PRIVACY POLICY

Last updated: 1 November 2026

This policy describes the processing of personal data carried out by SmashTone Studio in connection with smashtonestudio.com, quote requests, the newsletter, business communications and the search for bands or artists who may be interested in our audio services.

Une version française de cette politique est disponible ici : https://smashtonestudio.com/politique-de-confidentialite

Data controller

Julien Meirone, trading as SmashTone Studio (French sole trader, micro-entrepreneur).

Address: 104 Chemin du Vallon de Nice, 13390 Auriol, France.

Contact: contact@smashtonestudio.com

Quote requests

The form may collect: first and last name, artist or band name, email address, selected service (mixing, mastering, bundle, audit or coaching), number of tracks, optional link to your files, message, page language, page of origin and technical anti-spam signals.

This information is used to answer your request, review your project, prepare a quote and follow up on that request. Processing is based on pre-contractual steps taken at your request.

Required fields are marked in the form. Without them, your request may not be processed.

Data retention: requests that do not lead to a project are kept for as long as needed to follow them up and then, where keeping them for later marketing purposes is justified, for no more than three years from receipt or from your last contact with us. A message we send you does not extend this period.

Client data is kept for the duration of the business relationship, then for no more than three years after it ends for marketing purposes, and for as long as needed to meet our legal obligations and to protect our rights. Invoices and supporting documents are kept for the period required by French tax law, currently ten years.

Tools used for quotes and client follow-up

Hostinger: website hosting.
Make: automated transfer of your request.
Brevo: notification email and "Quotes" contact list.
Airtable: prospect and client follow-up.
Gmail (Google): receipt of the notification email.
ChatGPT (OpenAI): reading the notification received in Gmail and preparing a draft reply. No email is sent automatically: every reply is reviewed and sent by Julien Meirone.
Henrri: preparation of quotes and invoices.

A quote request never subscribes you to the newsletter.

Mix audit orders and payment

Mix audits are ordered and paid for online through a Stripe payment page. This page collects your first and last name, your email address, the track title, the link to your mix, your choice of when the service starts (immediately or after the 14-day withdrawal period) and your acceptance of the Terms of Sale.

Payment data: entered and processed directly by Stripe. SmashTone Studio never has access to your full card number; we only receive what we need to follow up the order (amount, date, payment status, last four digits and card type).

Purposes and legal bases: fulfilling your order and sending you the audit (performance of a contract), issuing the invoice and meeting our accounting obligations (legal obligation), preventing payment fraud (legitimate interests of Stripe and SmashTone Studio).

Recipients: Stripe Payments Europe Limited (Ireland), our payment provider, which also acts as a data controller for its own obligations; Henrri, for invoicing. Stripe may transfer some data to its parent company in the United States, under the safeguards set out in its own privacy policy (Standard Contractual Clauses).

Data retention: audio files you send are kept for 30 days after the audit is delivered; order information is kept for the duration of the business relationship; invoices and accounting records are kept for 10 years, as required by the French Commercial Code.

Subscribing collects your email address so SmashTone Studio can send you its newsletter. Processing is based on your consent. The newsletter is managed with Brevo, using double opt-in (a confirmation email validates your subscription) and Cloudflare Turnstile spam protection. Once your subscription is confirmed, your address is also copied through Make into Airtable, in a list kept separate from client and prospect follow-up.

You can unsubscribe at any time using the link in every email. Subscribing is separate from any quote request.

Data retention: your address is used for as long as you are subscribed. Unsubscribing stops the emails. Copies of your address may, however, remain in our management tools, in particular Airtable, until our retention policy is applied.

Instagram messages and comments

If you contact @smashtonestudio on Instagram, by direct message or comment, your username, your message and its date are read directly by Julien Meirone in the Instagram app or in Meta Business Suite in order to reply to you. Meta provides this platform and processes this data under its own privacy policy.

The content of a conversation, or a screenshot of it, may occasionally be shared with ChatGPT (OpenAI) to analyse the situation or prepare a reply. The reply is always reviewed and sent by Julien Meirone. No AI model automatically sorts or classifies incoming messages.

When the conversation concerns a service (mixing, mastering, audit, coaching, quote), details needed for follow-up may be recorded manually in Airtable: username or artist name, profile link, service discussed, stage of the conversation, agreed next step and, where relevant, any concern you raised, summarised in a few words.

The legal basis is our legitimate interests in replying to people who contact us and following up on their requests. These details are kept for no more than three years from your last contact with us. They are never sold or used for advertising.

A Meta app called SmashTone Ops is registered for the @smashtonestudio account. It has been used for technical tests of reading comments and messages. As of the date this policy was last updated, it is not used for any automated processing of your messages or comments (reading, classification or storage). This policy will be updated before any such processing is put into operation.

Research on bands and artists (business prospecting)

SmashTone Studio searches for and reviews publicly available professional information about bands, independent artists and music projects. This research is used to identify projects that could benefit from our mixing, mastering, audit or coaching services, to avoid duplicate research and to organise business follow-up.

Sources: artists' official professional pages (including Instagram, Bandcamp, Spotify and YouTube), websites, interviews, music credits and publicly available professional publications.

Categories of data: band or artist name, links to their professional pages, publicly stated city or region, music genre, releases and release dates, news, production credits (mixing, mastering), follower counts and other public audience indicators, observations on the sound of released tracks, and the sources consulted. Where this information directly or indirectly identifies a natural person, it is personal data, even if it is public.

We do not look for information about private life, special categories of data (health, opinions, beliefs, origin, etc.) or personal assessments unrelated to musical activity.

AI-assisted qualification: ChatGPT (OpenAI) and Claude (Anthropic) help us search, organise and analyse this information. An internal method assesses how well the project fits our services, its release timeline and what is publicly documented about its audio production. The result is a business priority category recorded in Airtable, used to organise our work. Julien Meirone decides whether to contact you and what any message says: no message is sent automatically, and no decision producing legal effects concerning you or similarly significantly affecting you is based solely on automated processing.

Legal basis: where the processing concerns identifiable natural persons, it is based on SmashTone Studio's legitimate interests in developing its business with musicians who may need its services, with due regard for your rights and interests. This processing does not in itself authorise any marketing approach: every message remains subject to the rules that apply to the channel used.

Recipients: Airtable, which hosts our business follow-up tool and acts as a data processor under a signed data processing agreement. Information used for research and qualification is also processed by the AI assistants mentioned above (see "AI assistants" and "International data transfers").

Data retention: prospecting data is kept for as long as needed for qualification and business follow-up, and for no more than three years from collection or from your last contact with us, unless an objection or other circumstance requires a shorter period. If you object to prospecting, your identifier (for example your username or email address) is entered in a separate list, used only to stop contacting you.

Your rights over this data: you can ask where your data came from, access it, and have it rectified or erased under the conditions set out in the GDPR. You can object at any time, free of charge and without giving reasons, to its use for direct marketing, including profiling related to such marketing. Write to contact@smashtonestudio.com.

AI assistants

SmashTone Studio uses AI assistants in two separate contexts.

Individual ChatGPT and Claude Pro plans: ChatGPT for researching bands, preparing draft replies to quote requests and, occasionally, analysing Instagram conversations; Claude Pro for researching bands and working on the website. For users in the European Economic Area, these services are provided by OpenAI Ireland Limited and Anthropic Ireland, Limited, which process data under their own privacy policies. These individual plans do not include a data processing agreement (DPA). The setting that allows our conversations to be used to train their models is switched off in both services.

Claude API (Anthropic): our tool that automates research on bands and artists sends the public professional information described in the "Research on bands and artists" section to the Claude API, so it can be sorted and qualified. This use is governed by Anthropic's commercial terms, which incorporate its data processing agreement (DPA) and the European Commission's Standard Contractual Clauses. Under these terms, Anthropic does not train its models on data sent this way. Data about website visitors, quote requests, orders and newsletter subscribers is never sent to the Claude API.

Third-party resources loaded by the site

Some pages load content provided by third parties. Loading it sends these providers technical data (IP address, browser type) needed to display it:

Before / after audio player: built into the site. The excerpts are hosted by Hostinger, our web host, and the player stores nothing in your browser.
Google Fonts (Google): fonts used in the quote form, the audio player and some sections of the site.
Pexels: background video and images.
Brevo and Cloudflare Turnstile: newsletter sign-up form and spam protection.

Cookies and trackers

The hosting provider Hostinger gives SmashTone Studio general traffic statistics (number of sessions and visitors). The site and the embedded content described above may set cookies or use your browser's storage for their operation, usage measurement, spam protection and content display, under each provider's own terms. With your consent obtained through the cookie banner, smashtonestudio.com uses Google Analytics 4 and the Meta pixel to measure website traffic and for advertising purposes. These processing activities are based on your consent. The relevant cookies are stored for a maximum of 13 months. You may refuse these cookies or withdraw your consent at any time through the website's cookie settings.

International data transfers

Some providers may process data outside the European Economic Area, particularly in the United States:

Airtable: the data processing agreement signed with Airtable incorporates the European Commission's Standard Contractual Clauses.
Cloudflare, Google, Make and other providers concerned: depending on the safeguards they describe, the European Commission's adequacy decision for companies certified under the EU-US Data Privacy Framework, or Standard Contractual Clauses.
OpenAI and Anthropic (individual plans): data processed by their Irish subsidiaries may be transferred to their parent companies in the United States, under the safeguards described in their privacy policies. No specific contract has been signed for these plans.
Anthropic (Claude API): any transfers to the United States are covered by the Standard Contractual Clauses included in Anthropic's data processing agreement.

For information about these safeguards, write to contact@smashtonestudio.com.

Deleting your data

To request erasure of personal data about you, including data relating to Instagram conversations or business prospecting, email contact@smashtonestudio.com and, if your request concerns Instagram, include your username.

We reply without undue delay and in any event within one month of receiving your request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests; if so, we will tell you within the first month.

Erasure is carried out where it applies. Some information may have to be kept to comply with a legal obligation, to establish, exercise or defend legal claims, or, in minimal form, to respect your objection and stop contacting you. If we do not act on your request, we will tell you why.

If we have reasonable doubts about your identity, we may ask for additional information strictly needed to confirm it, for example a message sent from the Instagram account or email address concerned.

Your rights

You have the right of access, rectification, erasure and restriction of processing. The right to data portability applies to data you have provided to us where processing is based on your consent (newsletter) or on a contract or pre-contractual steps (quotes, services); it does not apply to processing based on our legitimate interests.

Where processing is based on our legitimate interests, you may object to it on grounds relating to your particular situation.

Where your data is used for direct marketing, you may object at any time, free of charge and without giving reasons. This right to object also covers profiling to the extent that it is related to such marketing.

For the newsletter, you can withdraw your consent at any time, without affecting messages sent before withdrawal.

To exercise your rights, write to contact@smashtonestudio.com stating the right concerned. You can also lodge a complaint with the French data protection authority (CNIL) through its online complaint service: https://www.cnil.fr/fr/plaintes