This policy explains what Suonable does with your data. The short version: your music is yours, it is private by default, no other user can reach it, and it is never used to train AI models.
Who is responsible
The controller of your personal data is Viacolectiva S.R.L., Av. San Luis 2754, San Borja, Lima, Peru, RUC 20606672081. You can reach us at legal@suonable.com.
Suonable is operated from Peru. Peru's personal data law (Ley 29733) applies. The GDPR also applies to anyone in the European Union, because the service is offered to them from outside the EU (Art. 3(2) GDPR), and everything described here is written to meet it.
Representative in the European Union
For anyone in the European Union, our representative under Article 27 GDPR and our legal representative under Article 13 of the Digital Services Act is Jorge Aldo Peña Arguedas, in Turin, Italy (10152).
You can write to him at aldo@suonable.com about anything in this policy, and he is also our point of contact for authorities in the Union.
What we hold
Your email address and a cryptographic hash of your password. We never store the password itself and cannot recover it.
The audio files you upload, the separated tracks generated from them, and anything you attach to a song — lyrics, chord charts, PDFs, reference takes.
Your setlists, and the settings you choose on each device.
Technical records of processing: when a file was uploaded, how long it took, whether it succeeded. These do not contain audio.
Your IP address and basic security records — which requests reached the service and when — handled by our hosting provider to block abuse and attacks. They are not joined to your files, and we do not use them to profile you.
What we do not hold
We do not collect your name, address, phone number, date of birth or payment details. The beta is free and asks for none of that.
We do not use advertising trackers or third-party analytics that profile you.
We do not log the full URLs of your private files, because those carry access permissions inside them.
We do not keep a browser fingerprint, and we do not file your IP address next to your consent records or your library.
We do not hold data from children: Suonable is for people aged 16 and over.
Why we are allowed to process it
To give you the service you asked for — storing your files and separating them into tracks. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
To keep accounts secure and prevent abuse. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
To send you the account confirmation email. Legal basis: performance of a contract.
Anything beyond that is asked for separately, as consent you can refuse and later withdraw (Art. 6(1)(a) GDPR).
Private by default
Every file you upload and every track generated from it is private from the moment it exists. There is no public library, no discovery feed, no search across users, and no permanent public link.
This is enforced in the architecture, not by a setting. Each account's files live in a storage space addressed by that account's own identifier, and that identifier is taken from your logged-in session — never from anything a request can specify. There is no id, URL or parameter a person can change to reach somebody else's content.
Playback links are signed, expire within an hour, and carry the owner inside the signature: a link that leaks still only reaches its own owner's file.
If sharing is ever added, it will be a separate feature that you switch on deliberately, one item at a time. It will never be on by default.
No other user can reach your files. We can, in three situations and no others: when you ask support for help with a song, when a rightsholder sends us a notice about specific content and we have to act on it, and when we are stopping an attack on the service. Nothing else opens your library.
Artificial intelligence
Your uploads and your generated tracks are not used to train or fine-tune AI models, not used to build datasets, and not analysed for commercial purposes.
The separation itself is done by pre-trained models that run on your file and then forget it. Your audio does not change those models.
If we ever want to use content to improve the models, we will ask for that separately, it will be optional, refusing it will not limit your use of Suonable, and you will be able to withdraw it at any time.
Who else touches your data
Cloudflare — hosting, database and file storage.
Modal — the GPU that performs the separation. Your file is sent there, processed, and the result returned; it is not retained afterwards.
Resend — sends the account confirmation email. It receives your email address, never your audio.
None of these are allowed to use your content for their own purposes.
Where your data is
Suonable is operated from Peru and its providers run in several countries, so your files and your account data may be stored and processed in any of them, inside or outside the European Union.
Wherever they are, the same rules in this policy apply. For anyone in the European Union, transfers rely on the European Commission's standard contractual clauses, which our providers have signed.
Security
Traffic between you and Suonable travels encrypted, your files sit encrypted at rest with our providers, and your password is kept only as a hash that cannot be turned back.
No service is beyond a breach. If one ever reaches your data, we will tell the authority within the time the law gives us, and tell you directly when the risk to you is high.
How long we keep it
Your files stay as long as you keep them. Nothing is deleted automatically after processing.
When you remove a song, it leaves your library immediately and the files are held for 60 days so you can get it back. After 60 days they are deleted for good.
You can delete a song permanently at any time instead of waiting.
When you delete your account, your files and records are deleted. We keep only a minimal record that a deletion happened, with no content in it, because otherwise we could not show that we honoured your request.
We do not keep file backups that would survive a deletion.
Your rights
You can ask for a copy of your data, correct it, delete it, take it elsewhere, or object to processing. Write to legal@suonable.com.
You can delete your account and everything in it yourself, from inside the app. It is not a request you have to send us.
You can withdraw any optional consent at any time without giving a reason and without losing access to the service.
If you think we have handled your data badly you can complain to a data protection authority — the one in the country where you live, wherever that is. In Peru it is the Autoridad Nacional de Protección de Datos Personales; in the European Union, the authority of your country of residence.
Storage on your device
Suonable stores your session token and your settings in your browser, and keeps downloaded tracks on your device so it works offline. This is functional storage the app needs to run, not tracking, and it never leaves your device.
Clearing your browser data removes all of it.
This is a beta
Suonable is in open beta and free. Things will change, including this policy. If a change affects what you agreed to, we will ask you again rather than assume.