Privacy Policy

Effective date: 2026-09-11

This Privacy Policy describes how Intrect ("we") collects, uses, and protects your personal information when you use ArtifactNet. We comply with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA / CPRA), and the Korean Personal Information Protection Act (PIPA).

1. Data Controller

Intrect, contact: privacy@intrect.io

2. Information We Collect

2.1 Account information

• Email address (from Google OAuth or signup form)
• Display name and profile picture (Google OAuth only, optional)
• Subscription tier and billing status
• API keys (stored as bcrypt hashes)
• When an account is first created, a bounded acquisition snapshot: anonymous attribution and Google Analytics client/session identifiers; first and most recent landing path, referrer hostname and campaign labels; and advertising click-identifier type (never its value). We do not store a full referrer URL.

2.2 Audio submissions

• Original audio is never stored by default. On every plan it is decoded into memory, analysed, and discarded within the request lifetime. The only exception is a free-demo Report: sending one attaches the original audio, which that form requires (see § 4.1).
• For the free demo, the analysis result is held in a short-lived (1 hour) server-side cache so the user can press "Report"; after that it is deleted and nothing is stored. Only if the user submits a Report do we archive the spectral analysis (no IP, no filename, no URL) under a random ID.
• For paid tiers (Creator / Pro / Enterprise), we retain the spectral residual and analysis numbers as described in § 4.2 to deliver forensic reports, accuracy review, and support.
• Spectral residual (STFT magnitude, no phase — cannot be converted back into listenable audio)
• Submission metadata (filename, format, duration, file size, submitted URL): paid tiers only. Not retained for the free demo.
• Inference results (verdict, probability, generator predictions, audio format) and forensic features (segment-level scores, internal feature vectors): kept under the retention rules in § 4.

2.3 Usage logs

• Per-day track count for quota enforcement (paid tiers)
• API request timestamps, endpoints accessed, response codes
• IP address. On the free demo it stays transient — the rate-limiter cache holds it for minutes, it is never written to the request log, and it is not included in demo reports. On signed-in API and dashboard requests it is written to the request log and kept for 30 days (§ 4.3), which is how we apply the free allowance per person rather than per account.
• Browser user-agent, stored with the request rather than only in aggregate.
• Browser identifier: a short one-way hash of headers your browser already sends (user-agent, language, encodings, and the Sec-CH-UA client hints). We use it to tell “two accounts on one office connection”, which is normal, from “two accounts in one browser”, which is not. It is not canvas, WebGL, font or device fingerprinting — no script runs on your machine to produce it, and it cannot be reversed into those headers. Deleted with the request log after 30 days.

3. How We Use Your Information

4. What we store (and don't)

We never store the original audio you submit by default — not from the demo, not from the dashboard. The uploaded waveform is processed in memory and discarded immediately after analysis completes. The single exception is a free-demo Report (§ 4.1): sending one attaches the original audio, which that form requires. Nothing is kept unless you press Report.

ArtifactNet is a detection classifier, not a generative model. Nothing you send to us is used to train music-generating AI. We do not build, license, or sell generative audio models.

4.1 Free demo (demo.intrect.io) — zero-retention

Effective 2026-04-22 the free demo operates under a zero-retention policy. What this means in practice:

If you close the browser without pressing Report or Share within 1 hour, every server-side trace of your demo submission is gone.

A shared page is unlisted by default: search engines are told not to index it, and only someone who has the link can open it. You can opt a page into search indexing when you create it. When you create the link we also hand you a management token — keep it, because without an account that token is the only way to take the page down again.

4.2 Paid tiers (Creator / Pro / Enterprise)

Paid subscribers are processed under stricter retention:

4.3 Usage / security logs (all tiers)

5. We Do NOT

• Store the original audio you submit by default. The only exception is a free-demo Report, which attaches the audio because the reported verdict cannot be reproduced without it — and which happens only when you press Report.
• Train generative music or voice models. ArtifactNet is a detector; your submissions never feed a synthesis system, ours or anyone else's.
• Sell, rent, or otherwise monetize your submissions or personal information.
• Share your data with advertisers or marketing platforms.
• Publish, redistribute, or make your audio publicly accessible.
• Use identifying metadata (filename, URL) when improving the classifier — only the numeric residual / feature vectors are used.

5a. Requesting deletion of your submissions

You may email privacy@intrect.io at any time with a request to delete specific submissions (identify by filename, timestamp, or approximate time of use). We will remove them from active storage and any offline improvement set within 30 days. GDPR / CCPA / PIPA deletion requests are handled under the same process.

6. Third-Party Processors

7. International Transfers

Your data may be processed in the United States, the European Union, and the Republic of Korea. Audio you submit for analysis is processed on hardware we operate in South Korea; it is not sent to a third-party inference provider. We rely on Standard Contractual Clauses (SCC) for transfers outside the EU/EEA where applicable.

8. Your Rights

GDPR (EU/EEA users)

• Right of access: request a copy of your personal data
• Right to rectification: correct inaccurate data
• Right to erasure ("right to be forgotten"): delete your account and data
• Right to restrict processing
• Right to data portability: export your data in JSON format
• Right to object to processing based on legitimate interest
• Right to lodge a complaint with your local supervisory authority

CCPA / CPRA (California users)

• Right to know what personal information is collected
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt-out of sale (we do not sell personal information)
• Right to non-discrimination for exercising these rights

PIPA (Korean users)

• 개인정보 열람권, 정정·삭제 요구권, 처리정지 요구권
• 가명처리·익명처리 요구권

To exercise any rights, email privacy@intrect.io with the subject "Data Subject Request". We respond within 30 days.

9. Security

• All API traffic is served over HTTPS / TLS 1.3
• Passwords are hashed with bcrypt (cost factor 12)
• API keys are stored as bcrypt hashes; only the prefix is recoverable for display
• JWT tokens use HS256 with rotating secrets in production environments
• Audio files are processed in sandboxed ffmpeg subprocesses with strict timeouts
• Database backups are encrypted at rest

Despite our safeguards, no system is 100% secure. If you discover a vulnerability, please report it to security@intrect.io.

10. Children

The Service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have collected data from a child, contact us and we will delete it promptly.

11. Changes

We may update this Policy. Material changes will be announced via email and on the dashboard at least 14 days in advance.