.

Your privacy rights

Subject to applicable law, you can request access, correction, deletion, restriction, portability and objection where the processing basis permits it. If consent is used in future, you can withdraw it without affecting the lawfulness of earlier processing. Withdrawal does not replace ending a service contract for necessary account processing.

Account → Privacy & Data offers a machine-readable account/project metadata export, account deletion and a private request form. Large media is not duplicated in the metadata export. The original files remain on your device and saved exports are downloadable in the app; contact the operator for additional access needs, secure email correction or requests the self-service options cannot complete. Internal administrator notes and encryption keys are not included in the self-service file.

Contact the controller at hei@sondesign.no. We may need proportionate identity verification to protect your data, not unnecessary personal information.

Complaints and policy changes

EEA users have the right to complain to their competent Data Protection Authority without losing other legal rights. For a Norwegian Data Controller this would normally include Datatilsynet; the operator’s country is not assumed. Policy versions and confirmed last-updated dates appear above. Material Terms changes can require renewed acceptance; ordinary Privacy Policy wording updates are not treated as fresh consent to unrelated processing.