Privacy Policy

Last updated: July 8, 2026

1. General provisions

This Privacy Policy describes how the Magic Master service (the "Service", "we") collects, uses and protects the personal data of its users (the "You", "User").

By using the Service, you agree to the terms of this Policy. If you do not agree with any of the terms, please do not use the Service.

2. What data we collect

2.1. Data provided by the user

• Email address — when registering an account
• Password — hashed (bcrypt); we never store passwords in plain text
• Telegram ID — when linking a Telegram account
• Audio files — sources processed in memory; finished master retained by tier (Free 1 day / Pro 7 days / Studio 30 days)

2.2. Data collected automatically

• IP address — for rate limiting and security
• User-Agent — browser and device type
• Usage data — pages visited, visit time, in-app actions
• Cookies — for authentication and sessions

2.3. Payment data

• Transaction history — amounts, dates, payment statuses
• We DO NOT store bank card data — payments are processed by YooKassa (Russia) and Telegram Stars (abroad); USD/EUR card checkout is coming later

3. How we use data

Collected data is used to:

• Provide audio mastering services
• Process payments and credit tokens
• Send notifications about mastering status
• Ensure security and prevent fraud
• Improve the quality of the Service
• Send transactional emails (registration confirmation, password reset)
• Send marketing communications (only with your consent)

4. Sharing data with third parties

We share data with the following services:

We do not sell or share personal data with third parties for their own marketing purposes.

5. Data storage and protection

• Data is stored on servers in Russia (VPS HOSTKEY)
• Passwords are hashed using bcrypt
• Secret keys are encrypted with Fernet (AES-128-CBC)
• Connections are protected with SSL/TLS (Let's Encrypt)
• Sources are processed in memory and not kept on disk for the long term
• Database backups are created daily

6. Data retention periods

7. Your rights

You have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data
• Restriction — restrict the processing of your data
• Objection — object to the processing of your data
• Portability — receive your data in a machine-readable format

To exercise your rights, contact us at: privacy@magicmaster.pro

8. Cookies

We use the following types of cookies:

• Necessary — authentication, sessions, security
• Analytics — Google Analytics, Yandex.Metrica, Clarity

You can disable analytics cookies in your browser settings.

9. Data security

We take the following measures to protect your data:

• HTTPS encryption for all connections
• JWT tokens for authentication
• Rate limiting to protect against brute-force attacks
• CORS policy
• Input validation
• Protection against SQL injection (ORM)
• Regular backups

10. Children

The Service is not intended for individuals under 16 years of age. We do not knowingly collect data from children.

11. Changes to this Policy

We may update this Policy from time to time. We will notify you of material changes by email or through the Service. The date of the last update is shown at the top of this document.

12. Governing law

This Policy is governed by the laws of the Russian Federation, including:

• Federal Law No. 152-FZ "On Personal Data"
• Federal Law No. 149-FZ "On Information, Information Technologies and Information Protection"

13. Contact information