Privacy Policy

Last updated: 18 August 2026. Effective date: 18 August 2026.

1. Who we are

This website, aisongchecker.pro, is operated by NOTHING SAS, a French simplified joint-stock company, share capital 1,000 EUR, SIREN 892 798 208, SIRET 892 798 208 00021, registered office 58 rue de Monceau, 75008 Paris, France. NOTHING SAS is the data controller for the processing described here within the meaning of Article 4(7) of Regulation (EU) 2016/679 (GDPR). Publication director: Celian Ghelid, President. Privacy contact: [email protected]. We have not appointed a Data Protection Officer; write to the address above for any privacy request.

2. What this policy covers

It covers aisongchecker.pro and all its language versions (en, fr, es, de, it, pt, nl, pl, tr, ru, ar, ja, ko, zh, hi, id, vi), the free checker, the Pro subscription, the API, and the Chrome extension. Our legal notice is a separate document available at /legal-notice.

3. What we collect

3.1 Data you give us.

Account: your email address, and, if you sign in with Google, the email address, display name and profile picture that Google returns to us. Authentication is handled by Supabase Auth; we never see or store your Google password.

Audio files: when you are signed in and run an analysis, the audio file you submit is uploaded to our storage bucket (Supabase Storage, EU region) under a path derived from your account identifier and a timestamp. Audio feature extraction runs in your browser using the Web Audio API, but the extracted numerical features are sent to our scoring service (a Supabase Edge Function named analyze-score) and the file itself is stored on our servers so you can review past analyses.

Billing: if you subscribe, your name, email address, billing country and card details are collected and processed directly by Stripe. We never receive or store your full card number.

Messages: anything you send us by email.

3.2 Data collected automatically.

Technical data needed to run and secure the service: your IP address (used to enforce the daily analysis quota and to block abuse), the date and time of requests, and error logs.

Strictly necessary local storage: aisc_cookie_consent (your cookie choice), aisc_lang (your language), and the Supabase authentication token (sb-<project>-auth-token) that keeps you signed in.

3.3 Data collected only after you consent.

Usage analytics: a persistent session identifier stored in your browser under asc_funnel_sid, the pages you view, the referring URL, and product events (analysis completed, signup, login, checkout started, checkout completed). These are sent to our own analytics service (Supabase Edge Function track-event).

Device and browsing data attached to your account: browser user agent, browser language, platform, screen resolution, time zone and referring URL.

Advertising and tag management: Google AdSense and Google Tag Manager, described in section 6.

Nothing in section 3.3 is collected, and no advertising or analytics script is loaded, until you press "Accept all" in the cookie banner. If you press "Essential only", or if you make no choice at all, those scripts are never loaded.

4. Why we use it and on what legal basis

Providing the analysis service and your account: performance of a contract, GDPR Article 6(1)(b).

Billing, invoicing, subscription management and accounting records: performance of a contract and legal obligation, Articles 6(1)(b) and 6(1)(c).

Security, abuse prevention, quota enforcement by IP address, and service logs: legitimate interests, Article 6(1)(f), our interest being to keep a free service available and not to have it drained by automated abuse.

Service emails (account confirmation, password reset, payment failure notices), sent through Resend: performance of a contract, Article 6(1)(b).

Usage analytics and advertising, including advertising cookies and personalised advertising: your consent, Article 6(1)(a) GDPR and Article 5(3) of Directive 2002/58/EC as implemented in France by Article 82 of the French Data Protection Act.

5. Cookies, web beacons and similar identifiers

This website uses cookies, browser local storage, web beacons and similar identifiers. Some are strictly necessary to run the service and cannot be switched off (your cookie choice, your language, your sign-in token). Others are only set after you consent.

Third parties, including Google, may place and read cookies on your browser, and may use web beacons and IP addresses, to serve and measure advertising on this site.

You can change or withdraw your choice at any time by clicking "Cookie preferences" in the footer of any page, which reopens the banner. Withdrawing consent stops any further collection; it does not affect the lawfulness of what happened before.

Browser-level controls (Chrome, Firefox, Safari, Edge) also let you block or delete cookies, though blocking strictly necessary cookies will break sign-in.

6. Advertising (Google AdSense)

Third party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.

Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.

You may opt out of personalised advertising by visiting Google Ads Settings at https://myadcenter.google.com (formerly https://www.google.com/settings/ads).

Alternatively, you may opt out of a third-party vendor's use of cookies for personalised advertising by visiting https://www.aboutads.info/choices/ , https://optout.networkadvertising.org/ or, in Europe, https://www.youronlinechoices.eu/ .

For details of how Google uses information from sites that use its services, see "How Google uses information from sites or apps that use our services" at https://policies.google.com/technologies/partner-sites .

We do not serve advertising to signed-in Pro subscribers.

7. Who receives your data

We do not sell your personal data and we do not share it for cross-context behavioural advertising outside the advertising described in section 6. We use the following processors and partners:

Supabase Inc. (United States, infrastructure in the European Union): database, authentication, audio file storage, scoring and analytics functions.

Google Ireland Limited and Google LLC: Google AdSense advertising, Google Tag Manager, and Google Sign-In. Applicable terms: https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites .

Stripe Payments Europe Ltd (Ireland) and Stripe Inc. (United States): payment processing and subscription billing. https://stripe.com/privacy .

Cloudflare Inc. (United States): content delivery, DDoS protection and privacy-preserving web analytics. https://www.cloudflare.com/privacypolicy/ .

Resend (United States): delivery of transactional emails. https://resend.com/legal/privacy-policy .

OVH SAS (France): website hosting.

We may also disclose data where required by law, court order or a valid request from a competent authority.

8. International transfers

Some of the recipients above are established in the United States. Transfers rely on the European Commission's Standard Contractual Clauses of 4 June 2021 and, where the recipient is certified, on the EU-US Data Privacy Framework, together with supplementary technical measures (encryption in transit and at rest). You can request a copy of the safeguards by writing to [email protected].

9. How long we keep it

Uploaded audio files: 30 days from upload, then permanently deleted.

Analysis results and history: for as long as your account is open, then 12 months, then deleted.

Account data: until you delete your account, then 30 days in backups.

Billing records and invoices: 10 years, as required by Article L123-22 of the French Commercial Code.

Server and security logs including IP addresses: 12 months.

Usage analytics events and the asc_funnel_sid identifier: 25 months, in line with the French data protection authority's guidance.

Record of your cookie choice: the choice itself is re-asked after 6 months; proof of consent is kept for 3 years.

If you never sign in, no account data exists and nothing beyond section 3.2 is retained.

10. Your rights

Under Articles 15 to 22 GDPR you have the right of access, rectification, erasure, restriction, data portability, and the right to object at any time to processing based on our legitimate interests, including profiling. Where processing is based on consent, you may withdraw it at any time, as described in section 5. You also have the right to give directives on the fate of your data after your death under Article 85 of the French Data Protection Act.

To exercise any of these rights, email [email protected] from the address linked to your account. We answer within one month, extendable by two months for complex requests. If you are not satisfied, you may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, https://www.cnil.fr/ , or with the supervisory authority of your country of residence.

11. Automated decision-making

The AI-detection score is produced automatically. It is indicative, it produces no legal effect and no similarly significant effect on you within the meaning of Article 22 GDPR, and it is never used to take a decision about you. It is not a certified expert opinion.

12. Children

The service is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has created an account, write to [email protected] and we will delete it.

13. Changes

We update this policy when our processing changes. The date at the top always reflects the current version. Material changes affecting consent will be announced by re-displaying the cookie banner.

=== FIN DU TEXTE EN ===