orto.band is operated by Ortomate Ltd (NZBN 9429052636967), a company registered in New Zealand. We comply with the New Zealand Privacy Act 2020 and the thirteen information privacy principles it establishes. This policy explains what we collect, why, and what control you have.
1. What we collect
Your account
You can sign in with Google or with an email magic link. If you use Google, we receive your name, email address, and profile photo through OAuth. If you use a magic link, we receive your email address. We store this in our database to identify your account. We never receive your Google password, and we do not access your contacts, calendar, or files.
Your conversations with Muso
When you describe an album, your messages to Muso (our AI musician) are stored so we can compose your music and let you return to the project later. They are used only to create your album.
Audio you upload
If you give Muso audio to build around (an upload, a recording, or a hummed tune), we store it in a private, access-controlled bucket and use it only to compose your album. Before we use uploaded audio, you must confirm you hold the rights to it. Personal and uploaded audio is never made world-readable by us.
Your albums
We store the tracks, cover art, and details of albums composed for you so you can play and download them. Albums are private by default. If you choose to make an album public, anyone with its link can view and download it until you set it private again. You control this from the album page at any time.
Payments
Payments are handled by Stripe. Your card number, expiry, and security code go directly to Stripe. We never see or store your card details. We receive a confirmation of payment and your email address from Stripe.
Emails
We send transactional emails (sign-in links, purchase receipts, and album-ready notices) through Resend. We do not send marketing emails or add you to any mailing list.
2. How we store your data
Your data is stored in a Supabase-hosted PostgreSQL database and object storage, encrypted in transit (TLS) and at rest. The website is operated by Vercel, and some audio processing runs on Railway. These providers maintain industry-standard security practices.
3. Who we share data with
We share data only with the service providers needed to run orto.band:
- Supabase - database, authentication, and file storage
- Vercel - website hosting
- Railway - audio processing services
- Stripe - payment processing
- Anthropic- the AI behind Muso’s conversation and composition (your messages are sent to Anthropic’s API; Anthropic does not use API inputs to train its models)
- ElevenLabs - music and voice generation
- Resend - transactional email delivery
We do not sell, rent, or trade your personal information, and we do not share it with advertisers.
4. Cookies
We do not use tracking or advertising cookies. When you sign in, Supabase sets an authentication cookie to keep you logged in. This is a functional cookie required for sign-in to work.
5. Your rights under the Privacy Act 2020
Under New Zealand’s Privacy Act 2020, you have the right to:
- Access - request a copy of the personal information we hold about you
- Correction - ask us to correct inaccurate information
- Deletion - ask us to delete your data, which we will do unless we have a lawful reason to retain it (such as financial records required by tax law)
To exercise any of these rights, email muso@orto.band. We will respond within 20 working days as required by the Act.
6. Children
orto.band is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
7. International transfers
Our service providers operate servers outside New Zealand, primarily in the United States. By using orto.band, you acknowledge that your data may be processed in countries with different privacy laws. We only use providers with appropriate data protection practices.
8. Data retention
We retain your account, conversations, uploads, and albums until you delete them or delete your account. Financial records are retained as long as the law requires.
9. Changes to this policy
We may update this policy from time to time. The “last updated” date at the top of this page will change when we do. Material changes will be noted here.
10. Contact and complaints
If you have questions or concerns about your privacy, email muso@orto.band. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner (Te Mana Matapono Matatapu).