What happens to a song after you send it to the Songbrain API, who helps us process it, and how we protect it. In plain words; the binding versions are the Privacy Policy (§3.6), the Terms (§17) and the Data Processing Addendum.
The uploaded file is gone a day after the analysis.
API audio trains no model, ours or anyone else's.
No leaderboard, no playlists, no charts, no data brokers.
API, workers and storage run on Hetzner servers in the EU.
| What | How long | Notes |
|---|---|---|
| Uploaded audio file | Deleted within 24 hours | Used only to produce the analysis. |
| Compressed audio preview | 30 days | Deleted earlier with DELETE /v1/songs/{id}. |
| Analysis result | Until you delete it | DELETE /v1/songs/{id} removes audio and analysis at once. Closing the account deletes everything. |
| API keys | Until revoked | Stored only as SHA-256 hashes. We can't read your key. |
| Usage records | While the account exists | Which song, which key, when, free or paid, webhook status. Billing records as long as the law requires. |
| IP address | Not stored | Held in memory only, for rate limiting. |
| Test-mode songs | Nothing to keep | "test": true sends no audio through the pipeline and returns example data. |
Results you have fetched are yours to keep (Terms §17.4). Deleting a song at Songbrain does not reach into your systems.
Songbrain-Request-Id, so a single request can be found in our logs when you report a problem.Current availability and incidents: songbrain.ai/status.
These companies process data for API songs on our behalf. We tell key owners by email at least 30 days before we add or replace one.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the API, the analysis workers and storage | Audio, analysis results | Germany (EU) |
| Cloudflare, Inc. | Proxy, TLS and DDoS protection in front of the API | Request metadata, data in transit | Global edge |
| Google LLC (Gemini API) | Audio understanding: genre, instruments, description, story | Audio, lyrics | USA / global |
| Groq, Inc. | Lyrics transcription (Whisper) | Audio | USA |
| Anthropic PBC (Claude API) | Text enhancement of the analysis | Lyrics and analysis text (no audio) | USA |
| Supabase, Inc. | Accounts and sign-in | Email address, account id | EU region |
| Polar Software, Inc. | Payments, as merchant of record | Billing details | USA / EU |
| Resend, Inc. | Transactional email (for example the low-balance notice) | Email address | USA |
| Vercel, Inc. | Hosting of the website and the developer console | Request metadata | Global edge |
Transfers outside Switzerland and the EU/EEA are covered by the EU Standard Contractual Clauses (with the Swiss annex) or the EU-U.S. and Swiss-U.S. Data Privacy Framework where the provider is certified. Details per provider are in Privacy Policy §5. Polar acts as merchant of record and processes payment data as its own controller.
If you send audio or data of your own users, you are the controller and we process it for you. Our Data Processing Addendum (GDPR Art. 28 and Swiss FADP) covers that. It applies automatically to API use, as part of the Terms, so there is nothing to sign. A countersigned PDF is available on request.
Found a vulnerability? Email support@songbrain.aiwith the subject "Security", the steps to reproduce and, if you have it, a request id. We aim to answer within 3 working days and keep you posted until it is fixed. Please test only against your own account, don't access other people's data, don't degrade the service, and give us a reasonable time to fix before you publish. We won't take legal action against research done in good faith under these rules.
Security and data-protection questions: support@songbrain.ai. Formal data-protection requests can also go to the controller contact named in the Privacy Policy.