1. Data Controller
The Data Controller for personal data processed through the GhostWax service (ghostwax.app) is:
- Provider / Legal Entity: GhostWax
- Location / Jurisdiction: Italy
- Legal Contact: legal@ghostwax.app
- Support Contact: support@ghostwax.app
- Contact for Privacy & GDPR requests: legal@ghostwax.app
- General Support: support@ghostwax.app
2. Categories of Personal Data Processed
2.1 Data Provided Directly by the User
- Account Data: Email address, display name, encrypted password hash, and OAuth profile details (if authenticated via Google).
- Billing and Tax Data: Full legal name or registered company name, billing address, Tax Code, VAT ID, electronic invoicing code (SDI) or certified email (PEC) for Business accounts.
- BYOK API Keys: Personal API keys provided by Studio/Custom tier users in Bring Your Own Key mode, stored with encryption at rest and used exclusively to authenticate requests to the underlying model provider.
- Support Communications: Messages, inquiries, or feedback submitted through support channels.
2.2 Data Collected Automatically
- Service Usage Data: Generation history, selected record stores and mood styles, Dig token balance, and records saved in the personal Crate.
- Technical Logs: IP address, browser type, operating system, access timestamps, and error diagnostics for security monitoring, abuse prevention, and rate-limiting enforcement.
- Payment Processing Data: Handled directly by Stripe (or authorized crypto payment processors). GhostWax does not store full credit card numbers or private crypto wallet keys.
2.3 Special Categories of Data
GhostWax does not intentionally request or collect sensitive personal data (health, racial or ethnic origin, religious beliefs, biometric data) pursuant to Article 9 of the GDPR.
3. Purposes and Legal Basis of Processing
| Purpose | Legal Basis (Art. 6 GDPR) | Data Categories |
|---|---|---|
| Account registration, authentication, and core SaaS delivery | Performance of a contract (Art. 6(1)(b)) | Account data, usage logs, personal Crate |
| Payment processing and token Dig allocation | Performance of a contract (Art. 6(1)(b)) | Billing data, payment processor transaction IDs |
| Abuse prevention, platform security, and rate limiting | Legitimate interest (Art. 6(1)(f)) | IP address, access logs, generation activity |
| Customer support and dispute resolution | Performance of a contract / Legitimate interest (Art. 6(1)(b),(f)) | Contact email, communication history |
| Tax compliance, electronic invoicing, and statutory bookkeeping | Legal obligation (Art. 6(1)(c)) | Billing details, VAT ID, invoices, receipts |
| Service announcements and critical security notifications | Performance of a contract / Legal obligation (Art. 6(1)(b),(c)) | Account email address |
4. Data Processors and Third-Party Disclosures
Personal data is shared only with verified service providers necessary to operate the platform under strict Data Processing Agreements (DPAs):
- Database & Authentication: Supabase Inc. (PostgreSQL database, user authentication, row-level security).
- Hosting & Serverless Compute: Vercel Inc. (global edge infrastructure, application delivery).
- Payment Processing: Stripe Inc. (PCI-DSS compliant payment processing and subscription billing).
- Generative AI Inference: Google Cloud / Google AI (Gemini API / Lyria 3 model execution; audio generation queries are processed in real time and are not used to train public foundation models).
- Transactional Email: Resend Inc. (password resets, invoice delivery, account notifications).
GhostWax does not sell, rent, or monetize personal user data to third-party data brokers or advertisers.
5. International Data Transfers
Where data is processed outside the European Economic Area (EEA), transfers are governed by appropriate safeguards pursuant to Articles 44–49 of the GDPR, including Standard Contractual Clauses (SCCs) approved by the European Commission and supplementary technical security measures.
6. Data Retention
- Account Data: Retained for the duration of the active account relationship.
- Personal Crate & Generation History: Maintained while the account remains active, unless deleted by the User.
- Billing and Tax Records: Retained for ten (10) years in accordance with statutory Italian tax and accounting regulations (Art. 2220 Italian Civil Code).
- Technical Server Logs: Retained for a maximum of ninety (90) days for security analysis, after which they are deleted or anonymized.
7. Security Measures
GhostWax implements robust technical and organizational measures to safeguard personal data:
- Encryption: HTTPS/TLS encryption for all data in transit; AES-256 encryption at rest for sensitive tokens and BYOK API keys.
- Database Isolation: Granular Row-Level Security (RLS) policies ensuring users can only access their own records.
- Access Control: Administrative access is restricted to verified administrators with multi-factor authentication.
8. Rights of the Data Subject
Under Articles 15–22 of the GDPR, Users have the right to:
- Access: Obtain confirmation of whether personal data is being processed and receive a copy.
- Rectification: Correct inaccurate or incomplete information.
- Erasure ("Right to be Forgotten"): Request deletion of personal data where statutory retention grounds no longer apply.
- Restriction: Request limitation of processing under specific legal conditions.
- Data Portability: Receive personal data in a structured, commonly used, and machine-readable format.
- Objection: Object to processing based on legitimate interests.
To exercise these rights, submit a request to legal@ghostwax.app. Requests are handled within thirty (30) days without cost.
Users also have the right to lodge a complaint with their competent data protection supervisory authority (in Italy: Garante per la Protezione dei Dati Personali, www.gpdp.it).
9. Cookies and Local Storage
GhostWax uses essential cookies and browser local storage strictly necessary for authentication session maintenance, user preferences, and security. We do not use third-party tracking or behavioral advertising cookies.
10. Minors
The Service is strictly restricted to individuals aged 18 or older. We do not knowingly collect personal data from minors. Any account identified as belonging to an unauthorized minor will be promptly closed.
11. Contact
For any privacy-related inquiries, data requests, or compliance questions, please contact:
- Email: legal@ghostwax.app
- Support: support@ghostwax.app