Privacy Policy
Your sound is personal. We treat it that way.
Effective date: 2026-10-13 · Version: 2026-10-13
This policy explains what personal data OpenSEP collects, why, for how long, and what your rights are. The controller is OpenSEP, a sole proprietorship in the Republic of Korea ("we"). Contact: support@opensep.com.
We designed the Service to hold as little about you as possible. What follows is the complete list.
1. What we collect and why
| Data | Why | Kept for |
|---|---|---|
| E-mail address, password (stored only as a salted hash) | Your account and sign-in | Until you close the account |
| Your display name — required when you create an account; you choose it and can change it | To show who is signed in | Until you close the account |
| Your confirmation that you are at least 14 years old | To meet Section 2 of the Terms | Until you close the account |
| Your interface preferences: language, reduced motion, playback volume | To apply your settings on every device you sign in on | Until you close the account |
| If you sign in with Google: your name, e-mail address, Google's account identifier, and whether Google has verified the address | To create your account and to sign you in | Until you close the account |
| E-mail verification and sign-in codes | To confirm the address is yours | 10 minutes |
| Session identifiers (cookie) | To keep you signed in | 30 days of inactivity |
| Files you upload | To process them as you request | 1 day, then deleted automatically |
| Results we produce | To let you download them | 3 days, then deleted automatically |
| The name of each file you upload, shown with its job | To let you find your jobs and their results | 3 days, then deleted with the results |
| Technical details of each file (duration, sample rate, channels, format) — never the audio itself after deletion | To process the file and to check it against your plan's per-file limit | With the job record |
| Job records: date, type, length of audio processed, queue priority, outcome | Billing, support, fraud prevention, legal obligations | 5 years (tax and accounting law) |
| Subscription and payment records (plan, period, order references) | Billing | 5 years (tax and accounting law) |
| Delivery status of e-mails we send you (sent, delivered, bounced, complaint) — with your address stored only as a keyed hash | To stop sending to addresses that bounce or object | 1 year |
| Security logs: request identifiers, timestamps, error codes; IP addresses only as keyed hashes for rate limiting and abuse prevention | To keep the Service running and secure | 30 days |
We do not collect: your phone number, precise location, device fingerprints, or any per-person behavioural analytics.
Where this comes from. Almost all of it comes from you, when you create an account or upload a file. There is one other source: if you choose Continue with Google, Google sends us your name, your e-mail address, Google's own identifier for the account, and a flag saying whether Google has verified that address. That is the whole of it. We ask Google for nothing else — no contacts, no calendar, no Drive, no profile beyond those fields — and we cannot read anything else in your Google account. Signing in this way is optional; an e-mail address and a password work exactly the same. Google's own handling of the sign-in is governed by Google's privacy policy, not this one.
2. What we do not do
- Website measurement. We use Cloudflare Web Analytics to count page views, visits, referring sites, countries, browser and device types, and page performance. It is aggregate only: it sets no cookies, stores nothing in your browser, and does not build a profile of you or identify you. Cloudflare processes this data on our behalf. We do not use advertising networks or tracking pixels, and our e-mails contain no tracking.
- We do not listen to, review or use your audio for anything except processing it as you asked, and handling an abuse report if one is made.
- We do not use your content to train models.
- We do not sell or share personal data for advertising.
3. Who processes data on our behalf
We use a small number of providers to run the Service. Each processes only what is needed for its role, under a contract that restricts use to our instructions.
| Provider | Role | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, network, storage of your files and results, database | Everything in Section 1 | Global edge network; storage region as configured |
| RunPod, Inc. | GPU processing of your files | The file being processed and its result, for the duration of the job only, via a time-limited link; the processing worker holds no credential to any other data | United States / European Union data centres |
| Polar Software Inc. | Merchant of record for paid plans | E-mail address, payment details (which we never see), order and subscription records | United States |
| Google LLC | Sign-in provider, only if you choose "Continue with Google" | The sign-in request itself; Google returns your name, e-mail address, account identifier and verified flag to us | United States |
| Resend, Inc. | Sending verification and account e-mails | E-mail address and the content of the e-mail | Asia-Pacific region |
Payment card details are entered on Polar's pages and are never transmitted to or stored by us.
4. Legal bases (where the GDPR or similar laws apply)
- Providing the Service you asked for, including processing your files: performance of a contract.
- Billing, tax and accounting records: legal obligation.
- Security, abuse prevention and e-mail suppression: our legitimate interest in running a reliable service, balanced against your interests by minimising and hashing the data.
- Where consent is required by your local law (for example for cookies beyond strictly necessary ones), we do not currently use anything that requires it.
5. International transfers
Our providers operate outside the Republic of Korea, as listed in Section 3. Transfers are made under the providers' standard contractual safeguards. Your files are transferred to a processing worker only for the duration of a job, through a link that expires.
6. Your rights
Depending on where you live you may have the right to access, correct, delete or export your personal data, to object to or restrict processing, and to complain to a supervisory authority. You can exercise most of these yourself:
- Access and export: your account page shows your data; job records can be exported on request.
- Deletion: close your account from the account page. Files and results are deleted immediately; job and billing records are retained only as long as the law requires and are then deleted.
- Everything else: write to support@opensep.com. We answer within 30 days.
Residents of the Republic of Korea may additionally exercise rights under the Personal Information Protection Act; residents of the EEA/UK under the GDPR/UK GDPR; residents of California under the CCPA. We do not discriminate against you for exercising them.
7. Cookies
We set one cookie, and it is strictly necessary: a session cookie (signed, HttpOnly, Secure) that keeps you signed in. Your interface preferences are stored with your account, not in a cookie. There are no third-party cookies. Because the session cookie is strictly necessary, no consent banner is shown.
8. Children
The Service is not directed at children under 14 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
9. Security
Files travel directly from your browser to encrypted storage over HTTPS; processing workers receive time-limited links and hold no standing credentials; passwords are hashed with a memory-hard function; sessions are bound to a single origin. No system is perfectly secure, and we will notify you and the relevant authority of a breach where the law requires it.
10. Changes
We will publish changes here with a new effective date and notify you of material changes by e-mail or in the Service before they take effect.
11. Contact
OpenSEP · support@opensep.com