Privacy Policy
Last updated: August 2026.
1. Controller
elceedee UG (haftungsbeschränkt), represented by the managing directors Markus Schwarzer, Jakob Höflich and Joshua Weikert, Badenweiler Straße 4, 68239 Mannheim, Germany. Email mail@cyanite.ai.
2. Scope
This policy covers this application only. It does not cover cyanite.ai or app.cyanite.ai, which have their own privacy policies. This application requires no account and asks for no name, email address or payment details.
3. What we process
We process the following, and nothing else:
- The text you type into the chat. Your descriptions of what you are looking for are sent to a language model so it can search the catalogue and explain its picks. Legal basis: Art. 6(1)(b) GDPR, to provide the service you requested.
- Your IP address. Read from the incoming request and held only in server memory for a short rolling window, in order to apply request limits and protect the service against automated abuse. It is not written to a database. Where a request is refused, a short keyed hash of the address is written to our server logs together with the reason, never the full address. That hash is computed with a secret key held only by us, so it cannot be reversed back to the address. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in keeping the service available and controlling cost.
- Tracks you save. When you tap the heart on a track, the track identifier is stored in your own browser's local storage on your device. It never reaches our servers. Clearing your browser storage removes it.
Please do not type personal data about yourself or others into the chat. Describe the music you want, not people. Anything you enter is sent to the language model providers named below.
4. AI processing and transfers outside the EU
To understand your request and write its replies, this application sends the content of your conversation to large language models operated by OpenAI and Google, accessed through the AI gateway of our hosting provider Lovable. These providers process data on servers in the United States, which is a transfer to a third country within the meaning of Chapter V GDPR. These transfers take place on the basis of the European Commission's Standard Contractual Clauses, which are the transfer mechanism set out in our hosting provider's data processing agreement. That provider maintains the current list of its AI sub-processors in its trust centre. Where the model provider's interface supports it, we set the option that prevents your conversation from being stored on their side. Legal basis for the transfer: Art. 6(1)(b) together with Art. 46(2)(c) GDPR.
5. Services we use
Lovable (hosting and AI gateway) — Lovable Labs AB, Stockholm, Sweden. Serves the application and routes our model requests. It acts as our processor under Art. 28 GDPR for the data we entrust to it. For its own service and log data it acts as an independent controller for analytics, security, billing and product development, as set out in its data processing agreement. Its data protection officer can be reached at dpo@lovable.dev.
Cloudflare (content delivery and bot protection) — Cloudflare, Inc. Traffic reaches you through Cloudflare's network. Cloudflare sets one strictly necessary cookie named __cf_bm to distinguish humans from automated traffic. It expires after around 30 minutes, sets no tracking identifier and is not used to profile you across sites.
Cyanite API (music analysis) — elceedee UG, our own service, processing on servers in Frankfurt, Germany. Receives your search text and returns matching tracks and their analysis. No IP address of yours is passed to it.
Jamendo (audio and cover artwork) — Jamendo S.A., Luxembourg. Audio previews are streamed through our own server, so your IP address is not disclosed to Jamendo when you press play. Cover artwork, however, is loaded by your browser directly from Jamendo's servers, which means your IP address and browser details are transmitted to Jamendo for that request.
6. Cookies and consent
This application sets no cookies of its own and uses no analytics, advertising or tracking services. The only cookie present is Cloudflare's strictly necessary bot protection cookie described above, and the only device storage we use is the list of tracks you chose to save. Both fall under § 25(2) TDDDG as strictly necessary for a service you explicitly requested, so no consent banner is required. Should we ever add non-essential tracking, we will ask for your consent first.
7. Retention
Rate limiting data exists only in server memory and disappears within minutes. Server logs containing security events and keyed IP hashes are retained by our hosting provider for a limited period and then deleted. Conversations are not stored on our servers: reload the page and the conversation is gone. Saved tracks remain in your browser until you clear them.
8. Security
Traffic is encrypted in transit with TLS. We apply a content security policy, strict transport security and further protective headers, restrict which origins may call our interfaces, and enforce request limits. We keep no database of users.
9. Your rights
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection (Art. 21 GDPR)
- Withdrawal of consent (Art. 7(3) GDPR) where processing rests on consent
Because we do not operate user accounts, we usually hold no data that would let us identify you, which may limit what we can act on. To exercise a right, write to mail@cyanite.ai.
10. Right to complain
You may lodge a complaint with a data protection supervisory authority. The authority competent for us is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg.
11. Changes
We may update this policy as the service changes. The date at the top shows the current version.