Privacy Policy

Thank you for choosing backingtrack.store. We are a platform for hobby and working musicians to practise and perform with backing tracks, instrument separation (stems), synced chord charts and band collaboration tools. To provide that service, we need to process some of your personal data. Your privacy matters to us, and this Privacy Policy ("Policy") explains transparently what data we collect, why we collect it, who we share it with, how long we keep it and what rights you have over it.

This Policy follows the principles and obligations of the Lei Geral de Proteção de Dados (Law 13.709/2018 — LGPD), the Brazilian statute governing the processing of personal data.

1. About this Policy

This Policy applies to all services offered at backingtrack.store and associated services ("Service"). The conditions for using the Service are set out in our Terms of Use, a document complementary to this Policy.

If we launch new features or services that significantly change how we process your personal data, we will update this Policy and let you know before or at the time of the change. The purpose of this Policy is: to explain what personal data we collect, why we collect it and who we share it with; to explain how we use the data you entrust to us to provide a good experience on the Service; and to explain your rights and choices regarding the personal data we process, and how we protect it.

If you do not agree with this Policy, please do not use the Service. Questions can be sent to the contact channel in Section 14.

2. Your rights as a data subject (LGPD, art. 18)

As a data subject, you have the following rights under art. 18 of the LGPD:

• Confirmation and access — to confirm whether we process your personal data and to access it;
• Correction — to request correction of incomplete, inaccurate or out-of-date data;
• Anonymisation, blocking or deletion — of unnecessary or excessive data, or data processed unlawfully;
• Portability — to request portability of your data to another service provider, on express request;
• Deletion — to request deletion of personal data processed on the basis of your consent, subject to the retention grounds provided by law (Section 8);
• Information about sharing — to obtain information about which public or private entities we share your data with;
• Information about the possibility of withholding consent and the consequences of doing so;
• Withdrawal of consent — to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• Review of automated decisions — to request review of decisions taken solely on the basis of automated processing that affect your interests.

To exercise any of these rights, use the channel in Section 13. If, after contacting us, you believe your request was not handled properly, you also have the right to petition the Autoridade Nacional de Proteção de Dados (ANPD), Brazil's data protection authority.

3. Personal data we collect

3.1 Registration data

When you create an account we collect: name, email, password (stored encrypted, never in plain text) or, if you choose to sign in with your Google account, the basic profile data provided by Google (name, email, photo) with your explicit authorisation at sign-in.

3.2 Usage data

We collect data about how you use the Service, including: songs searched and played, stems enabled/disabled during practice, A-B loop use, speed and transposition applied, setlists created, comments posted on chord charts, playback history, and interactions with the community and with support.

3.3 Content you upload (audio uploads and recordings)

If you use personal upload features, we collect and process the audio file you upload for instrument separation (stems), through our processing pipeline (running on on-demand GPU infrastructure).

If you use the own-recording feature ("takes"/overdub), we collect the audio recorded by your microphone through the browser. Those recordings are linked to your account and have visibility you control: private (default), shared with your band, or public if you choose.

3.4 Band and collaboration data

If you take part in a band inside the Service, we process data about your role in the band (leader/member), shared setlists, chord corrections submitted for community validation, and invites sent and received.

3.5 Payment data

If you subscribe to a paid plan, billing data (name, tax ID where required, payment method details) is collected and processed directly by our payment partner (currently Asaas). We do not store full credit card numbers on our own systems. We keep only the history of subscription and transaction status (date, amount, plan).

3.6 Technical data and cookies

We automatically collect: IP address, browser type and version, operating system, device identifiers, cookie data and similar technologies, and Service performance/error information. We use this information to make the Service work, keep your session authenticated, prevent fraud and, on the free plan, display advertising (Section 10). See more detail in our Cookie Policy.

4. What we use your data for, and the legal basis

5. Sharing personal data

We do not sell your personal data. We share personal data only in the following situations:

With other users, inside the Service:

• If you take part in a band, your name/role and what you share with the band (setlists, chord corrections) are visible to the other members.
• If you choose to make a recording/take public, it becomes visible to other users.
• The catalog of processed songs (stems + chord chart) is shared between users on paid plans, as detailed in Section 6 — this does not involve sharing your personal data, only the processed musical content.

With service providers acting on our behalf (each processing data only to perform its specific function):

With authorities and third parties, where required:

• Public authorities, under a court order or valid legal request.
• Copyright holders, in the context of the notice-and-takedown policy (Section 6).
• A potential buyer of the business, in the event of a merger, acquisition or asset sale — in that case you will be notified before your data is transferred.

6. Shared catalog and copyright notice-and-takedown policy

Unlike a wholly owned music catalog, backingtrack.store works largely from audio uploaded by users themselves for instrument separation. The processed result (stems and chord chart) of a given song may become available to other users on paid plans, as a way of avoiding duplicate reprocessing and allowing community-validated chord charts.

If the holder of the copyright in a composition or sound recording notifies backingtrack.store requesting removal of a song from the catalog, we may make that song unavailable to all users who rely on it, even if you were not the one who originally uploaded it. In that case the file is not deleted — it is blocked, with a message stating it is unavailable at the request of the copyright holder — and it may become accessible again if the notice is successfully contested through the counter-notice channel.

By using the Service, and especially by subscribing to a paid plan with access to the shared catalog, you expressly agree to this condition, including the possibility of temporary or permanent unavailability of specific songs for that reason, without this amounting to a failure of the contracted service.

If you are a copyright holder and wish to request removal of content, or you are a user and wish to contest a removal, get in touch through the channel in Section 13, with proof of ownership of the right (registration, publishing contract, or representation by a publisher/label).

7. International data transfers

Some of the service providers listed in Section 5 (hosting, database, storage, separation processing) may store or process data on servers located outside Brazil. In those cases we seek to ensure the transfer is to countries or bodies providing an adequate level of personal data protection, or is made under mechanisms provided for in the LGPD (art. 33), such as specific contractual clauses with suppliers.

8. Data retention and deletion

We keep your personal data while your account is active and for as long as necessary to fulfil the purposes described in this Policy, including applicable legal, tax and accounting obligations.

If you request deletion of your account, your registration data and personal content will be removed or anonymised within a reasonable period, subject to the grounds in art. 16 of the LGPD (compliance with a legal obligation, exclusive use by the controller where anonymised, transfer to a third party with your consent, or exclusive use for legitimate purposes such as fraud prevention). Audio files blocked following a copyright notice (Section 6) are kept for a set period, long enough to allow a counter-notice, before permanent deletion.

To request deletion of your account and your data, get in touch through the channel in Section 13.

9. Information security

We adopt technical and organisational measures to protect your personal data, including: encrypted connections (HTTPS/TLS), password storage with cryptographic hashing, access to the admin panel restricted to authorised staff, and audio file storage on access-controlled infrastructure.

No system is entirely free of risk. We recommend using a strong, unique password for your account and not sharing it with anyone.

10. Cookies and advertising

We use cookies and similar technologies to keep your session authenticated, remember your preferences and, on the free plan, display advertising (Google AdSense) outside the player — never overlaid on the content or during practice/performance mode.

You can manage non-essential cookies directly in your browser settings. Cookies strictly necessary for the Service to work (such as authentication cookies) cannot be disabled without compromising use of the platform. See the full list in our Cookie Policy.

11. Children and adolescents

The Service is not directed at children (people under 12, as defined by the LGPD). We do not knowingly collect personal data from children. Processing of adolescents' data (12 to 18) follows the best interests of the data subject, as required by the LGPD.

If you are the legal guardian of a child and find that they have provided us with personal data without your authorisation, get in touch through the channel in Section 13 so we can delete that data.

12. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will notify you by a notice in the Service and/or by email, before or at the time the change takes effect. We recommend reviewing this Policy periodically.

13. How to contact us

If you have questions about this Policy, want to exercise the rights described in Section 2, or want to report a copyright matter (Section 6), get in touch through our contact form or by email at contato@l2techs.com.