Privacy · GDPR

Privacy policy

Last updated: 25 October 2026

This policy describes how Jamodio collects, uses and protects users' personal data, in compliance with the General Data Protection Regulation (GDPR — EU 2016/679) and the French Data Protection Act (loi Informatique et Libertés).

In short — We collect only what is strictly necessary to operate the service (email, first name, studios you create). Your data is stored in the European Union (Supabase, Ireland), never resold, and you can delete it yourself from the app (Settings → Delete my account).

1. Data controller

The data controller is Benoît Godard, individual entrepreneur (SIRET 10499100500018), 10 rue Tisserant, 92100 Boulogne-Billancourt, France. Contact: contact@jamodio.com.

No Data Protection Officer (DPO) is designated at this stage, as the activity does not meet the criteria for mandatory designation (Article 37 GDPR).

2. Data collected

2.1 Data you provide directly

Email — used to create your account, send you transactional emails (confirmation, welcome, invitations) and allow you to log in.
First name and last name — requested at sign-up; they are not shown to other musicians.
Nickname — chosen by you; it is what other musicians see (studios, Community, invitations).
Password — stored hashed (bcrypt) by Supabase Auth, never accessible in clear text.
Preferences — language, theme, instruments, audio/video selection, video blur settings. Stored to personalize your experience.
Profile picture (optional) — if you upload one.
Payment data (if you subscribe) — entered directly with Stripe, our payment provider: Jamodio never sees or stores your card number. Your name and billing address, asked for at payment, are stored by Stripe so they appear on your invoices; Jamodio does not copy them. We keep the Stripe customer and subscription identifiers, your plan, its status and its renewal date.
Card used for a free trial — so that a free trial is granted only once per bank card, we keep a scrambled fingerprint of the card used for a trial: a code computed by Stripe from the card number, which we further transform with a secret key. Neither this code nor we can recover the card number. We link it to your account, the Stripe identifier of the trial subscription and its date.

2.2 Data generated by use of the service

Studios you create — name, slug (identifier), creation date, owner.
Participation history — studios joined, dates.
Recordings that you make in a studio (paid plans) — placed in that studio's library (Supabase Storage, Ireland), visible to and downloadable by its members.
Backing tracks that you upload — stored encrypted in Supabase Storage so they can be shared within a studio.
Technical audio metadata — selected instrument, VU level, measured latency. Exchanged between musicians of the same studio to display the mixer. Not stored long-term.

2.3 Automatic technical data

IP address — necessary to establish real-time audio/video connections (WebRTC SFU). It is visible to the audio server but not stored in the database. Kept only in the server's technical logs (maximum 7 days, for diagnosis).
Browser / platform information — browser (Chrome, Edge…), operating system, processor architecture (to suggest the right version of the Audio Engine). Not stored in the database.
Email address of the sender/recipient of email invitations (kept only for the time of sending by Resend, not stored durably).

2.4 Waitlist (before launch)

What we record — your email address, your first name if you give it, the language of the page, the campaign your sign-up came from (an ad, for example), the date and version of the consent you gave, then the confirmation date.
Why — to announce the opening of Jamodio. Legal basis: your consent, given by ticking the box on the form and then confirmed through the link you receive by email (double opt-in). Without that click, we don't email you again.
How long — a sign-up that is never confirmed is deleted after 30 days. A confirmed sign-up is kept for at most 3 years after our last contact. If you unsubscribe, your first name is erased; we keep the address, the language, the source campaign and the dates of consent, confirmation and unsubscription, as proof and so that we never email you again.
Abuse protection — an address receives at most 3 confirmation emails while it is unconfirmed, and none after unsubscribing. To limit automated sign-ups, a fingerprint of your IP address, computed with a secret key, is kept for 24 hours. The IP address itself is not stored.
Who sends the emails — the confirmation email is sent through Resend. The launch announcement will be sent through Brevo (a French company), which will only receive confirmed sign-ups that have not unsubscribed.
Unsubscribing — at any time, through the link in every email, or by writing to support@jamodio.com.

2.5 Support requests and bug reports

What is sent — only when you click “Send to support”: your description, your account email and identifier, your plan, system information (browser, operating system, Audio Engine version, screen, time zone), a reading of your connection during the last session (latency, bitrate, network path type) and Jamodio's technical logs, and only those: those of the Jamodio app in your browser (last 7 days) and those of the Audio Engine (last 3 days). Nothing else from your browser is read: not your history, nor other websites, nor their tabs. These logs describe how the sound works: names of your audio interfaces and plugins, latency and network measurements, studios joined and times, and the folder on your computer where they are kept, which may contain your user name. Jamodio writes no password or login token in them.
Why — to understand and fix the reported problem, and to answer you (performance of the contract; legitimate interest: the reliability of the service).
Who reads them — the publisher only. The report is sent by Resend to the support@jamodio.com mailbox, hosted by OVH SAS (a French company). Messages from the contact form follow the same path to contact@jamodio.com; if the address given matches a Jamodio account, its plan is added to the message, marked “unverified address”, so that subscribers are handled first.
How long — 12 months after the last exchange about your request, then deleted.
On your computer — as long as you send nothing, these logs stay with you: 7 days in the browser, 14 days for the Audio Engine. “Download the bundle” creates a file on your computer without sending us anything.

Currently not collected: no analytics tools (no Google Analytics, Plausible, Matomo…), no third-party trackers, no advertising pixels, no profiling cookies. Only one strictly essential cookie is used to maintain your session. See Cookie policy.

3. Purposes of processing

Your data is used to:

allow you to create an account and authenticate (legal basis: performance of the contract);
provide you with the remote jam service (studios, audio, video) (performance of the contract);
send you essential transactional emails (registration confirmation, studio invitations that you send, support) (performance of the contract);
remind you of the jams you signed up for: an hour before each one, when its room opens, a reminder in the app and an email. Each can be turned off in My account → Notifications; the email also through the link in every reminder (performance of the contract);
let you know about jams looking for one of your instruments, in the app and, unless you have declined, by email: no more than two a week, grouped. You can decline the email when signing up, at any time in My account → Notifications, and in one click from every email (legitimate interest: keeping the community's jams alive);
manage your subscription and its payment (performance of the contract), and keep invoices (legal obligation);
prevent a free trial from being granted more than once with the same bank card (legitimate interest: abuse prevention);
diagnose technical incidents and improve the service (legitimate interest);
respond to your requests (support, questions, GDPR rights) (performance of the contract / legal obligation).

No processing for advertising or commercial purposes is carried out without your explicit consent. You will not receive unsolicited commercial newsletters. Jam alerts are not advertising: they point to free jams held on Jamodio, related to the service you use.

4. Retention period

User account: kept as long as the account is active. Deleted immediately upon your request (Settings → Delete my account, or email to contact@jamodio.com). An active subscription is then cancelled immediately, with no refund for the current period; you are warned before confirming.
Studios, their files, participations and profile picture: deleted with the account.
App notifications: deleted 60 days after being read, and at the latest 90 days after being created; with the account in any case.
Notification email tracking: the record of each reminder sent is kept 90 days, so it is never sent twice; send and unsubscribe counts, 13 months. Deleted with the account.
Private conversations (messaging): deleted with the account, including for the other participant.
Messages and files you posted in other musicians' studios: they stay in those studios, but your name is no longer attached to them.
Invoices and payment history: kept by Stripe on behalf of Jamodio for 10 years, including after the account is deleted, to meet our accounting obligations (article L123-22 of the French Commercial Code). Stripe keeps your email and the technical identifiers of your customer record with them — your card number never reaches Jamodio.
Scrambled fingerprint of a card used for a free trial: 3 years after the trial, then deleted automatically. If you delete your account, it is no longer linked to it but is kept until that date, so that the card does not give right to a new trial.
Technical logs (SFU server): 7 days rolling.
Transactional emails: Resend keeps delivery logs for 30 rolling days (in line with their policy).
DMARC reports: kept for up to 6 months for security analysis.
Support requests, bug reports and contact form messages: 12 months after the last exchange about the request, then deleted.

5. Recipients of the data

Your data is accessible to:

You — in full, via the application interface or upon request.
Other musicians in a studio you join — they see your nickname, your photo or avatar, your instrument and the audio/video streams you voluntarily share.
The publisher (Benoît Godard), strictly for administration and support purposes.
Our technical subprocessors, listed in the Legal notice: Vercel (frontend), Supabase (database + auth, Ireland), OVH (SFU, Gravelines), Scaleway (SFU, Paris), Resend (emails), OVH (support and contact mailboxes), Stripe (online payment).

No data is sold, rented, transferred or shared with third parties for commercial purposes.

6. Transfers outside the European Union

Supabase Inc. and Vercel Inc. are US companies. Jamodio user data is, however, stored exclusively in Supabase's eu-west-1 region (Ireland, European Union) — it does not leave the EU. The Vercel infrastructure deploys the frontend code to a global CDN; only public data (HTML, CSS, JavaScript) transits through it, no personal data.

For payments, Stripe may process some data in the United States (Stripe, Inc.).

Contractual exchanges with these providers rely on the European Commission's Standard Contractual Clauses (SCCs), in accordance with the Schrems II ruling.

7. Your rights

Under the GDPR, you have the following rights regarding your data:

Right of access — obtain a copy of all data concerning you;
Right of rectification — correct inaccurate data (editable by yourself in Settings);
Right of erasure — delete your data (“Delete my account” function in Settings);
Right of portability — receive your data in a structured, machine-readable format (JSON);
Right of objection — object to processing based on legitimate interest;
Right of restriction — request the temporary freeze of processing;
Withdrawal of consent — at any time, for processing based on consent.

To exercise these rights, contact contact@jamodio.com. A response will be provided within a maximum of 30 days.

If you consider that your rights are not respected, you may lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés, the French data protection authority): cnil.fr/fr/plaintes.

8. Data security

Jamodio implements technical and organizational measures to protect your data:

TLS 1.3 encryption for all communications (HTTPS everywhere, WSS for WebSocket);
passwords hashed with bcrypt (never stored in clear text);
JWT authentication signed with automatic signing-key rotation;
Supabase Row-Level Security (RLS) policies to isolate data between users;
server-side rate limiting on the SFU (protection against abuse);
strict HTTP security headers (HSTS 2 years, CSP, X-Frame-Options DENY, etc.).

In the event of a data breach likely to result in a risk to your rights, a notification will be made to the CNIL within 72 hours and, where applicable, to the data subjects as soon as possible.

9. Minors

Jamodio is accessible from the age of 15 (age of digital consent in France, Article 8 GDPR). For users under 15, the consent of a holder of parental authority is required.

10. Changes

This policy may be updated to reflect technical or legal changes. The last update date (at the top of the page) indicates the current version. In the event of a substantial change, active users are notified by email.

This page is provided in English for convenience. The French version prevails in case of any discrepancy.