DJLynux Privacy Policy

Who We Are

DJLynux is an AI-powered audio mastering service, currently in beta. Operated by S Hutton, Singapore.

Contact: Contact form

Singapore ACRA business registration is in progress. This policy will be updated with our registered UEN once complete.

What Data We Collect

• Email address — required to create an account and sign in.
• Display name (optional) — a public-facing name you choose. Shown on blog comments. If you do not set one, your comment shows as "Anonymous".
• Profile avatar (optional) — a photo or image you upload. Displayed on blog comments and your writer profile (if you are a writer). Stored in a publicly accessible CDN.
• Audio files you upload (MP3, WAV, FLAC) — processed to deliver the mastering output.
• Blog comments — text you submit on blog articles. Approved comments are publicly visible.
• Usage data — upload timestamps, genre selection, mastering job logs.
• Support tickets — name, email, and message content you submit via the contact or support form, whether or not you have an account.
• Technical data — IP address, browser type, collected automatically by our infrastructure.

What We Do With It

• Deliver the mastering service to you.
• Display your display name and avatar on blog comments you post and on your writer profile.
• Send you service-related emails (e.g. job completion notices, account alerts).
• Respond to support requests.
• Improve the service using aggregated, non-identifiable usage patterns.
• Improve our support and mastering systems using de-identified support ticket content from resolved accounts (see "How Long We Keep Your Data" below). This never includes your audio files, and never includes ticket content from a submission that was never tied to a signed-in account.

What We Never Do

• Your audio files are never used to train any AI model.
• Your files and personal data are never sold or shared with third parties beyond the sub-processors listed below.
• We do not send marketing emails without your explicit consent.
• We never use contact-form or support-ticket content from a submission that was never tied to a signed-in account for anything beyond resolving that request.

AI-Authored Content

Some articles on our blog are drafted by AI agents and reviewed by human editors before publication. AI-drafted articles are clearly attributed. The factual content in all published articles is reviewed by a human before being made public.

Display Names and Avatars

Your display name and avatar are publicly visible on any blog comments you post. If you are a writer, they are also shown on your author byline on published articles. You may update or remove your display name and avatar at any time from your Account settings.

Blog Comments

When you submit a blog comment:

• It is held for moderation and only published after admin approval.
• Once approved, your comment (with your display name and avatar) is publicly visible.
• If you delete your account, your comments are anonymised — the comment body is replaced with "[deleted]" and your name and avatar are removed. The comment structure is preserved to keep discussion threads coherent.

Third-party Service Providers

We work with third-party service providers to operate DJLynux. These providers only receive the data necessary to perform their specific function and are contractually bound to handle your data in accordance with applicable law.

• Cloud database, authentication, and file storage providers — store your uploaded tracks, mastered tracks, and profile avatars. Avatar and blog images are stored in a public CDN bucket (publicly accessible by URL).
• Cloud compute and hosting providers — run the audio mastering pipeline and host the website you are using now.
• AI processing providers — audio metadata (e.g. BPM, LUFS, spectral features) is sent to generate mastering decisions. Your audio file itself is never sent to any AI service.
• LemonSqueezy (Link, LLC) — payment processing. LemonSqueezy acts as Merchant of Record for all credit pack purchases. They process your card details directly under their own PCI-DSS compliance programme. DJLynux never receives or stores your card number or CVV. LemonSqueezy retains transaction records as required by applicable financial regulations (typically 7–10 years depending on jurisdiction). To request your LemonSqueezy payment records, contact them directly at lemonsqueezy.com/privacy.
• Transactional email delivery providers — magic links, job completion notices, support replies.

Some providers are located outside Singapore. Where data is transferred internationally, we rely on contractual safeguards to ensure your data receives a comparable level of protection to that required under Singapore law. A full list of sub-processors is available on request — contact us.

How Long We Keep Your Data

Support tickets, specifically:

• If you have an account, your support tickets are retained for as long as your account is active — there is no fixed deletion date while you remain a customer.
• If you delete your account, your tickets are not deleted outright: the link to your identity is removed (de-identified) and the de-identified content may be retained to improve our support and mastering systems, including for training purposes. If you would prefer your tickets be deleted outright instead of de-identified and retained, contact us before deleting your account.
• If you contact us without an account (contact form) or via a support-ticket email reply without ever signing in, that submission is retained for 90 days and then permanently deleted if it is never linked to an account you sign in to. This content is never used for training.

Everything else, on account deletion:

Other data outside of account deletion:

• Account data — retained while your account is active.
• Contact-form / non-account support submissions — retained 90 days, then deleted, unless linked to an account you sign into within that window (see above).
• Technical data — IP addresses and server logs (including sign-in records) are retained for up to 90 days for security and debugging purposes, then deleted.
• Unconfirmed sign-ups — if a sign-in link is requested but never used, the unused account (which holds only the email address) is deleted after 7 days. You can sign up again at any time.
• Account deletion records — when an account is deleted, we keep a short internal record of the email address, the date, and how the account was closed, for 30 days, then erase it. This is used only for security (detecting abuse such as repeated sign-ups) and to confirm deletions happened. Accounts closed because they did not meet the age requirement in our Terms of Service are not recorded this way.

Self-Service Account Deletion

You can permanently delete your account at any time from your Account settings. The deletion is immediate for your audio files and personal data. Support ticket content is de-identified and retained as described above unless you contact us first to request outright deletion instead. You will receive a confirmation email once deletion is complete.

If you prefer, you can also contact us to request deletion on your behalf.

Cookies

During beta, we use only essential cookies required to keep you signed in (Supabase session tokens). No third-party analytics or advertising cookies are used.

Data Breach Notification

In the event of a personal data breach that is likely to result in significant harm, we will notify the Personal Data Protection Commission (PDPC) within 3 calendar days of becoming aware of the breach, and affected individuals within 30 calendar days, as required under the Singapore Personal Data Protection Act 2012 (as amended).

Your Rights — Singapore (PDPA)

Under the Singapore Personal Data Protection Act, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of any inaccurate data.
• Request deletion of your account and associated data (see Self-Service Account Deletion above).
• Withdraw consent to any non-essential processing, including the use of your de-identified support ticket content for service improvement — contact us to opt out.

To exercise any of these rights, contact us. We will respond within 30 days.

Your Rights — European Union (GDPR)

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal basis — we process your data on the basis of contract performance (to deliver the mastering service) and legitimate interests (to improve the service, train our systems on de-identified support content, and prevent abuse). Display names and avatars are processed on the basis of consent — you choose to set them and can remove them at any time.
• Data portability — you may request a copy of your personal data in a machine-readable format. Use the Download your data feature on your Account page for an instant JSON export.
• Right to erasure — you may request deletion of your personal data. Note that anonymised blog comment bodies ("[deleted]") and de-identified support ticket content do not constitute personal data once de-identified, and are retained for service-improvement purposes as described above unless you request outright deletion instead. LemonSqueezy payment records are retained by LemonSqueezy under their own legal obligations.
• Right to object — you may object to processing based on legitimate interests, including the use of your support ticket content for service/model improvement — contact us.
• Right to restrict processing — you may request that we limit how we use your data while a complaint is being resolved.
• Supervisory authority — you have the right to lodge a complaint with your local data protection authority if you believe your rights have been infringed.

To exercise any GDPR rights, contact us. We will respond within 30 days.

Changes to This Policy

We may update this policy as the service evolves. We will notify you by email of any material changes before they take effect, and you will be asked to review and accept the updated policy when you next sign in.