Privacy Policy

The studios make photos, music, patterns and other creations from your own choices and material. Results can be wrong or differ from what you expected, and generated music can by chance sound like existing works. This is not legal or professional advice, not a certification and not a guarantee that a creation is free of other people’s rights or fit for a particular use.

Who we are

U-Studio is a service operated by UNIHOLIX OÜ, a private limited company registered in Estonia (registry code 17479878), Sepapaja tn 6, 11415 Tallinn, Estonia. We are the controller of the personal data described in this policy. Contact: ceo@uniholix.com.

What we process and why

The studios are built so that what you create stays with you. Most of the work happens in your browser, and we receive as little as possible.

Camera, microphone, photos and recordings. Your camera, your microphone, the photos you take, the sounds you record and the files you open are processed in your browser on your device. They are never uploaded to us or to anyone else.
Music choices. When you compose music, the page sends our server your menu choices: genre, mood, tempo, key, length and a random number that makes the track repeatable. Our server writes the score from these choices and sends it back. These choices contain no personal data, and we do not keep them after the score has been sent.
Payment data. If you buy a Studio Pass, our payment processor handles your payment. We receive your email address, your country, the amount, the currency and the payment status, together with your confirmation that you wanted the pass to start right away. Our server then gives your browser a pass that it can check for 24 hours. Your card details go only to the payment processor and never reach us.
Emails to us. If you write to us, we use your email address and your message to answer you.
Technical data. Our server uses your IP address for a short time to limit the number of requests and to keep the service secure. Our hosting provider keeps standard request logs, such as the IP address, the time and the page requested. These logs contain no photos, recordings or files of yours.
Data on your device. The page keeps your language, your Studio Pass and the creations you choose to keep in My library in your browser's storage on your device. This data stays on your device. You can delete it at any time in the page or in your browser settings.
No tracking. We do not use analytics or advertising cookies, and we do not use any analytics or advertising trackers.

The studios do not use AI model providers: music and patterns are made by rules, on our server or in your browser, and photo effects run in your browser.

We do not sell your personal data, we do not use it for advertising, and we never see or use what you create.

The service is for people aged 13 or older (or the higher minimum age in their country), people under 18 may use it only with the permission of a parent or guardian, and we do not knowingly process personal data of younger children.

Legal bases

Contract (GDPR Art. 6(1)(b)): running the studios you use, delivering your Studio Pass, taking your payment and answering your questions about a purchase.
Legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing fraud and abuse, and answering other messages.
Legal obligations (Art. 6(1)(c)): keeping accounting records, including payment records, as Estonian law requires.

Who processes it for us

We use service providers that process personal data on our behalf and on our instructions. We describe them here by category.

Payment processor: takes payments and emails your receipt. It also processes payment data as an independent controller for its own legal duties, such as fraud prevention, under its own privacy policy.
Hosting provider: runs the website and our server, and keeps request logs.
Email provider: receives and stores the emails you send us.

Some of these providers process data outside the European Economic Area, for example in the United States. Where they do, the transfer relies on an adequacy decision of the European Commission or on the Commission's Standard Contractual Clauses.

How we protect it

All connections to the service and to our providers are encrypted. Access to our systems is limited to the people who need it and is protected by two-step sign-in. Card details are handled only by our payment processor.

How long we keep it

Payment records, including your confirmation that the pass should start right away: 7 years, as the Estonian Accounting Act requires.
Photos, recordings and files: we never receive them. What you keep in My library stays in your browser until you delete it.
Music choices: we do not keep them after the score has been sent.
Emails to us: as long as we need them to deal with your request, and no longer than 2 years after it is closed, unless they are part of accounting records.
Request and security logs: up to 2 years. Data used to limit requests is held in memory only, for a few minutes.

Your rights

You can ask us to give you access to your personal data, to correct it or delete it, to restrict its processing or to stop processing it, and to give you a copy in a portable format.

To use these rights, email ceo@uniholix.com. We answer within one month. If a request is complex, we may need up to two more months, and we will tell you so within the first month. If you have not bought a Studio Pass, we usually hold no personal data about you other than request logs.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI, www.aki.ee) or to the data protection authority in the country where you live or work.

Additional notices for some regions

California. If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the right to know what personal information we collect, use and disclose, the right to have it deleted, the right to have it corrected, and the right not to be discriminated against for using these rights. We do not sell or share your personal information, as those terms are defined in that law. To use your rights, email ceo@uniholix.com.

United Kingdom. If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 give you the rights described above. You can also complain to the Information Commissioner's Office (ICO).

Brazil. If you are in Brazil, the General Personal Data Protection Law (LGPD) gives you rights that include confirmation that we process your data, access, correction, anonymisation, blocking or deletion, portability, and information about who we share it with. To use these rights, email ceo@uniholix.com. You can also complain to the National Data Protection Authority (ANPD).

Republic of Korea. If you are in the Republic of Korea, the Personal Information Protection Act (PIPA) gives you the right to access your personal information and to ask us to correct it, delete it or stop processing it. To use these rights, email ceo@uniholix.com. Your personal information is processed outside Korea by the service providers described in this policy.

Changes

We may update this policy when the service or the law changes. The current version is always on this page. If a change significantly affects how we process your personal data, we will announce it on the service before it takes effect.