Last updated: August 25, 2026
This Privacy Policy explains how Sunrise Software Oy ("we", "us", "our", "Company") collects, uses, and protects your personal data when you use MasterForge services. We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and Finnish data protection laws.
The data controller responsible for your personal data is:
Sunrise Software Oy
Business ID: 3588983-1
Finland
Email: info@masterforge.app
| Data Type | When Collected | Purpose |
|---|---|---|
| Email address | Account registration | Account management, communications |
| Name | Account registration (optional) | Personalization |
| Payment information | Subscription purchase | Payment processing (via Stripe) |
| Support inquiries | When you contact us | Customer support |
| Audio files | Only when you start a server-based job (Pro Analysis, Preparation, Auto-Master, the managed mastering service or the API) | Producing the analysis, restoration or master you asked for |
Audio files are covered in detail in section 2.5, because how we handle them depends entirely on which tool you use.
| Data Type | Purpose | Legal Basis |
|---|---|---|
| IP address | Security, fraud prevention | Legitimate interest |
| Browser type/version | Service optimization | Legitimate interest |
| Device information | Service compatibility | Legitimate interest |
| Usage statistics | Service improvement | Legitimate interest |
| Campaign tag from an advertisement link | Knowing which advertisement brought you here | Legitimate interest |
Service Usage Verification: We collect limited usage data when you use our mastering tools. This data is necessary for service verification and refund processing in accordance with EU Consumer Rights Directive.
| Data Type | Purpose | Retention Period |
|---|---|---|
| Mastering action type (upload, process, download) | Service usage verification for refund eligibility | 90 days |
| Preset name selected | Service quality and improvement | 90 days |
| File name (metadata only) | User reference, support inquiries | 90 days |
| File size | Service optimization, abuse prevention | 90 days |
| Timestamp | Audit trail, support | 90 days |
Note: These logs describe the browser-based mastering tools. They record that a master was made, not what it sounded like: the file name is metadata only and no audio content is stored.
This data is collected under GDPR Article 6(1)(b) (contract performance) as it is necessary to verify service usage for refund eligibility under EU consumer protection laws. After 90 days, this data is automatically deleted.
We do not collect special categories of personal data, we do not track you across other websites, and we do not sell or rent personal data to anyone. We do not use your audio to train machine learning models or to improve our algorithms.
Whether we ever receive your audio depends on which tool you use, so we describe both cases separately.
Browser-based tools: we never receive your audio. The free mastering tools, the analysis tools and Pro Master run entirely on your own device. The audio file is not uploaded, and we cannot access, store or listen to it. This has always been true of these tools and remains true.
Server-based services: we do receive your audio. Pro Analysis, Preparation, Auto-Master, the managed mastering service and the API cannot work in your browser, so you upload the file to us and we process it on our own hardware.
| What happens | Where | Retention |
|---|---|---|
| Managed mastering service: your uploaded track and the delivered master | Cloudflare R2, EU region | Deleted automatically 7 days after your download window closes |
| Pro Analysis, Preparation, Auto-Master and the API: your uploaded file and the processed result | Cloudflare R2, EU region | The audio is deleted automatically 90 days after the run finishes. The analysis itself, meaning the measurements and the plan produced from them, is kept with your order history so that you can return to a past result. You can also ask us to delete the audio earlier and we will act on it. |
| The audio is analysed and processed | Our own server in Helsinki, Finland (Hetzner) | Working copies are deleted when the job ends |
| Numerical measurements taken from the audio are sent to an AI model to produce a mastering plan. The audio itself is never sent. | Anthropic, United States | Governed by Anthropic's own retention terms |
| For the managed mastering service, a person listens to and masters your track | Our staff, Finland | Access ends when the order is delivered and the revision window closes |
The legal basis for all of this is GDPR Article 6(1)(b), performance of the contract: you asked us to process a specific file and we cannot do it without receiving that file. Nothing is uploaded unless you start a server-based job yourself.
We process your personal data based on the following legal grounds:
We use your personal data to:
We share data with trusted third-party service providers who assist in operating our Services:
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare | Website hosting, CDN, security, and storage of files you upload to server-based services (R2) | EU region for stored files; CDN is global |
| Supabase | Database and sign-in. Holds your account record, email address, orders and credit history. | EU (Frankfurt, Germany) |
| Hetzner | The server that runs our analysis, restoration and mastering processing | EU (Helsinki, Finland) |
| Stripe | Payment processing | USA (EU-US Data Privacy Framework) |
| Anthropic | The Claude AI model, which turns measurements of your audio into a mastering plan. It receives numbers describing the audio, never the audio file and never your name or email address. | USA |
| Resend | Sending email: sign-in messages, order notifications and, if you have subscribed to it, our newsletter | USA / EU |
Most of your data stays in the EU. Your account record is in Germany, and audio submitted to our server-based services is processed in Finland and stored in Cloudflare's EU region.
Three providers involve a transfer outside the EU/EEA:
For these transfers we rely on the safeguards permitted by GDPR Chapter V:
We retain your personal data only as long as necessary:
| Data Type | Retention Period |
|---|---|
| Account data | Duration of the account. When you delete it, your email address and name are overwritten immediately and sign-in is closed permanently. |
| Payment and order records | 6 years (Finnish accounting law). After account deletion these are kept without your name or email attached. |
| Audio you uploaded to a server-based service | See section 2.5 |
| Mastering usage logs | 90 days |
| Support communications | 2 years after resolution |
| Analytics data | 26 months (anonymized after) |
What deleting your account actually does. We do not erase the rows that record payments, because Finnish accounting law requires us to keep them for six years. Instead we remove the person from them: your email address and name are overwritten, your sign-in is permanently closed, your API keys stop working, tracks you published to our showcase are removed, and any remaining credits are forfeited. What is left is a record that a transaction happened, with nobody's name on it.
As a data subject, you have the following rights:
You can request a copy of all personal data we hold about you.
You can request correction of inaccurate personal data.
You can request deletion of your personal data ("right to be forgotten"). You do not have to ask us: you can delete your account yourself at any time from your account page, and it takes effect immediately. Section 6 explains exactly what is removed and what is kept for accounting purposes.
If you want files you uploaded to a server-based service deleted without closing your whole account, contact us and we will remove them.
You can request limitation of how we process your data.
You can request your data in a machine-readable format.
You can object to processing based on legitimate interests.
Where processing is based on consent, you can withdraw it at any time.
To exercise your rights: Contact us at info@masterforge.app. We will respond within 30 days. You may also lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).
We use cookies and similar technologies to:
You can manage cookie preferences in your browser settings. Disabling essential cookies may affect functionality.
We implement appropriate technical and organizational measures to protect your data:
Our Services are not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the Services. The "Last updated" date at the top indicates when the policy was last revised.
For privacy-related questions or to exercise your rights:
Sunrise Software Oy
Email: info@masterforge.app
Finland
Supervisory Authority:
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
Website: tietosuoja.fi