whichmix?
Sign in

Privacy Policy

Last updated 6 October 2026

1. Who we are

Pristine3D Limited (“we”, “us”) is the controller of the personal data described here. We are based in Nigeria and operate WhichMix. Questions, requests, and complaints: [email protected].

2. The short version

  • We collect what it takes to run WhichMix — nothing else. No ads, no trackers, no selling data.
  • Your music is private by default: only people you grant access to can reach it.
  • We never use your content to train AI, and we never listen to it for anything but running the service.
  • We do not delete your work automatically; deleting is something you do.

3. What we collect

  • Account data. Your name, email address, password (stored only as a bcrypt hash), verification status, and the last time you signed in — plus, if you choose Google sign-in, your Google identifier and profile image.
  • Your work. The files, audio, artwork, lyrics, titles, credits, notes and comments (text and voice, with their timestamps), approvals, and activity history that you and your collaborators put into a workspace.
  • Collaboration data. Email addresses you invite and the roles you give; share links you create (their optional PINs are stored hashed); and play receipts — the fact that a version was played, when, and how far it got. A receipt identifies a signed-in member, or just the link a guest arrived through; we do not record visitors’ IP addresses in them.
  • Billing data. Your plan, subscription status, and transaction references. Card details are handled by Creem, our merchant of record, and never reach us.
  • Technical data. The cookies needed to sign you in and to unlock a PIN-protected link; security and delivery records, including server logs (which may briefly include IP addresses) and delivery events from our email provider.

4. How we use it, and why

  • To provide the service — accounts, storage, playback, notes, approvals, sharing. This processing is part of our contract with you.
  • To send service email — invitations, uploads, notes, approvals, and the digest of what changed. These are part of how the product works, so they are part of the contract too.
  • To keep accounts and workspaces secure, stop abuse, and enforce our Terms — our legitimate interest in protecting the service and its users.
  • To support you and meet legal obligations — tax, accounting, and lawful requests.

We do not build advertising profiles, and we do not use your data or content to train AI.

5. What we never do

  • We do not sell or rent your personal data.
  • We do not run advertising or third-party tracking in the product.
  • We do not train AI models on your content — or anyone else’s.
  • We do not go through your files. Our support and admin tools show metadata, roles, and history, not audio.
  • We do not publish or promote your work without your written permission.

6. Who we share data with

Only the providers it takes to run WhichMix, and only with what they need:

  • Cloudflare — R2 object storage, where your files live;
  • our hosting provider — the server and database that run the application;
  • Zoho ZeptoMail — transactional email (invitations, notifications, digests);
  • Creem — payments, as merchant of record;
  • Google — only if you choose to sign in with Google.

We may also disclose data where the law requires it, or where it is needed to enforce our Terms or protect rights and safety; where we can, we will tell you about a legal request. If the business is involved in a merger or acquisition, data may transfer with it under this policy.

7. Where your data is processed

We are based in Nigeria, and our providers run infrastructure in other countries, including the European Union and the United States. Your data may therefore be processed outside the country you live in. Where the law requires safeguards for those transfers, we rely on our providers’ measures, such as standard contractual clauses.

8. How long we keep it

  • Your work — until you or someone with access deletes it. When a file or version is deleted, the stored bytes are removed; the workspace’s activity log keeps a tombstone — what was deleted, by whom, and when — so the song’s history stays accurate. A tombstone never contains the file.
  • Account data — for as long as your account exists. If you ask us to delete your account, we remove your personal data within 30 days, except what we must keep for legal reasons (billing records live with Creem as the seller of record).
  • Backups — daily backups are kept for 30 days, and monthly backups for up to 12 months. Content deleted from the live service can remain in those backups until they rotate out; we do not restore deleted content on request.

9. Your rights

Depending on where you live — for example under the EU/UK GDPR or Nigeria’s data protection law — you may have the right to a copy of your data, correction, deletion, restriction, objection, and portability. Write to [email protected] and we will answer within 30 days. Much of this you can already do in the app: download your files, and delete songs, versions, and notes. If you are not happy with our answer, you can complain to your local data-protection authority (in Nigeria, the Nigeria Data Protection Commission).

10. Security

We protect your data with TLS in transit; bcrypt-hashed passwords; private object storage reachable only through WhichMix’s access checks; per-role permissions on every change; share links you can revoke and PIN-protect (PINs are hashed too); and staff tools that expose metadata rather than audio. No system is perfectly secure, but if a breach ever affects your data we will notify you and the authorities as the law requires.

11. Cookies

We use only what the service needs: a session cookie to keep you signed in, a CSRF protection cookie, and — only if you unlock a PIN-protected share link — an unlock cookie for that link. We do not set analytics, advertising, or third-party tracking cookies.

12. Children

WhichMix is for people aged 16 and over, and we do not knowingly collect personal data from younger children. If you believe a child has created an account, write to us and we will delete it.

13. Changes

If this policy changes, we will post the new version here and update the date above. For material changes we will give notice by email or in the app before they take effect.

14. Contact

Pristine3D Limited, Nigeria — [email protected].