Privacy Policy

1. Data Controller

The data controller is Individual Entrepreneur Karine Balasanyan (the "Operator").

TIN: 20019859
State registration number: 85.1495998
Registered address: Kotayk Province, Hrazdan, Kentron, Bldg. 88, Apt. 44, 2301, Republic of Armenia
Data/privacy requests: privacy@aurixmusic.ru
General support: support@aurixmusic.ru
Website: https://aurixmusic.ai

2. Personal data we collect

We process the data you provide when you register and use the Service, and data generated automatically.

• Registration data: email address and password stored only as a bcrypt hash.
• Profile data: name, stage name, phone number, city, gender, biography, profile photo.
• Subscription and payment data: plan type, billing period, subscription status, and the transaction identifier from the payment provider. Payments are processed by our authorized Merchant of Record reseller (named at checkout) acting as Merchant of Record. We never receive or store your full card details.
• Content and working data: music releases (tracks, cover art, metadata), activity history, AI analysis results, artist-profiling data.
• AI tool data: the text of your requests to the AI assistant, generated recommendations, and conversation history.
• Technical data: IP address, browser/device type and version, app version, operating system, error logs, date and time of requests.
• Cookies and analytics: session data, JWT token identifier, analytics events (where you have consented).

3. Legal bases for processing

We rely on the following legal bases under Article 6 GDPR and the equivalent provisions of Armenian law:

• Performance of a contract: creating your account, providing access to features, and managing your subscription.
• Legitimate interests: keeping the Service secure, preventing fraud, diagnosing technical issues, and improving the Service.
• Your consent: optional marketing messages, analytics, and non-essential cookies. You may withdraw consent at any time.
• Legal obligation: retaining records required by accounting and tax law and responding to lawful requests from authorities.

4. Sharing data with third parties

To operate the Service, the Operator engages the following categories of processors:

• Hosting and server infrastructure for the backend and database.
• Cloud storage: S3-compatible storage for music files and cover art.
• Email provider: an SMTP service for transactional email (email verification, password reset, release notifications).
• AI provider: for generative features (AI assistant, track analysis, recommendations). Data is sent in a de-identified context.
• Payment provider: our authorized Merchant of Record reseller (named at checkout), acting as Merchant of Record, processes payments and applicable taxes. The Operator never receives or stores full card data.
• CDN and protection services: to speed up content delivery and protect against attacks.

5. International data transfers

Some processors may handle data outside the Republic of Armenia and the EEA. In such cases the Operator ensures an adequate level of protection through appropriate safeguards, including standard contractual clauses and an assessment of protection in the recipient country.

6. Data retention

Personal data is kept no longer than necessary for the stated purposes:

• Account and profile data: until you or the Operator delete the account.
• Content (tracks, cover art, videos): until account deletion or until you delete the content yourself.
• Payment and transaction records: retained by our authorized Merchant of Record reseller (named at checkout) and by the Operator as required by applicable tax and accounting law.
• AI conversation data: until account deletion or your request.
• Security and anti-fraud logs: up to 12 months.

7. Your rights

Under the GDPR and Armenian data-protection law you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten"), subject to legal retention.
• Restrict or object to certain processing.
• Data portability: receive your data in a machine-readable format.
• Withdraw consent at any time, without affecting processing already carried out.
• Lodge a complaint with a supervisory authority.

8. Account and data deletion

You may request full deletion of your account and associated personal data. The list of deleted data and the timelines are described on the "Account & Data Deletion" page.

9. Security measures

The Operator applies appropriate legal, organizational, and technical measures to protect personal data:

• Password hashing (bcrypt) and HTTPS for all connections.
• JWT authentication with short-lived access tokens and separate refresh tokens.
• CORS restrictions limiting access to approved domains.
• Validation and sanitization of all input.
• Regular dependency updates and vulnerability remediation.
• Rate limiting to prevent abuse and brute-force attempts.

10. Children

The Service is not intended for persons under 16. We do not knowingly collect data from children. If you believe a child has provided us with data, contact us so we can delete it.

11. Changes to this Policy

The Operator may update this Policy. The current version is always available at https://aurixmusic.ai/legal/en/privacy.html For material changes we will notify you in the Service or by email. Continued use of the Service after changes are published means you accept the updated Policy.