Legal
Last updated: 15 August 2026
Draft — pending legal review
This document was prepared against standard industry practice and how the Service actually processes data. It has not been reviewed by a qualified lawyer and is not yet a binding commitment. Do not rely on it for a compliance assessment, and do not present it to a customer as final.
NEXT_PUBLIC_LEGAL_* environment variables with your registered entity details before accepting paid traffic. Run npm run env:check -- --production to see which are missing.This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Engineer") and Treeline Audio ("tothemixhub", "we"). It applies whenever you use the Service to process personal data relating to your clients, collaborators, and reviewers.
Version 2026-08-15. Terms defined in the UK GDPR and EU General Data Protection Regulation (Regulation (EU) 2016/679) (together, "Data Protection Law") have the same meaning here.
The Service processes two distinct categories of personal data, and the parties hold different roles for each. This distinction determines who is responsible for responding to a data subject.
For personal data you introduce into the Service about your clients, their artists, and anyone you invite to review work — including names, email addresses, review-link recipients, comment text, voice notes, project and track titles, and the audio content itself — you are the controller and tothemixhub is your processor. We process that data only to provide the Service and only on your documented instructions.
You are responsible for having a lawful basis to upload client material and to invite reviewers, and for telling those people how their data will be used.
For your own account data — your registration details, plan and billing status, authentication events, and support correspondence — tothemixhub is the controller. That processing is described in the Privacy Policy and is not governed by this addendum.
| Element | Detail |
|---|---|
| Subject matter | Provision of the tothemixhub mix review, delivery, and payment platform. |
| Duration | For as long as your account is active, plus the retention periods in section 7. |
| Nature and purpose | Storage and streaming of audio, collection of timestamped review feedback, revision tracking, sign-off records, delivery of final files, and payment requests. |
| Types of personal data | Names, email addresses, project and track metadata, review comments and voice recordings, sign-off records, listening events, hashed IP addresses, payment status. |
| Categories of data subject | Your clients, their artists and representatives, collaborators you invite, and anyone you send a review link to. |
| Special category data | None requested or required. Do not upload special category data; the Service is not designed for it. |
We will:
(a) process personal data only on your documented instructions, of which your use of the Service and this DPA are the complete set, unless required otherwise by law — in which case we will tell you before processing, unless the law forbids it;
(b) ensure that anyone authorised to process the data is bound by an appropriate duty of confidentiality;
(c) implement the technical and organisational measures described in section 4;
(d) respect the conditions in section 5 for engaging another processor;
(e) assist you, so far as reasonably possible and taking into account the nature of the processing, in responding to requests to exercise data subject rights;
(f) assist you with your obligations regarding security, breach notification, and data protection impact assessments, taking into account the information available to us;
(g) at your choice, delete or return the personal data at the end of the provision of services, as set out in section 7; and
(h) make available the information reasonably necessary to demonstrate compliance with this addendum, as set out in section 8.
We maintain the following technical and organisational measures. They describe the Service as built, not aspirations.
| Measure | Implementation |
|---|---|
| Access control | Row Level Security is enforced at the database layer, so a query cannot return another account’s rows even if application logic is wrong. Administrative tooling is restricted to named staff roles. |
| Encryption in transit | TLS on all connections, including audio delivery. Strict Transport Security is enforced in production. |
| Encryption at rest | Provided by our infrastructure sub-processors for both database and object storage. |
| Audio access control | Audio is never publicly listable. Playback is authorised per request and served through short-lived signed URLs that expire in five minutes. |
| Share controls | Review links can be public, password-protected, or restricted to named accounts, and can be expired or revoked by you at any time. |
| Pseudonymisation | IP addresses associated with listening and download events are hashed before storage; the raw address is never written to the database. |
| Auditability | Administrative actions are written to an append-only audit log with no update or delete path. |
| Segregation | Production and staging run as separate projects with separate credentials and separate storage buckets. |
We review these measures as the Service changes. We may update them provided the level of protection is not reduced.
You give general authorisation for us to engage the sub-processors listed below. Each is bound by data protection obligations no less protective than those in this addendum.
| Sub-processor | Purpose | Region |
|---|---|---|
| Supabase | Database and authentication | European Union (eu-west-1) |
| Cloudflare | Audio and file storage (R2), edge routing for branded hosts | Configurable; default United States |
| Vercel | Application hosting | EU/US edge; functions pinned to Dublin (dub1) |
| Stripe | Subscriptions and Connect payouts | EU/US |
| Resend | Transactional email | United States |
| Modal | Audio analysis and waveform generation | United States |
| Upstash | Rate limiting | EU/US |
| Sentry | Error monitoring | European Union (de.sentry.io) |
| Deepgram | Voice-note transcription (only when enabled) | United States |
We will give at least 30 days' notice before adding or replacing a sub-processor. If you have a reasonable objection on data protection grounds, tell us at privacy@tothemixhub.com within that period and we will work with you in good faith; if we cannot resolve it, you may terminate the affected part of the Service without penalty.
Our database is hosted in the European Union. Some sub-processors listed above process data outside the European Economic Area.
Where personal data is transferred outside the EEA or the UK, the transfer is made under an approved mechanism — the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision — together with any supplementary measures required by the transfer risk assessment for that vendor.
You control the lifecycle of the data you put into the Service. You can delete projects, tracks, versions, review links, and comments at any time from the application.
When you delete your account, we erase your projects, uploaded audio, delivery files, review links, comments, and voice notes. Deletion runs as a durable, retryable job and removes both the database rows and the stored objects. We send confirmation when it completes.
We retain records we are legally required to keep — principally payment and invoicing records for tax and accounting purposes — for the period required by law. These are retained as controller under our own legal obligation, not as your processor.
Backups are retained on a rolling schedule and overwritten in the ordinary course. Deleted data may persist in backups until they age out.
You can export your account data from the application before deleting it. If you need an export in a different form, contact us before deletion — we cannot reconstruct erased data afterwards.
On reasonable written request, and no more than once in any 12-month period unless required by a supervisory authority, we will provide the information reasonably necessary to demonstrate compliance with this addendum. Where available we will satisfy such requests by providing our sub-processors' third-party certifications and reports, which we consider more informative than a site visit to a platform of this size.
We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting personal data we process on your behalf. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.
Notification is not an acknowledgement of fault. As controller, you are responsible for any notification you owe to a supervisory authority or to affected data subjects.
If we receive a request directly from one of your clients or reviewers, we will not respond to it substantively. We will tell them to contact you, and inform you of the request without undue delay.
Because you can read, edit, export, and delete the data you control directly in the application, you can satisfy most access, rectification, and erasure requests yourself. Where you cannot, we will assist.
Each party's liability under this addendum is subject to the limitations and exclusions of liability in the Terms of Service.
If there is a conflict between this addendum and the Terms of Service in relation to the processing of personal data, this addendum prevails. If there is a conflict between this addendum and the Standard Contractual Clauses, the Clauses prevail.
Questions about this addendum, or a request for a countersigned copy, go to privacy@tothemixhub.com.
See also the Privacy Policy, Security overview, and Terms of Service.