Privacy Policy

Last updated: March 2026

The Short Version

We collect what we need to run the service and nothing more. We don't sell your data. Your audio files are yours, and we delete them after processing.

1. Data Controller

Munchy Cow is operated by Yann Jubelin, with NIF: Y5606049C, located at carrer de les calandries 19, Barcelona, Spain. Contact: [email protected].

2. Information We Collect

Account Information

When you create an account, we collect your email address. We use magic links for authentication, so no password is stored.

Audio Files

You upload audio files for processing. We store these temporarily while processing and for a limited time afterward so you can download the results. Files are automatically and permanently deleted 7 days after processing.

Payment Information

Payment processing is handled entirely by our Merchant of Record, Polar Sh, Inc. We do not store your credit card details; we only receive a reference to the transaction for accounting.

Usage Data

We collect basic analytics about how you use the service: pages visited, features used, processing jobs created. This helps us improve the service.

3. How We Use Your Information

To provide and improve the Service
To communicate with you about your account
To process payments
To detect and prevent abuse
To comply with legal obligations (e.g. tax reporting to the Spanish Tax Agency)

4. Legal Basis for Processing

Under GDPR, we process your data based on:

Contract: To provide the audio processing service you signed up for
Legitimate Interest: To improve our service and prevent abuse
Legal Obligation: To comply with tax and accounting requirements

5. Sub-processors

To provide the Service, we share limited data with the following providers:

Infrastructure: Hetzner Online GmbH (Germany). Our primary processing servers are located in the European Union.
Storage: Cloudflare, Inc. (R2) (USA/Global). Used for encrypted storage of your audio files.
Payments & Taxes: Polar Sh, Inc. (USA). Our Merchant of Record for global billing and tax compliance.
Email Delivery: Resend, Inc. (USA). Used for sending magic links and transactional notifications.

6. International Data Transfers

While we prioritize EU processing, we use US-based providers (Cloudflare, Polar, Resend). These transfers are protected by Standard Contractual Clauses (SCCs) and/or the EU-U.S. Data Privacy Framework to ensure your data receives a level of protection equivalent to that of the GDPR.

7. Data Retention

Audio Files: Automatically and permanently deleted from storage 7 days after processing.
Account Data: Retained until you delete your account.
Billing/Tax Data: We are legally required to keep records of sales and tax data for 6 years to comply with the Spanish Commercial Code (Código de Comercio).

8. Data Security

We use industry-standard security measures to protect your data, including encryption in transit and at rest. Audio files are stored in encrypted cloud storage with access controls.

9. Your Rights

You have the right to access, rectify, or delete your data, and to object to or restrict its processing. You can exercise these rights through your account settings or by emailing [email protected].

You also have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD).

10. Cookies

We use essential cookies to keep you logged in and remember your preferences. We do not use tracking cookies for advertising or third-party marketing.

11. Children's Privacy

The Service is not intended for children under 13. We don't knowingly collect data from children.

12. Changes to This Policy

We may update this policy from time to time. We'll notify you of significant changes via email.

13. Contact

Questions about privacy? Contact us at [email protected].