Legal
Privacy
What Composer Assistant collects, why, where it's kept, for how long, and how to see or delete yours.
Last updated 29 September 2026
In plain English
- We collect little. Your email address, your sign-in and usage records, and the musical input you send us to generate takes.
- We use it only to run Composer Assistant. No ads, no trackers, no analytics in the plugin or on composerassistant.com. We don't sell your information.
- We never train on your music. Your files, recordings, MIDI, descriptions and takes are never used to train our AI models.
- Your takes live on your computer. Audio you upload is deleted from our server right after it's analyzed. Generated audio is deleted from our server after 48 hours.
- Some records we keep longer. Your text descriptions, the musical data we read from your input (notes, chords, tempo), generated MIDI and server logs. Right now we don't delete these automatically; we're setting a 30-day limit. You can ask us to delete yours at any time.
- Where: account servers in Canada, the generation server in Norway, email sent through Amazon Web Services in London.
- Your data, your call. Ask us for a copy, a correction or deletion at hi@cinematiccomposing.com.
The full policy
1. Who we are
Composer Assistant is run by Cinematic Composing LLC, Lake Forest, California, USA ("we", "us"). We're responsible for the personal information described here. This policy covers the Composer Assistant plugin and app, the account website at composerassistant.com and the cloud service that generates takes. You buy Composer Assistant on our Cinematic Composing checkout at cinematiccomposing.com; that website is covered by its own terms. When you buy, the checkout passes your purchase to Composer Assistant so we can open your account.
2. What we collect, and why
| What | Where it comes from | Why we use it |
|---|---|---|
| Email address | You, or Cinematic Composing's checkout when you buy | Your account, sign-in and messages about your account |
| Purchase record — plan, purchase date | Cinematic Composing's checkout (it also sends your name, which we don't keep) | To open your account and give you your plan |
| Sign-in records — when you asked for a sign-in link and the IP address you asked from; the plugin's sign-in tokens and the software information its sign-in request sends | You and the plugin | To sign you in and keep your account secure |
| Usage records — for each take: when, how much of your allowance it used, and the kind of take | The plugin | To run your plan and your usage allowance |
| Your input — files you drop in, microphone recordings, MIDI captured from your DAW, the descriptions you type, and your settings | You, through the plugin | To analyze it and generate your takes |
| Generation records — your description, your settings and the musical data we read from your input (notes, chords, tempo); generated MIDI | Our generation server | To deliver your takes and to find and fix problems |
| Technical logs — IP address, the software and language your requests report, the time and the address requested | Your browser and the plugin | Security, preventing abuse, and fixing problems |
| Messages you send us | You | To answer you |
Cookies. composerassistant.com uses one cookie, which keeps you signed in and protects your account; it lasts up to 30 days. Your browser also remembers whether you chose the light or dark theme. Both are needed for things you ask for, so we don't ask for consent. We use no advertising or analytics cookies. The plugin keeps its sign-in token on your computer for up to 90 days.
Your microphone. The plugin uses your microphone only when you record an idea. We use recordings only to read the musical idea — never to recognize or identify you by your voice, and we don't create voice prints.
When your input is sent. When you drop a file, record an idea or capture MIDI from your DAW, the plugin sends it to our generation server to analyze it. This can happen before you press Produce.
What we don't collect. No payment card details (payments are handled by Cinematic Composing's payment providers, Stripe and PayPal). No analytics, tracking or crash reporting in the plugin. No advertising pixels on composerassistant.com.
3. What we don't do
- We don't sell your personal information, and we don't share it for advertising. We haven't done either in the past 12 months.
- We never use your input, anything we derive from it (such as notes, chords and tempo), or your takes to train, retrain or fine-tune any AI model, ours or anyone else's, and we never sell or license them for AI training. This promise is part of our Terms of use: it can change only through a separate opt-in that is off by default, and anyone who takes over Composer Assistant must keep it.
- We make no decisions about you by automated means that have legal or similarly significant effects.
4. Our legal reasons (EU and UK)
- To provide the service you bought (performance of a contract): your account, sign-in, plan, usage records, your input and generation records.
- Our legitimate interests in keeping Composer Assistant secure and working: technical logs and sign-in records.
- To meet legal obligations, such as keeping purchase records for tax.
We need your email address to create your account; without it we can't provide Composer Assistant.
5. Who we share it with
We share personal information only with the service providers that help us run Composer Assistant, and only for that purpose:
| Provider | What they do for us | Where |
|---|---|---|
| OVHcloud | Hosts our account servers and database | Quebec, Canada |
| Hyperstack (NexGen Cloud) | Hosts our generation server | Norway |
| Amazon Web Services | Sends our emails (sign-in links, account messages) | London, UK |
| Cloudflare | Runs our domain names (DNS only; your traffic doesn't pass through it) | Global |
| Stripe and PayPal | Process payments at checkout | Their own locations |
We may also share information when the law requires it, or with a company that takes over Composer Assistant — for example, a company we set up to run it, or a buyer of the business. That company would have to keep this policy and our promise never to train on your music, and we'd tell you before the switch.
6. Where your information is kept
We're a US company, and when you use Composer Assistant you send your information to us directly. We keep it in Canada and the UK, which the EU recognizes as giving adequate protection, and in Norway, which is inside the European Economic Area. Our team accesses it remotely, including from the United States.
7. How long we keep it
| What | How long |
|---|---|
| Account and purchase records | While you have an account, and after that as long as the law requires us to keep purchase records |
| Audio files you upload | Deleted from our server right after they're analyzed |
| MIDI files you upload | Processed in memory, not saved as files |
| Generated audio on our server | Deleted after 48 hours — your takes are saved on your own computer |
| Generation records and generated MIDI | Right now, kept until deleted — we don't yet delete them automatically. We're setting a 30-day limit and will update this page when it's in place. Ask us any time and we'll delete yours |
| Technical logs | Right now, kept until deleted — we don't yet delete them automatically. We're setting a 30-day limit and will update this page when it's in place |
| Sign-in links | Expire after a short time |
8. Your rights
You can ask us to:
- give you a copy of your personal information;
- correct it;
- delete it;
- stop or limit how we use it, or object to a use.
Email hi@cinematiccomposing.com from the address on your account. We may need to confirm it's you. We answer within one month.
- In the EU or the UK, you can also complain to your data protection authority.
- In California, you have the right to know what we collect, to delete it and to correct it, and we won't treat you differently for using these rights. We don't sell or share personal information as California law defines those terms. Your sign-in details count as "sensitive personal information" there; we use them only to sign you in and keep your account secure.
9. Security
- Sign-in links and plugin sign-in tokens are stored on our servers only in scrambled (hashed) form.
- Connections between the plugin, your browser and our servers are encrypted (HTTPS).
- The plugin keeps its sign-in token in a settings file on your computer. Signing out from the plugin removes it.
No system is perfectly secure. If a breach affects your information, we'll tell you as the law requires.
10. Children
Composer Assistant isn't meant for children under 16, and we don't knowingly collect their information. If you think a child has given us information, tell us and we'll delete it.
11. Changes to this policy
We'll post any change here with its date. If a change materially affects you, we'll email you before it takes effect.
12. Contact
Cinematic Composing LLC · Lake Forest, California, USA · hi@cinematiccomposing.com