Privacy Policy

tothemixhub is operated by Treeline Audio, registered in Ireland, with its registered address at Ireland ("tothemixhub", "we", "us", or "our").

We operate the website tothemixhub.com and the associated mix review platform (together, the "Service"). This policy explains how we collect, use, disclose, and protect personal data when you use the Service.

For privacy enquiries, contact us at privacy@tothemixhub.com.

This policy applies to two categories of people:

• Account holders — audio professionals who create an account, upload files, and manage projects.
• Client reviewers — people invited by an account holder to review and comment on audio. Reviewers do not need an account and are not direct customers of tothemixhub.

We use the following third-party services to operate the platform. Each processes data on our behalf. The maintained list is published at tothemixhub.com/subprocessors.

We do not share your personal data with any other third parties except as required by law.

If we transfer data outside the European Economic Area, we rely on the recipient's Standard Contractual Clauses or an equivalent approved transfer mechanism.

We use only cookies and browser storage needed to provide the Service or to remember a preference you set yourself. Supabase Auth sets session cookies when you sign in. Password-protected review links set a short-lived review-access cookie after you enter the correct password, and verifying your email address on a project request sets an equivalent session cookie. Connecting a Stripe account sets a short-lived security cookie that protects that redirect.

The app also keeps a few values in your browser storage: interface preferences such as playback volume, panel layout, and dismissed notices, plus any message you have typed but not yet sent. If you leave a note on a review link without an account, we store a random identifier for that link in your browser so that you — and only you — can delete the notes you wrote. It is scoped to that one review link, is never read on any other site, and identifies no one.

We do not use advertising cookies or cross-site tracking cookies. Vercel Web Analytics and Vercel Speed Insights measure aggregate traffic and page performance without cookies or device storage. That is why this site shows no cookie consent banner: everything described above is either strictly necessary to deliver what you asked for, or stores nothing on your device at all. If we later add non-essential analytics or marketing cookies, we will update this policy and ask for your consent before setting them.

• Inactive workspace content: kept read-only for a 90-day recovery period after the last paid, complimentary, or trial access ends, then permanently deleted unless access is restored.
• Audio and other stored media: deleted with the workspace graph after that 90-day recovery period, or earlier through an applicable deletion flow.
• Client comments, voice recordings, sign-off records, deliveries, intake and roster data: tied to workspace content and deleted with the related project or workspace.
• Login/profile identity and entitlement history: retained while the account remains open so the user can restore or start a new empty workspace.
• Delivery download events and listen events: retained while the project exists unless deletion is requested and legally permitted.
• Server logs: retained for up to 90 days for security purposes, then purged.
• Payment records: retained as required by applicable tax and accounting law (typically 7 years).

If you request account deletion, we erase personal data unless we must retain specific billing, tax, fraud-prevention, security, or legal records. Those retained records are restricted to the purpose that requires them and removed when the applicable obligation ends.

Depending on where you are located, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate data
• Deletion — ask us to delete your data ("right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Restriction — ask us to pause processing in certain circumstances
• Objection — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, email privacy@tothemixhub.com. We will respond within 30 days. If you are in the EU/UK and believe we have mishandled your data, you have the right to lodge a complaint with your local supervisory authority (e.g. the ICO in the UK, or your national DPA in the EU).

We do not sell or share personal information as defined by the California Consumer Privacy Act. California residents may still exercise the rights described in Section 8 by contacting us at privacy@tothemixhub.com.

The Service is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it promptly.

We apply industry-standard security measures: encrypted connections (HTTPS/TLS), bcrypt password hashing, presigned URLs for file access, and row-level security policies on our database. However, no system is completely secure and we cannot guarantee absolute security.

We may update this policy from time to time. Material changes will be notified by email to registered account holders at least 14 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

For any privacy-related questions or requests: privacy@tothemixhub.com

Treeline Audio
Ireland
Ireland