Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Jacopo Di Loreto (AFTERTOUCH LABS DI DI LORETO JACOPO), Via Europa 18, 66020 San Giovanni Teatino (CH), Italy, VAT no. IT02882890698 ("Processor", "we") and a business customer ("Controller", "you") that uses LIA for its own users, for example a school, a studio or a label. It applies when the Controller is established in the European Economic Area (EEA), the United Kingdom or Switzerland, or when the GDPR applies to the Controller's processing. For people who use LIA for themselves, we are the controller and our Privacy Policy applies.
1. Definitions
Terms in this DPA have the meaning given to them in Regulation (EU) 2016/679 ("GDPR"). "Personal Data" means any information relating to an identified or identifiable natural person.
2. Subject Matter and Duration
The Processor processes Personal Data on behalf of the Controller only to provide the LIA Service as described in the Terms of Service. This DPA remains in force for the duration of the service contract and for the retention periods that follow its end (§11).
3. Nature and Purpose of Processing
Processing is limited to the operations needed to deliver the LIA Service:
- account management: sign-in, plan and payments;
- chats, written, dictated or spoken in Talk Mode, and their processing by the artificial intelligence provider;
- reading the open Ableton Live set and the list of installed plugins through the LIA app and the LIA Bridge, and writing the requested work into Live;
- chat memory, job logs, plan usage, voice minutes and dictation seconds;
- Community and Support;
- security, error monitoring and backups.
4. Categories of Personal Data and Data Subjects
Data Subjects: the users the Controller authorises to use LIA (for example students, staff, musicians, contractors).
Personal Data: email addresses and, if a user signs in with another account, the identifier, name, username and profile picture that service passes to us; passwords, stored only as a one-way hash by the authentication provider; profile names and the name chosen in Settings; plan, subscription, redeemed codes and payment metadata (no card details), withdrawal requests and the partner code used, if any, and the name, email and invoice address in the payment provider's notices; when a user accepts the Terms and the Privacy Policy in the app or asks to start a plan right away, the record of that acceptance or request; chat messages, including the text of Talk Mode calls and the dictated messages that the user sends; data read from the Live set (tempo, key, tracks and their names, devices and their parameters, mixer and levels, clips with their MIDI notes, locators, preset names) and the plugin list; chat memory, job logs and usage counters, including voice minutes and dictation seconds; Community posts, comments, votes, reports and sanctions; Support messages and screenshots; notification preferences and the "Use my chats to improve LIA" permission; technical data such as app version, system and language, errors and technical traces of model calls; website and email statistics linked to the account (pages viewed; delivery, opening and clicks of emails); IP addresses, with country and browser or app version, kept in full in the server access logs for about 30 days and in the sign-in and security logs for 12 months. The Processor stores no audio: the audio of Talk Mode goes from the app directly to the voice provider, and the audio of dictation passes through the LIA server only to be turned into text.
The Service is not meant for special categories of data (Art. 9 GDPR). The Controller must not ask its users to enter such data in LIA.
5. Obligations of the Processor
- Process Personal Data only on documented instructions from the Controller, including transfers to third countries (Art. 28(3)(a) GDPR). The Terms of Service, this DPA and the settings the Controller uses in the app are the Controller's instructions.
- Ensure that persons authorised to process Personal Data are bound by confidentiality.
- Implement appropriate technical and organisational security measures (Art. 32 GDPR), see §9.
- Engage Sub-processors only with the Controller's general written authorisation (see §8).
- Assist the Controller in responding to data subject requests (Art. 15-22 GDPR) and with Art. 32-36 GDPR obligations, taking into account the nature of the processing.
- Notify the Controller without undue delay of any Personal Data breach (Art. 33 GDPR), see §10.
- At the Controller's choice, delete or return all Personal Data at the end of the services (Art. 28(3)(g) GDPR), see §11.
- Make available the information needed to demonstrate compliance with Art. 28 GDPR and allow audits, carried out with reasonable notice, during business hours and without access to other customers' data (Art. 28(3)(h) GDPR).
6. Obligations of the Controller
The Controller confirms that it has a lawful basis (Art. 6 GDPR) for the Personal Data processed under this DPA, that it has informed Data Subjects in accordance with Art. 13/14 GDPR and, where users are under 16, that it has collected the parents' consent before giving them access to LIA.
7. Where data is processed and international transfers
The LIA server runs on a rented virtual server in Germany (Hostinger), and the database and authentication are in the European Union region of Supabase. Some Sub-processors process data outside the EEA, in particular the artificial intelligence provider (OpenAI, United States). These transfers are governed by:
- the EU-US Data Privacy Framework (DPF), where the recipient is certified;
- otherwise, the Standard Contractual Clauses (SCCs) adopted by Commission Decision (EU) 2021/914, Module 3 (processor to sub-processor).
8. Sub-processors
The Controller gives the Processor a general authorisation to engage Sub-processors. The current Sub-processors, with their country, are named in §4 and §5 of our Privacy Policy. The full list, with the transfer basis and the data processing agreement of each one, is available on request at privacy@liaplugin.com: we send it within 7 days. The Processor will tell the Controller about any intended change at least 30 days in advance; the Controller may object for reasonable grounds related to data protection, and if no solution is found it may terminate the service without penalty. The Processor imposes on each Sub-processor data protection obligations equivalent to those in this DPA and remains responsible for them.
9. Security Measures (Art. 32 GDPR)
- Encryption in transit (TLS) for the website, the app and the server.
- Database managed by Supabase with encryption at rest; nightly backups of the server and the database, encrypted on the server before they leave for the backup storage (Backblaze, United States).
- Sign-in checked on every request to the LIA server, with per-account limits; database rules that let each user see only their own data.
- Internal server services reachable only from the server itself or from our private network; administrative access only with SSH keys or from panels protected by a dedicated sign-in.
- Access logs without query strings and without headers that carry keys or tokens; automatic deletion of logs and traces at the end of their retention period.
10. Personal Data Breach Notification
The Processor will notify the Controller without undue delay, and in any case within 48 hours of becoming aware, of any breach affecting Personal Data processed under this DPA, so that the Controller can meet its 72-hour deadline. The notification will include, as far as known at that moment:
- the nature and approximate scope of the breach;
- the categories and approximate number of Data Subjects and records affected;
- the likely consequences and the measures taken or proposed;
- a contact for further information: privacy@liaplugin.com.
11. End of the services
When the service contract ends, and at the Controller's written request, the Processor deletes or returns all Personal Data, except data it must keep by law (for example payment and tax records). Deleted data disappears from the encrypted backups within 63 days.
12. Liability
Liability under this DPA follows the Terms of Service, except where that would limit the rights of Data Subjects under Art. 82 GDPR.
13. Governing Law and Jurisdiction
This DPA is governed by the laws of the Republic of Italy. The competent court is the court of the Controller's registered office, or where this is outside the EEA, the court of Abruzzo, Italy.
14. Contact
For all matters related to this DPA: privacy@liaplugin.com