Privacy & Data Protection Policy

1. Data Controller & Data Protection Officer (DPO — Art. 41 LGPD / Art. 37 GDPR)

Sample Box acts as the Data Controller for personal data processed on this platform. To exercise any rights under the Brazilian General Data Protection Law (LGPD — Law No. 13.709/2018) or the EU General Data Protection Regulation (GDPR), you can use the self-service privacy controls inside your Profile or contact our Data Protection Officer (DPO) at: privacy@samplebox.ai.

2. Data Collected & Legal Bases (Arts. 7 & 11 LGPD / Art. 6 GDPR)

• Account & Authentication Data: Email address, artist/full name, and encrypted credentials via TLS/bcrypt (Legal Basis: Performance of a Contract — Art. 7, V LGPD / Art. 6(1)(b) GDPR).
• Optional Profile Data: Phone number, age, city, and profile photo (Legal Basis: Freely given and revocable consent — Art. 7, I LGPD / Art. 6(1)(a) GDPR).
• Audio & Voice Files: Songs and vocals uploaded for isolation or timbre conversion are processed temporarily in an isolated environment and remain available in your local History for up to 7 days for download, after which they are automatically purged.
• Payment Data: All subscription and Multi-Kit transactions are processed directly by Stripe (PCI-DSS Level 1 certified). Sample Box never stores credit card numbers.
• Access Logs: Retained securely for the statutory period of 6 months in strict compliance with Art. 15 of the Brazilian Civil Rights Framework for the Internet (Law No. 12.965/2014).

3. Data Subject Rights (Art. 18 LGPD & Arts. 15–20 GDPR)

You have full, immediate control over your personal data directly inside the Profile modal:

• Portability & Access: Use Export My Data (JSON) to download all your account details and history in a machine-readable package.
• Erasure & Consent Revocation: Use Clear Personal Data to immediately wipe optional profile fields, avatar, and local history.
• Rectification: Edit your name, phone, and location directly in your account settings.

4. Information Security (Art. 46 LGPD & Art. 32 GDPR)

We enforce encryption in transit (TLS 1.3 / HSTS), strict HTTP security headers (Content-Security-Policy, X-Frame-Options DENY, X-Content-Type-Options nosniff), login brute-force lockout protection, binary file signature validation (magic bytes), per-IP rate limiting, and automatic session storage purging upon sign-out.