← lode
ITLegal documents

Draft — pending legal review

This text is a working draft prepared for review by legal counsel. It has not yet been verified and may change before final publication.

Privacy Policy

Information on the processing of personal data provided under arts. 13 and 14 of Regulation (EU) 2016/679 («GDPR») to users of the LODE (lode.fm) application.

1. Data controller

The data controller is [COMPANY BEING INCORPORATED]. Contact for any privacy matter: legal@lode.fm. Full corporate details will be published upon the company’s incorporation (see the Service Provider Information page).

2. What data we process, for what purposes, on what legal bases

a) Account

Email, password (in encrypted form), date of acceptance of the Terms and age declaration. Purpose: creating and managing the account. Legal basis: performance of the contract (art. 6.1.b GDPR).

b) Social profile and chat (opt-in)

Display name, handle, bio, avatar, external links, follow relationships, 1:1 messages. The social features are optional and private by default: nothing is visible or discoverable until the user explicitly enables each visibility setting (private / followers / public), which can be changed at any time. Purpose: providing the requested social features. Legal bases: performance of the contract (art. 6.1.b) and, for publishing data according to the chosen visibilities, the consent expressed via the relevant toggles (art. 6.1.a), which can be withdrawn at any time from the settings.

c) Local library

For the music library we process metadata only (titles, artists, tags, musical characteristics) and numeric vectors computed on the device: the audio files never leave the user’s device (privacy by design, art. 25 GDPR). Purpose: search, organisation and recommendations. Legal basis: performance of the contract (art. 6.1.b).

d) Cart

References to tracks the user intends to buy on the source platforms. Purpose: operation of the cart. Legal basis: performance of the contract (art. 6.1.b). LODE does not process payment data: purchases take place entirely on the source platforms.

e) Security and technical logs

Technical logs, session identifiers, labels of connected devices (browser/operating system). Purpose: account security, abuse prevention, technical operation. Legal basis: the controller’s legitimate interest in the security of the service (art. 6.1.f).

We do not process special categories of data (art. 9 GDPR) and do not take decisions based solely on automated processing producing legal effects on the user (art. 22 GDPR). Music recommendations are based on track characteristics and expressed preferences, not on advertising profiling.

3. Data processors (art. 28 GDPR)

To provide the service we rely on the following suppliers, appointed as data processors:

  • Supabase — database, storage and authentication;
  • Vercel — application hosting;
  • Replicate — GPU processing for stem separation of user-uploaded files;
  • Inngest — execution of asynchronous jobs;
  • Anthropic and Google — automatic classification of textual music metadata only (no personal data beyond such metadata);
  • Upstash — request rate limiting.

4. Transfers outside the EU

Some of the suppliers listed above are based in, or process data in, the United States. Transfers are supported by the Standard Contractual Clauses approved by the European Commission (art. 46.2.c GDPR) and, where applicable, by the adequacy decisions in force.

5. Retention periods

  • Account data: for the entire life of the account; on closure, the linked data is deleted.
  • Chat messages: at most 24 months from sending.
  • Notifications: 90 days if read, 180 days if unread. Deletion occurs via an automatic purge.
  • Technical logs: for the time strictly necessary for security purposes.

6. Data subject rights

The user may exercise at any time the rights under arts. 15-22 GDPR: access, rectification, erasure, restriction, data portability, objection, and withdrawal of consent given (without prejudice to the lawfulness of processing prior to withdrawal). Requests should be sent to legal@lode.fm.

The right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of your member state of residence remains unaffected.

7. Minimum age

The service is reserved for those who have turned 14, the threshold set in Italy for a minor’s digital consent (art. 2-quinquies of Legislative Decree 196/2003). An explicit age declaration is required at registration.

8. Cookies and local storage

LODE uses technical cookies only. For details see the Cookie Policy.

9. Updates

This notice may be updated, for example in the event of new features or changes of suppliers. Substantial changes will be signalled through the service.

Last updated: September 2026