FinalFinal | Privacy Policy

1. Data Controller

This privacy policy (“Policy”) explains how FinalFinal LLC (“FinalFinal,” “We,” “Us,” or “Our”) collects, uses and discloses information when you access or use our website at https://www.finalfinal.pro/, our web application, any mobile application we make available that links to this Policy and any related services (collectively, the “Platform”). Your access and use of the Platform is governed by our Terms of Use which includes dispute resolution provisions. This Policy is a disclosure document intended to inform you about our data practices. It does not create contractual obligations beyond those set forth in our Terms of Use [https://www.finalfinal.pro/legal/terms-of-use]. This Policy is incorporated by reference into the Terms of Use.

This Policy applies to all users and visitors of the Platform including individuals in the European Economic Area (the “EEA”), the United Kingdom, US and elsewhere. For EU/EEA and UK users, nothing in this Policy or the Terms of Use limits your statutory rights under the GDPR or UK GDPR, including the right to lodge a complaint with a supervisory authority.

1. Personal Data We Collect

We collect personal data (“Personal Data”) that you provide, that is generated through your use of the Platform, and that is collected automatically through cookies and similar technologies. For purposes of this Policy, “personal data” includes “personal information” as those terms are used under applicable privacy laws. The categories of Personal Data we may collect include:

• Account/Registration Data. Name, address, email address, username, password, artist name, age, gender, and information needed to create and maintain an account.
• Payment data. Payments are processed by our third-party payment processor, Stripe, Inc. (“Stripe”). When you make a payment, you provide your payment information (such as your name, billing address and payment card details) directly to Stripe. We do not receive or store this information. Stripe’s use of your information is governed by Stripe’s privacy policy [https://stripe.com/privacy]. We maintain records of your subscription plan and status as necessary to provide the Platform.
• Usage Data. Pages visited, features used, session data, waveform comments, audio file uploads and downloads, music library activity and interactions with other Platform content.
• Device & Technical Data. IP address, browser type, operating system, device identifier, language and similar technical information collected from the device or browser used to access the Platform. The iOS app may request access to your device microphone, for recording and audio features. The iOS app does not access your camera, contacts or push notification tokens. In-app activity is tracked through backend analytics provided by Mixapanel.
• Cookies & Tracking Data. Information collected through cookies, pixels, tags, and similar technologies, including Meta Pixel and Google Analytics, Google Ads conversion tracking and Tag Manager on landing page. See Cookies and Tracking Technologies below.
• Communication Data. Information in support requests, feedback, surveys, and other communications you send to us.

You may choose not to provide certain information, but required information may be necessary to create an account, process a subscription or respond to a request. If you choose to create an account or log in using Google Sign-In or Apple Sign-In, we receive information such as your name, email address, and account identifier, depending on your setting with that provider. If you use Apple Sign-In, you may choose to share a private relay email address instead of your actual email address.

We may collect Personal Data directly from you, automatically when you use the platform, from third-party sign-in providers you choose to use (Google and Apple), and from service providers that support account payment, analytics, security or customer support functions. Audio files, waveform comments and library information may be visible to collaborators or other users to the extent you choose to share them, or the Platform functionality permits.

1. How We Use Your Personal Data

We use Personal Data only for appropriate business purposes, including:

1. Provide and operate the Platform. Create and manage accounts; enable audio-file sharing, waveform comments and music library features; process subscriptions and payments; provide support, and perform our obligations under the applicable terms of service.
2. Improve and secure the Platform. Understand usage and diagnose problems; perform analytics; prevent fraud, abuse and unauthorized access; protect users and our business; and enforce our agreements.
3. Communication with you. Respond to inquiries and support requests; provide administrative information; and send marketing communications, newsletters, advertisements, or offers where permitted by law and consistent with your choices. You may unsubscribe from marketing communications using the available opt-out instructions.
4. Comply with law and protect rights. Comply with tax, accounting, recordkeeping, legal, regulatory, and law-enforcement requirements; respond to lawful requests; and establish, exercise, or defend legal claims.

If we use your Personal Data for a purpose materially different from those described in this Policy or disclose it to a third party not contemplated here, we will notify you and, where required by applicable law, obtain your consent before doing so.

You have the right to deny or withdraw your consent to the collection or use of your Personal Data at any time, as described in the jurisdiction-specific sections of this Policy. However, withdrawing consent may affect our ability to provide certain features or services to you.

1. Automated Decision-Making

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, such as decisions about your eligibility to use the Platform or the status of your account. This includes decisions within the meaning of GDPR and the UK GDPR, and profiling that would give rise to opt-out rights under applicable U.S. state privacy laws. If we begin using this type of processing in the future, we will update this Policy and, where required by applicable law, give you the right to obtain human review of the decision, to express your point of view, and to contest the decision.

1. How We Share Your Personal Data

We do not sell, trade, or rent Personal Data to others. We may disclose Personal Data to the following categories of recipients, as necessary for the purposes described in this Policy:

1. Service Providers. Vendors that provide hosting, storage, payment processing, analytics, customer support, security, communication and related services. Our service providers currently include Amazon Web Services (cloud hosting and storage), Stripe (payment processing), Google (analytics and cloud services), Mixpanel (product analytics), Vercel (landing page hosting) and Mailchimp (marketing and product emails).

We work with third-party service partners who assist us in operating the Platform and offering a broader array of services than we could provide on our own. These partners use Personal Data only as necessary to provide their services to us. Parties with whom we share Personal Data are bound by contracts requiring them to use and disclose personal data only for the permitted purposes set forth in the contract and to use reasonable security measures to protect Personal Data from unauthorized access and use.

1. Advertising Partners. Meta and Google, including Meta Pixel, Google Ads conversion tracking and Google Tag Manager, for ad measurement, attribution, retargeting, audience building, and campaign delivery on the landing page at finalfinal.pro, subject to applicable law and your choices.
2. Legal and regulatory recipients. Courts, regulators, governmental authorities, law enforcement or other persons when disclosure is required or reasonably necessary to comply with law, protect rights or safety, investigate fraud, or abuse or establish, exercise, or defend legal claims.
3. Business-transfer recipients. A buyer, investor, successor, or its advisors in connection with a merger, financing, acquisition, reorganization, sale of assets, or similar transaction provided that we inform the buyer that Personal Data may only be used for the purposes disclosed in this Policy.

When you use collaboration features, Personal Data associated with your account, audio files, waveform comments, and music-library activity may be shared with collaborators or other users according to your selections and the Platform’s functionality.

We do not control the privacy practices of independent third-party websites or services to which the Platform may link and that are not acting as our service providers. We encourage you to review their privacy policies before providing information to them.

1. Data Retention

We retain Personal Data only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Platform, comply with legal obligations, resolve disputes, enforce agreements, maintain business and security records, and protect our rights.

Account and profile data is retained for as long as your account remains active. When you delete your account, account data is deleted immediately from our production system; any Stripe subscription is cancelled and your login, profile, files, spaces and permissions are deleted. Messages you sent in another user’s space remain in that space but are no longer linked to your deleted account. Database backups may remain residual copies for up to 35 days before permanent deletion, and we do not use those copies for any other purpose during that period.

Payment and transaction records are retained for the periods required by applicable tax, accounting, anti-fraud, and other legal or regulatory requirements.

Server logs are retained for 90 days; web traffic logs are retained for 356 days and Mixapanel analytics data is retained for 24 months.

You may request deletion of your Personal Data, but we may retain limited information where necessary to comply with law, complete a transaction, resolve a dispute, detect security incidents or fraud, enforce our agreements, or establish, exercise or defend legal claims. To request deletion, see Your Rights and Choices below.

1. Your Rights and Choices

Opting Out and Removal

You may opt-out of promotional communications and communications related to the FinalFinal products or services, at any time by using the unsubscribe mechanism included on our email or by contacting us at the contact information provided in this Policy. You may also request that we remove your Personal Data from our database, blogs, forums or testimonials, or other public-facing areas of the Platform, or that we cancel your account. If we are unable to fulfill a removal request, for example, because of a legal retention obligation, we will explain the reason and any alternative available to you.

Access, Correction and Deletion

You may request details about the Personal Data we hold about you, including whether we process it on our own behalf or on behalf of a third party. You may also request that we correct inaccurate information or delete your Personal Data. We will verify your identity before responding to any such request and will address it within 30 days, or sooner where required by applicable law.

If we are unable to grant a request, whether in whole or in part, we will notify you in writing, explain the basis for our decision, and describe any further steps or remedies available to you.

1. Cookies and Tracking Technologies

Cookies are small text files or similar identifiers stored on or associated with your browser or device. We and our service providers may use cookies, pixels, tags, software development kits, and similar technologies to operate the Platform, remember preferences, understand usage, measure advertising and help protect the Platform.

1. Strictly Necessary Cookies. These cookies are essential for site operation, account authentication, security, load balancing and core Platform functions.
2. Analytics cookies. Google Analytics may be used to understand usage patterns, measure performance, and improve the Platform. In-app activity is tracked through backend analytics provided by Mixapanel.
3. Advertising and tracking cookies. Meta Pixel may be used for advertising measurement, retargeting, audience building, attribution and campaign optimization. Google Ads conversion tracking and Google Tag Manager may be used on our websitefor advertising measurement, retargeting, audience building, attribution, and campaign optimization. These tools are not used within the web app.

Strictly necessary and functionality cookies are essential to deliver the Platform to you and cannot be turned off through our consent tools. You can still block or delete them through your browser settings, but doing so may prevent certain features from functioning properly.

For all other cookies, pixels, web beacons, and similar technologies, you have the right to decide whether to accept or reject them. You may manage your preferences through the cookie settings available on the Platform or through your browser controls. Some third-party providers also allow you to opt out of their cookies universally through industry tools such as http://www.aboutads.info/choices/ or http://www.youronlinechoices.com.

If you choose to reject non-essential cookies, you may continue to use the Platform, but your access to certain functionality or features may be limited. Browser controls vary by provider; consult your browser’s help menu for instructions on managing cookie settings.

1. Data Integrity and Security

FinalFinal uses reasonable efforts to maintain the accuracy and integrity of Personal Data and to update it as appropriate. FinalFinal has implemented physical and technical safeguards to protect Personal Data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. These safeguards may include access restrictions, authentication controls, encryption where appropriate, monitoring, and procedures intended to maintain data integrity.

No method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we continually assess and improve our safeguards consistent with applicable law and the nature of the information.

1. Children's Privacy

We do not knowingly collect, maintain, or use Personal Data from children under 13 years of age. If we learn that we have knowingly collected Personal Data from a child without the required consent, we will take reasonable steps to verify the situation and delete the data promptly.

Parents or guardians who believe a child has provided Personal Data may contact us at support@finalfinal.pro.

1. Changes to This Policy

We may update this Policy from time to time to reflect changes in the Platform, our practices, technology, or applicable law. For material changes, we will provide notice by email or by a prominent notice on the Platform, as appropriate.

1. Reporting Violations
   
   If at any time you believe that we have violated these policies, please notify us by email at support@finalfinal.pro and we will use all commercially reasonable efforts to promptly investigate and remedy the problem.
2. Right to Non-Discrimination

You have the right to non-discriminatory treatment by us, should you exercise any of your rights.

1. Contact Us

FinalFinal LLC

1600 National Ave

San Diego, CA 92113, United States of America

support@finalfinal.pro

PART B — ADDITIONAL INFORMATION FOR EU/EEA USERS

If the processing of your Personal Data is subject to the General Data Protection Regulation (“GDPR”), the following provisions apply.

Data Controller

FinalFinal LLC

1600 National Ave

San Diego, CA 92113

support@finalfinal.pro

Legal Bases for Processing

Depending on the circumstances, we process Personal Data based on one or more of the following legal bases:

1. Contract performance. To provide and operate the Platform; create and manage accounts; enable audio-file sharing, waveform comments, and music-library features; process subscriptions and payments; provide support; and perform our obligations under applicable terms of service.
2. Legitimate interests. To improve and secure the Platform; understand usage and diagnose problems; perform analytics; prevent fraud, abuse, and unauthorized access; protect users and our business; and enforce our agreements, provided that these interests are not overridden by your rights and freedoms.
3. Consent. To send marketing communications and email newsletters and to use non-essential advertising and analytics cookies or similar technologies, including Meta Pixel and Google Analytics, for advertising measurement, retargeting, audience building, and related purposes. You may withdraw consent at any time.
4. Legal obligation. To comply with applicable tax, accounting, recordkeeping, legal, regulatory, and law-enforcement requirements and to respond to lawful requests.

When we rely on consent, you may withdraw your consent at any time, without affecting the lawfulness of processing conducted before withdrawal.

International Data Transfers

We are based in the United States and do not currently maintain a physical presence in Europe. Your Personal Data is stored on servers located in the United States, operated by Amazon Web Services.

When your Personal Data is transferred to the United States, we will continue to protect your Personal Data that we transfer in line with this Policy. Whenever we transfer your data outside of the EEA, we ensure similar protections are put in place and we rely, where applicable, on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission (the “SCCs”).

Where third-party vendors have access to Personal Data of EU/EEA users, we require appropriate data processing agreements (“DPAs”) and, where applicable, SCCs to be in place. We are reviewing and executing DPAs with relevant vendors to ensure compliance with GDPR transfer requirements.

Our EU Representative is DataRep and may be contacted at contact@datarep.com.

Your GDPR Rights

Subject to applicable conditions and exceptions, you have the following rights. We may ask for information reasonably necessary to verify your identity and protect Personal Data from unauthorized disclosure.

1. Right of access. To obtain confirmation of whether we process your Personal Data and, where applicable, a copy of that data and related information.
2. Right to rectification. To request correction of inaccurate Personal Data or completion of incomplete Personal Data.
3. Right to erasure. To request deletion of Personal Data in circumstances required by law.
4. Right to restriction of processing. To request that we limit processing in circumstances provided by law.
5. Right to data portability. To receive certain Personal Data in a structured, commonly used, machine-readable format and, where technically feasible, to transmit it to another controller.
6. Right to object. To object to processing based on our legitimate interests and, at any time, to processing for direct marketing, including related profiling.
7. Right to withdraw consent. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
8. Right to lodge a complaint. You may lodge a complaint with a data protection supervisory authority in the EU/EEA, including the authority where you live, work, or believe an infringement occurred.

We will respond without undue delay and, in any event, within thirty (30) days after receiving a request. The response period may be extended by up to two additional months where necessary because of the complexity or number of requests; we will inform you of the extension and the reasons for it within the first month.

These rights are not absolute and may be limited by applicable law, including where necessary to protect the rights of others, preserve confidential information, comply with legal obligations, or establish, exercise, or defend legal claims.

Cookies and ePrivacy Compliance

Under applicable ePrivacy requirements, we must obtain your affirmative opt-in consent before we place or use non-essential cookies and similar technologies. This includes analytics technologies such as Google Analytics and advertising technologies such as Meta Pixel, Google Ads conversion tracking and Google Tag Manager.

We do not use pre-checked boxes, and browsing the Platform does not constitute consent. Cookie preferences can be changed or withdrawn at any time through the available cookie settings mechanism. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Certain EU/EEA Member States, including France, Germany, Italy, and Spain, maintain stricter enforcement environments for data protection and cookie compliance. In particular, the French data protection authority (the “CNIL”) is especially active in cookie enforcement, and Germany imposes its own requirements under the Telecommunications-Telemedia Data Protection Act (the “TTDSG”). Our cookie practices and consent mechanisms are designed to meet these heightened standards.

EU Digital Services Act (DSA)

The EU Digital Services Act (“DSA”) imposes transparency and accountability obligations on online platforms and, increasingly, on advertisers using those platforms. While the primary DSA obligations fall on platforms such as Google and Meta, advertisers are expected to provide accurate targeting disclosures and are restricted from targeting advertisements based on sensitive personal data categories (such as health, religion, political opinions, or sexual orientation). We do not use sensitive personal data categories for advertising targeting, and we will cooperate with platform-level transparency requirements as applicable.

Children’s Privacy (EU/EEA)

We do not knowingly collect, store, or process personal data from children under the age of 16 (or the legal age of digital consent in your country).

If you are a child under the legal age in your region, please do not use this website, create an account, or send any personal information to us.

If you are a parent or legal guardian and you believe your child has provided us with personal data without your consent, please contact us immediately at support@finalfinal.pro. Upon verification, we will promptly delete that information from our servers and terminate any associated account.

PART C — ADDITIONAL INFORMATION FOR UK USERS

UK GDPR and PECR

If the processing of your Personal Data is subject to UK GDPR and the UK Data Protection Act 2018, you have rights regarding your Personal Data that are substantially similar to the rights described in the EU/EEA section above.

These may include the right to access, correct or erase your Personal Data; restrict or object to processing; receive certain Personal Data in a portable format; and withdraw consent where processing is based on consent.

Data Controller

FinalFinal LLC

1600 National Ave

San Diego, CA 92113

support@finalfinal.pro

We process your Personal Data under one or more of the legal bases described in the UK GDPR, which correspond to the bases set forth in Part B above: contract performance, legitimate interests, consent, and legal obligation.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (“ICO”). We encourage you to contact us first if you have concerns regarding our processing of your Personal Data. We will respond to rights requests without undue delay and, in any event, within one month after receiving a request. The response period may be extended by up to two additional months where necessary because of the complexity or number of requests; we will inform you of the extension and the reasons for it within the first month.

International Data Transfers

When your Personal Data is transferred to the United States we rely, where applicable, on the UK Extension to the EU-U.S. Data Privacy Framework and/or the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses.

Your Personal Data is stored on servers located in the United States, operated by Amazon Web Services.

Our UK Representative is DataRep and may be contacted at contact@datarep.com.

Cookies and PECR Compliance

We must obtain your prior consent before we place or use non-essential cookies and similar technologies. The same standards described in Part B apply. Affirmative opt-in consent, no pre-checked boxes, and no treatment of browsing the Platform as consent.

Cookie preferences can be changed or withdrawn at any time through the available cookie settings mechanism. ICO guidance applies, and we use Cookiebot, a consent management platform provided by Usercentrics, to collect and manage your cookie consent.

Children’s Privacy

The Platform is not directed to children under the age of 13, and we do not knowingly collect Personal Data from children. If you are under 13 years old, you must not create an account, make purchases, or provide us with any personal information without your parent or guardian’s explicit permission.

If you are a parent or legal guardian and discover that your child under 13 has provided us with personal data without your consent, please contact us immediately at support@finalfinal.pro. Once notified, we will investigate, restrict the account, and promptly delete your child’s information from our systems.

In addition to our obligations under the GDPR and UK GDPR, we comply with applicable national data protection and privacy laws in the EU/EEA Member States where we operate, including:

• France, the Loi Informatique et Libertés (French Data Protection Act), as supplemented by the guidelines and recommendations of the CNIL (Commission Nationale de l'Informatique et des Libertés);
• Germany, the Federal Data Protection Act (the "BDSG") and the Telecommunications-Telemedia Data Protection Act (the "TTDSG");
• The Netherlands, the Dutch GDPR Implementation Act (the "UAVG") and the Dutch Telecommunications Act;
• Italy, the Personal Data Protection Code (Legislative Decree No. 196/2003, as amended);
• Spain, the Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (the “LOPDGDD”);
• Belgium, the Act of 30 July 2018 on the Protection of Natural Persons with regard to the Processing of Personal Data; and
• Sweden, the Act (2018:218) containing supplementary provisions to the EU General Data Protection Regulation.

Our cookie consent mechanism and data protection practices are designed to meet the requirements of these national laws, including those of jurisdictions with heightened enforcement standards.

PART D - US PRIVACY NOTICE

Additional Information for U.S. Residents

Residents of certain US states may have additional privacy rights under applicable state privacy laws. Depending on your state of residence and subject to applicable exceptions, these rights may include:

• Confirm whether we process your Personal Data;
• Access Personal Data we maintain about you;
• Correct inaccuracies in your Personal Data;
• Delete certain Personal Data;
• Obtain a portable copy of certain Personal Data;
• Opt out of certain processing for targeted advertising;
• Opt out of the sale of Personal Data;

FinalFinal, LLC - Privacy Policy

• Opt out of certain profiling activities; and
• Appeal our decision regarding a privacy right request.

The specific rights available to you depend on your state of residence and applicable law.

Additional Information for California Residents

The California Consumer Privacy Act of 2018, as amended (“CCPA”) gives California residents rights regarding their Personal Data. Personal information includes information that identifies, relates to, describes, or could reasonably be linked with you or your household, subject to CCPA exclusions. California rights are not absolute and may be limited or denied where an exception under the CCPA applies.

1. Right to know and access. You may request information about the categories and specific pieces of personal information we collected, the categories of sources, the business or commercial purposes for collection, the categories of recipients, and the categories of personal information disclosed for a business purpose or sold or shared during the preceding 12 months. Where required, you may also request a portable copy.
2. Right to delete. You may request deletion of personal information that we collected from or about you, subject to exceptions permitted by the CCPA.
3. Right to correct. You may request correction of inaccurate personal information that we maintain about you.
4. Right to opt out of sale or sharing. To the extent our use of advertising technology is treated as “sharing” under the CCPA, you may opt out by contacting us at [Email Address] or using available privacy or cookie controls.
5. Right to limit use and disclosure of sensitive personal information. You may request that we limit use or disclosure of sensitive personal information to what is necessary to perform services, provide goods you requested, or for other purposes permitted by California law.
6. Right to non-discrimination. We will not discriminate against you for exercising CCPA rights, although the CCPA permits differences reasonably related to the value of personal information as allowed by law.
7. Authorized agents. You may designate an authorized agent to submit a request on your behalf, subject to verification and proof of authorization.

Personal Information that We collect, Use and Share

We have collected information corresponding to the following categories of information enumerated in the CCPA.

• Identifiers and account information. Name, address, email address, account name, IP address and an ID number assigned to your account.
• Customer records, payment and commercial information. Billing address, subscription information, payment information processed by our payment provider, and Platform activity.

FinalFinal, LLC - Privacy Policy

Page of

• Internet activity. Pages visited, history of visiting and interaction with our software and/or service, browser type, browser language and other information collected automatically.
• Location-related information General location (such as country or city) inferred from your IP address. We do not collect precise geolocation.

We use and disclose these categories for the business and commercial purposes described in this Policy, including providing, securing, improving, supporting, and advertising the Platform, as permitted by law and your choices.

How To Exercise Your Rights

To exercise the rights to access, receive portable data, delete, correct and opt out of sale or sharing, limit sensitive Personal Data, or exercise another CCPA right, please submit a verifiable consumer request to us by contacting us support@finalfinal.pro. You may submit a request yourself, through an authorized agent, or on behalf of your minor child where permitted by law.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

If we cannot verify your identity, we may deny your request. We will not use personal information collected to verify a request for any purpose other than verification, security, and compliance, except as permitted by law.

We will respond to verified requests within the time required by the CCPA, generally within 45 days and subject to a permitted extension. If we deny a request, we will explain the basis for the denial and any appeal or other rights available under applicable law.

Sale and/or Sharing of Personal Information

We do not generally sell Personal Data. We may disclose information to service providers and advertising partners as described above, and we will provide any notices and opt-out mechanisms required by California law if an advertising activity is treated as “sharing” under the CCPA.