Privacy Policy

1. Controller and contact

Wendelin Pack, trading as OpenMind Audio, Wurzelgasse 58, 9020 Klagenfurt am Wörthersee, Austria, is responsible for the processing described here. For privacy requests, email aimusicprompts.partners@gmail.com.

2. Website delivery and security

The website runs on ChatGPT Sites infrastructure using Cloudflare Workers. To deliver pages, protect the service and diagnose failures, the infrastructure processes technical connection information such as IP address, request time, requested URL, browser information and error or security events. Our legal basis is our legitimate interest in operating and securing the service (Article 6(1)(f) GDPR). Account and checkout requests are also processed to provide the service you request (Article 6(1)(b)).

While the site is private, the hosting platform additionally controls who may open it. That platform sign-in is separate from your OpenMind Audio account.

3. Registration, authentication and service emails

We use Supabase Auth for email-and-password registration, email confirmation, login, logout and password reset. Data includes your email address, optional name, user identifier, password authentication data, confirmation and recovery records, and session information. Password authentication is handled by Supabase; passwords are not displayed in the studio.

We process these data to create and secure your account and deliver confirmation and recovery emails (Article 6(1)(b) and, for abuse prevention, Article 6(1)(f)). Providing an email address and password is necessary to register; your name is optional. A selected subscription plan may be stored as a navigation preference so it can be resumed after email confirmation. It does not grant access.

3a. Optional newsletter consent

If you explicitly select the optional registration checkbox, we record your request to receive occasional emails about new OpenMind Audio music prompt generators, special offers and discounts. The legal basis is your consent (Article 6(1)(a) GDPR). Consent is voluntary and is not required for registration, three free prompts or a paid subscription. Existing accounts are not enrolled automatically.

We store your account identifier, whether consent was given, its timestamp, the consent text and version, a separate confirmation timestamp when applicable, and any withdrawal timestamp in Supabase. We retain the consent evidence as necessary to demonstrate and respect your choice; it is not a permanent obligation to retain your account. Registration or account email confirmation alone does not confirm newsletter consent.

Separate newsletter email confirmation and marketing delivery are not operational yet; no verified newsletter subscription is created from the checkbox alone. No newsletter delivery provider has been activated for this feature. We will identify the actual provider here before enabling delivery. You can withdraw in your signed-in account under “Newsletter preferences” or contact aimusicprompts.partners@gmail.com. Future marketing emails must include a working unsubscribe link. Withdrawal does not close your account or cancel paid access and does not affect the lawfulness of earlier consent-based processing.

4. Free prompts and generation history

Each confirmed account receives three successful free generations in total across all genres. We store the number used against your account on the server. Reloading or signing in again does not reset it. Failed generations, reading saved results and copying them do not use a new free attempt.

Successful generated results and their request identifiers and timestamps are stored in Supabase for history and to avoid charging twice for a repeated request. The history interface displays the latest 20 results; older records are not automatically deleted by that display limit. A prompt can include details from your creative description. Please do not enter sensitive personal information or other people’s private data.

The basis is performance of the requested service (Article 6(1)(b)) and preventing trial abuse and duplicate consumption (Article 6(1)(f)). The app creates prompt text; it does not automatically submit it to Suno, Udio or Mureka. If you use those services yourself, their own terms and privacy notices apply.

5. Subscriptions and Digistore24

Digistore24 processes checkout, payments, invoicing and order administration as the reseller identified at checkout, under its own privacy notice. We do not receive your full payment card details.

Before checkout, a server-generated checkout identifier is linked to your confirmed user account, selected plan and checkout mode. The identifier is sent to Digistore24 to associate a verified order with that account. Server-to-server payment notifications can contain buyer email, order, product, plan, merchant and payment identifiers, currency, payment and subscription dates, event type and signature information. The application records order and subscription state, payment references, paid-through dates and verified payment events to provide, renew, suspend or end access, and to display the confirmed plan, cancellation status, paid-through date and access end date in your account. Account assignment uses the checkout reference rather than relying on matching email addresses. A personal Digistore24 rebilling_stop_url received in an authenticated notification is stored separately as a protected order-management credential. Only its associated signed-in account can retrieve it to open the provider’s cancellation form; it is excluded from public event history and diagnostic logs.

Authentication secrets are checked server-side. Diagnostic records are restricted to selected technical fields and do not store the IPN password or signature. We process subscription data to deliver paid access (Article 6(1)(b)), meet applicable record-keeping duties (Article 6(1)(c)) and prevent fraud and resolve payment disputes (Article 6(1)(f)). See Digistore24’s privacy information and the reseller notice shown at checkout.

6. Cookies and browser storage

These own-domain cookies are Secure, HttpOnly and SameSite=Lax. They support the account or checkout function you request. Logging out clears the authentication cookies. You can delete cookies in your browser; doing so can sign you out or clear your plan selection. Server-side usage and subscription records are not reset by deleting cookies.

We do not add advertising pixels or audience analytics to the application. With your consent (Article 6(1)(a) GDPR and applicable terminal-storage rules), official Digistore24 trust badges load scripts and images on sales, pricing and purchase-return pages. This exposes technical connection data such as IP address and browser information to Digistore24. The badge server also sends a seven-day cookie named ds_gb_id; whether a browser accepts it depends on its third-party cookie rules. We therefore block the optional badges before consent. The original scripts also provide the reseller’s legal footer.

You can decline or withdraw badge consent without losing access to registration, the free trial or checkout. The separate Digistore24 checkout can use its own technologies, explained there. Hosting-platform cookies are governed separately by the hosting provider.

7. Service providers and international processing

We use Supabase for authentication and application data storage, and ChatGPT Sites / OpenAI and Cloudflare for website hosting and delivery. The configured Supabase project is in region eu-west-1 (Ireland). Hosting, support and provider subprocessors can involve processing outside the EEA; a database region alone does not mean that every processing operation takes place in the EU.

Providers’ data-processing terms and applicable transfer safeguards govern processing on our behalf. For information on a particular recipient or safeguards relevant to your data, contact us. Provider information: Supabase data-processing terms, OpenAI privacy information, and Cloudflare privacy information. Digistore24 acts separately for its reseller and payment responsibilities. If you contact us by email, your message is also handled by the email provider serving our published Gmail address.

8. Retention and deletion

Account, usage and saved-result data remain associated with your account while needed to operate it. The present application does not automatically erase an account or generation history after a fixed inactivity period. You can request deletion by email; we verify the request and remove data for which there is no continuing lawful basis. We do not treat a cancellation as an account-deletion request.

Order, payment-event and entitlement records are retained as necessary for payment reconciliation, fraud prevention and legal claims. Accounting records subject to Austrian retention duties are generally retained for seven years from the end of the relevant calendar year, and longer where proceedings legally require it. This does not mean all prompt or log data must be kept for seven years. Technical logs and backups follow the relevant provider’s operational retention and deletion cycle; we do not promise an unverified fixed provider retention period. A deletion request does not remove records a reseller must independently retain.

9. Your rights

Subject to the legal conditions, you may request access, correction, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. If processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing. We may need to verify your identity before responding. Requests are normally answered within one month; any lawful extension will be explained.

You may complain to your local supervisory authority or the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria; email dsb@dsb.gv.at; complaint information. The application does not make automated decisions producing legal or similarly significant effects about you; automated quota and subscription checks determine routine service availability.

10. Changes

We update this policy when relevant processing changes. The date above identifies the current version. Material changes will be communicated where required.