Privacy Policy

Chordict (www.chordict.com) is operated by Mehmet Akif VARDAR, a sole proprietor established in Türkiye. For the purposes of the General Data Protection Regulation (GDPR) and other applicable data-protection laws, Mehmet Akif VARDAR is the data controller.

Contact for all privacy matters: info@chordict.com

We collect the following categories of personal data:

We do not collect special-category data (health, biometric, political, etc.).

We process your data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): Creating and maintaining your account, processing audio uploads, storing analysis results, managing your subscription, and sending OTP verification codes. Without this processing we cannot provide the service.
• Legitimate interests (Art. 6(1)(f) GDPR): Protecting the service against abuse and bots (hCaptcha), maintaining error logs for debugging, enforcing rate limits to ensure fair use, and detecting billing currency from IP address. Our legitimate interests are proportionate and do not override your rights.
• Consent (Art. 6(1)(a) GDPR): Operating Google Analytics to understand site usage and improve the product. You can withdraw this consent at any time via the cookie widget (🍪) at the bottom-left of every page.

We do not sell your personal data. We share it only with the service providers (data processors) needed to operate Chordict, each bound by data-processing agreements.

Named processors

Additional sub-processors (by category)

The following categories of processors handle data solely to deliver core features. We do not publicly name them to protect operational security, but will identify them on request sent to info@chordict.com.

• Cloud database, authentication & file-storage provider: Stores all account data, analyses, audio files, and authentication state.
• Transactional email provider: Delivers OTP verification codes, password-reset emails, contact-form and feedback relay, and subscription & account lifecycle notifications (trial started, subscription canceled, account deleted). Email address, recipient name, and the relevant message or subscription details are transmitted.
• AI speech-to-text provider: Converts your uploaded audio file into a text transcript. The audio is transmitted for processing; we do not retain audio on this provider's systems beyond their standard processing window.
• AI text-formatting provider: Receives the text transcript (no audio) to reformat it into labeled lyric sections.
• Cloud audio-analysis service (EEA-based): Performs chord detection on your audio using a proprietary model hosted within the European Economic Area. Only a time-limited download link and a job identifier are transmitted; no permanent copy is retained.
• User avatar image CDN: Delivers profile images linked by https URL. Only standard request headers are transmitted.
• Cloud hosting & infrastructure provider: Runs the website and API servers and processes connection metadata (IP address, request logs, User-Agent) needed to deliver the service.

Some processors are located outside the European Economic Area (EEA). Where this is the case, we rely on the European Commission's Standard Contractual Clauses (SCCs) or other adequacy mechanisms provided by each processor's data-processing agreement to ensure an equivalent level of protection.

Depending on your location, you may have the following rights. To exercise any of them, email info@chordict.com or use the self-serve tools at Account Settings. We will respond within 30 days.

• Access: Request a copy of the personal data we hold about you (self-serve JSON export available).
• Rectification: Correct inaccurate profile data — email us and we'll update it for you.
• Erasure: Delete your account and all associated data (self-serve account deletion available).
• Portability: Receive your data in a structured, machine-readable format (self-serve JSON export available).
• Restriction: Ask us to stop processing your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Withdraw your analytics consent at any time via the 🍪 widget.
• Lodge a complaint: EU/EEA/UK residents may lodge a complaint with their national supervisory authority. Turkish residents may contact the Personal Data Protection Authority (KVKK, www.kvkk.gov.tr).

California residents: We do not sell or share your personal information for cross-context behavioural advertising. You have the right to know, delete, and opt-out under the CCPA/CPRA.

We protect your data using HTTPS encryption, JWT-based authentication, short-lived signed storage URLs, Content Security Policy with per-request nonces, magic-byte validation for uploaded files, and rate limiting on all sensitive endpoints. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

Chordict is not intended for users under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us at info@chordict.com so we can delete it.

We may update this Privacy Policy at any time. Any changes take effect as soon as they are posted on this page, and the “Last updated” date at the top of this page always reflects the current version. Please review this page periodically to stay informed.

Questions or requests: info@chordict.com