Privacy Policy (GDPR)
Last updated: November 14, 2026
1. Data Controller & Privacy Contact
Personal data processed via Boumb'App (boumbapp-daw.app) is controlled by the individual publisher designated in the Legal Notice, based in France, in compliance with Regulation (EU) 2016/679 (GDPR) and French data protection law.
Given the scale and nature of processing, no Data Protection Officer (DPO) is appointed (not required under GDPR Article 37). For any data protection inquiry or rights request, contact: contact@boumbapp-daw.app.
2. Account-Free Studio, Mandatory Data & Minimization
The audio workstation (sequencer, synthesizer, mixer, WAV/JSON export) runs locally in your browser using the Web Audio API. No registration or personal data is required to create music.
Registration is strictly restricted to individuals aged 15 or older. When creating an optional free cloud account:
- Mandatory data for cloud saving: valid email address, username, password (minimum 12 characters), and a minimum-age declaration (15 or older). No identity document is collected. Without these fields, account creation and cloud storage are unavailable, while local studio usage remains fully available.
- Optional data: interface language preference updates and optional satisfaction ratings (1–10) on AI-generated MIDI patterns.
3. Data Collected, Purposes & Legal Bases (Art. 13(1)(c))
- Account data & transactional emails: email address (unique identifier and verification), private non-unique username, hashed password, preferred language (
en/fr), timestamped minimum-age declaration (15+), technical lifecycle timestamps (creation, update, last login, inactivity notice), and strictly transactional emails (verification, email change, password reset, inactivity notices, account deletion confirmation). - Cloud projects: up to 50 private projects per account (and up to 20 versions per project) containing only musical JSON data (tempo, tracks, patterns, synth presets).
- Security, rate-limiting & server logs: IP addresses processed briefly in application cache (brute-force and API rate protection) and in HTTP server security/access logs.
- Anonymous server-side AI telemetry: when using the AI pattern generator, our own self-hosted inference server (located in France, EU) stores in a SQLite database (
telemetry.db) the UTC timestamp, text prompt (truncated to 200 characters), musical parameters, generated MIDI notes, and optional user rating (1–10). Zero account ID, email address, or IP address is stored there. Never enter personal, confidential, or third-party data into AI prompts.
| Processing Activity | Data Categories | GDPR Legal Basis |
|---|---|---|
| Account management, cloud project storage & transactional account emails | Email, username, hashed password, 15+ declaration, language, JSON projects | Performance of a contract (Art. 6(1)(b) — Terms of Use for requested cloud service) |
| Security, abuse prevention, rate limiting & HTTP logs | IP address, security timestamps | Legitimate interest (Art. 6(1)(f) — infrastructure and account protection) |
| Interface language persistence | boumbapp_locale cookie & i18nextLng browser storage |
Legitimate interest (Art. 6(1)(f) — serving requested UI language) |
| AI generator quality monitoring | UTC timestamp, prompt (≤ 200 chars), music parameters, MIDI notes, 1–10 rating | Legitimate interest (Art. 6(1)(f) — model diagnostics and improvement) |
| Compliance with binding legal orders | Data strictly required by applicable law | Legal obligation (Art. 6(1)(c)) |
No current processing on Boumb'App relies on consent under GDPR Article 6(1)(a), as zero advertising or third-party analytics trackers are used.
4. Cookies & Browser Storage
Boumb'App uses zero advertising cookies, zero tracking pixels, and zero third-party analytics SDKs. Only three technical storage items strictly necessary to provide the requested cloud session or language preference are used (consent-exempt under ePrivacy / CNIL guidelines):
| Name | Type | Purpose | Retention |
|---|---|---|---|
BEARER |
HTTP Cookie (HttpOnly, SameSite=Lax, Secure over HTTPS) |
Session authentication token (JWT) while signed in | 12 hours |
boumbapp_locale |
HTTP Cookie (SameSite=Lax, Secure over HTTPS) |
Remembers your chosen interface language (EN/FR) | 6 months (180 days) |
i18nextLng |
localStorage |
Synchronizes selected language inside the studio interface | Until browser storage cleared |
5. Recipients, Sub-processors & International Transfers
Recipients: data is accessible only to the publisher acting as technical administrator (strictly as needed for operations and support), the technical sub-processors listed below, and competent judicial/public authorities solely where required by binding law.
- OVH SAS (Roubaix, France — datacenter in Milan, Italy, EU): application servers, PostgreSQL database, and automated backups.
- Self-hosted AI inference server (France, EU): local MIDI pattern inference and anonymous
telemetry.dbstore (connected via encrypted Tailscale tunnel). - Brevo (Sendinblue SAS) (European Union): transactional email delivery only (email verification, password reset, inactivity warnings, and account deletion confirmation).
- Cloudflare, Inc. (United States): authoritative DNS resolution only (DNS-only mode, no active HTTP proxy on site traffic). Zero account data, application cookies, or projects are sent to Cloudflare. Only technical DNS query metadata (which may include client or resolver IP addresses) transits Cloudflare's global DNS network strictly to resolve domain queries, governed by Cloudflare's GDPR safeguards (EU–US Data Privacy Framework and European Commission Standard Contractual Clauses).
Account data and projects stay hosted in the European Union and are never sold or shared for advertising.
6. Retention Periods & Automated Purges
- Unverified accounts: automatically deleted 7 days after registration if the email address has not been verified.
- Inactive accounts: warning email sent 30 days before deletion (at 23 months of inactivity), followed by permanent cascading deletion of the account and all cloud projects after 24 months without login.
- Security tokens: valid for at most 24 hours (email verification/change) or 1 hour (password reset); expired tokens are purged automatically.
- IP addresses (security): cached in application memory/cache for 1 minute (AI rate limit) up to 15 minutes (login brute-force and auth email throttling), and retained at most 7 days in server HTTP access/security logs.
- AI technical telemetry (
telemetry.db): records are automatically purged after 6 months (180 days). - Encrypted off-site backups (
age): rolling maximum retention of 3 months.
7. Security Measures & Automated Decision-Making
We apply proportionate technical and organizational safeguards: TLS/HTTPS transport encryption with HSTS, strong password hashing, HttpOnly/SameSite=Lax JWT cookies with server-side version revocation, HMAC CSRF protection, strict owner-only isolation of private projects, multi-layer rate limiting, and at-rest encryption (age) for off-site backups. Because no system guarantees absolute zero risk, keep local exports (WAV/JSON) of important compositions.
Automated decision-making (GDPR Art. 22): Boumb'App does not carry out automated decision-making or profiling producing legal or similarly significant effects (the AI assistant solely generates MIDI patterns upon your prompt).
8. Your GDPR Rights
You have the right to access, rectify, erase, restrict, object to processing (where based on legitimate interest), and port your personal data:
- Self-service via /profile: update your profile, download a full JSON export of your account and projects, or delete your active account immediately (cascading deletion of all cloud projects). Snapshot copies within encrypted off-site backups (
age) expire automatically within at most 3 months (and HTTP server logs within at most 7 days). - By email: contact@boumbapp-daw.app (answered within one month).
- Supervisory authority: you may lodge a complaint with the French supervisory authority CNIL or your local EU data protection authority.