MixPilotLab
MixPilotLab Back to home

Privacy Policy

Effective date: August 5, 2026

1. Data Controller

MixPilotLab ("Company", "we", "us") is the data controller for the service available at mixpilotlab.com (the "Service"). This Privacy Policy is issued to satisfy our disclosure obligations under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), and, to the extent applicable to users accessing the Service from the European Union/European Economic Area or the State of California, the relevant notice requirements of the General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA").

For any privacy-related request, question, or complaint, you may contact us at: support@mixpilotlab.com

2. Personal Data We Process

a) Account information: your email address; a salted bcrypt hash of your password (we never store or can recover your plaintext password); your display name; and, if you sign in with Google, your Google account ID, name, and profile picture.

b) Audio files you upload and derived data: the audio files themselves; metadata extracted from them (title, artist, album, genre, release year, duration, sample rate, bit depth, bitrate); and data derived from automated analysis of those files (tempo/BPM, musical key, energy curve, song-structure segments, and numerical audio representations used for similarity search).

c) Usage data: your IP address (processed solely for rate-limiting and abuse prevention, and recorded in server logs); timestamps of logins and actions; the history of background jobs you initiate (uploads, analysis, stem separation); and the set lists and libraries you create.

d) Billing and subscription data: if you subscribe to a paid plan, we process your subscription plan and status, billing interval (monthly/annual), renewal and expiry dates, your remaining stem-separation credits, and a customer/subscription identifier assigned to you by our payment processor, Lemon Squeezy. See Section 4 for what Lemon Squeezy collects directly.

e) Data we do not process: we do not process your full payment card number or bank account details (see Section 4), precise geolocation data, or any device data beyond what your browser transmits in the ordinary course of an HTTP request.

3. Purposes and Legal Basis for Processing

We process your personal data for the following purposes, relying on the legal bases of performance of a contract to which you are a party and our legitimate interests as data controller:

  • To provide the Service: storing your library, running audio analysis, computing transition recommendations, and generating the stem separations you request.
  • To secure your account: authentication, rate-limiting against brute-force attempts, and abuse detection.
  • To communicate with you: email verification, password reset, and confirmation notices for account changes you request.
  • To generate, at your request, automated recommendation text via a third-party language-processing service for track pairs that score highly under our internal compatibility metric (see Section 4).

We do not sell your personal data, and we do not use your uploaded audio or account data to train any machine-learning model.

4. Recipients of Personal Data

  • Lemon Squeezy (paid plans): acts as our payment processor and merchant of record for subscription checkout and billing. If you subscribe, Lemon Squeezy collects and stores your payment details (card number, billing address) directly; we never see or store your full card number. Lemon Squeezy shares back with us your subscription status, plan, and renewal/cancellation events, which we process as described in Section 2. See Lemon Squeezy's Privacy Policy.
  • OpenAI, L.L.C. (optional feature): where a track pair's compatibility score crosses our internal threshold and you elect to use this feature, we transmit to OpenAI only the track titles, tempo, musical key, an energy value, and computed mix-timing figures, for the sole purpose of generating a short recommendation note — the audio file itself is never transmitted. This transfer occurs only where the relevant feature has been enabled by the Service administrator. See OpenAI's Privacy Policy.
  • Email delivery provider: your email address and the content of verification/password-reset emails pass through the SMTP provider configured by the Service administrator, solely for the purpose of delivering those emails.
  • Cloud storage provider (where applicable): where the Service administrator has configured cloud-based storage in place of local disk storage, your uploaded audio files are stored on that infrastructure. See AWS's Privacy Policy.

We do not otherwise disclose your personal data to third parties, we do not use any advertising or cross-site tracking technology, and we do not sell or share your personal information as those terms are defined under the CCPA/CPRA. See Section 8 for the analytics technology we do use and how it differs from advertising trackers.

5. Retention and Deletion

Deleting your account (Settings → Delete Account) permanently removes your user record and cascades to delete your libraries and every track, analysis result, stem, and transition score associated with them, together with your set lists, refresh tokens, verification tokens, and application settings. Uploaded audio files are removed from storage before the corresponding database records are deleted. If you hold an active paid subscription, deleting your account also terminates that subscription with Lemon Squeezy, and no further charges will be incurred.

Unlike the rest of your account, your subscription and credit-transaction history is retained, disassociated from your identity, for as long as necessary to satisfy our accounting obligations and to resolve disputes that may arise after deletion (for example, a chargeback filed after your account has been deleted). Lemon Squeezy separately retains its own transaction records under its own retention policies, independent of this deletion.

Server logs (which may include your IP address) are retained for 30 days for operational and security purposes. Background job records older than a configurable retention window (30 days by default) are periodically deleted.

6. Your Rights

Rights under the KVKK

Pursuant to Article 11 of the KVKK, you have the right to: learn whether your personal data is being processed; request information about such processing; learn the purpose of processing and whether your data is used consistently with that purpose; know the third parties to whom your data is transferred, domestically or abroad; request correction of incomplete or inaccurate data; request erasure or destruction of your data under the conditions set out in Article 7 of the KVKK; request that any correction or erasure be notified to third parties to whom your data has been transferred; object to a result that is to your detriment arising solely from analysis of your data through automated systems; and claim compensation for damages arising from unlawful processing.

Rights under the GDPR (EU/EEA users)

If you access the Service from the European Union or European Economic Area, you have the right to access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), and objection to processing (Article 21), as well as the right to withdraw consent at any time with respect to processing carried out on the basis of consent.

Rights under the CCPA/CPRA (California users)

If you are a California resident, you have the right to know the categories of personal information collected about you, to access that information, to request its deletion, and to request correction of inaccurate information. We do not sell personal information, nor do we "share" it as defined under the CCPA/CPRA; accordingly, no separate opt-out of sale or sharing is required.

To exercise any of the rights described above, contact us at support@mixpilotlab.com. We will act on verified requests within the time limits prescribed by applicable law.

7. Copyright Notice Regarding Uploaded Content

The Service is a tool for analyzing audio files that you provide. We do not review uploaded files for copyright status. You are solely responsible for ensuring that you hold the necessary rights in any audio file you upload and analyze. For further detail, see the "Content you upload" section of the Terms of Service, and our DMCA / Copyright Infringement Policy if you believe content on the Service infringes your copyright.

8. Cookies and Similar Technologies

The table below lists every cookie and tracking technology the Service actually uses — nothing else is set.

| Name | Set by | Purpose | Type | Duration | Consent required? | |---|---|---|---|---|---| | refresh_token | mixpilotlab.com (us) | Keeps you signed in | HttpOnly, first-party | Matches your session length (~30 days) | No — strictly necessary to provide the Service you requested; not used for advertising or cross-site tracking. | | Umami analytics | analytics.mixpilotlab.com (us — self-hosted, not a third party) | Aggregate, anonymous usage statistics (which pages get visited, how often) so we can improve the Service | No cookie is set. A daily-rotating, non-reversible hash derived from your IP address and browser is used instead of a persistent identifier — we cannot use it to recognize you across visits or sites. | N/A — nothing persists | No — Umami sets no cookie and stores no persistent identifier, so it does not fall under cookie-consent requirements. | | Google OAuth session | accounts.google.com (Google) | Lets you sign in or create an account with your Google account | Third-party, set only if you click "Continue with Google" | Set and governed by Google | No — set only as a direct consequence of you initiating that sign-in. See Google's Privacy Policy. | | Lemon Squeezy checkout | lemonsqueezy.com (Lemon Squeezy) | Processes your subscription payment | Third-party, set only during checkout on Lemon Squeezy's own domain | Set and governed by Lemon Squeezy | No — set only as a direct consequence of you starting checkout. See Lemon Squeezy's Privacy Policy. |

We do not currently use Google Analytics or any advertising/cross-site tracking cookie. Our infrastructure has the capability to enable Google Analytics in the future; unlike Umami, Google Analytics sets persistent cookies, so turning it on would require this Policy — and a consent mechanism — to be updated first.

9. Changes to This Policy

We may update this Policy from time to time to reflect changes in applicable law or in how the Service operates. Material changes will be reflected by updating the "Effective date" above, and where a change is material, we will additionally notify you at your registered email address.