JUSSA GOT THE SAUCE Privacy Policy Version: 2026-11-13.2 1. Controller and scope The controller for JUSSA GOT THE SAUCE and VocalMatch is Bartłomiej Jóźwiak (Jussa), ul. Łanowa 7B, 32-050 Skawina, Poland; email: kontakt@jussagotthesauce.com. Phone: +48 662 439 673. Contact the controller directly about personal data and your rights. This policy covers the store, accounts, private libraries, negotiations, notifications and vocal tools. It does not ask for blanket consent to the policy: different functions use different legal bases. 2. Account, purchase and contact data We process your email, account identifier, profile details you provide, favourites, FIRE votes and messages. An agreement may require your legal name or business name, address, country and optional tax identifier. Orders record selected beats, licence versions, price, currency, individual offer terms, acceptance time and payment state. A payment provider may supply transaction identifiers and confirmation. Full card details and banking credentials are not stored in the store database. Authentication credentials are handled by the sign-in provider; do not send us your password. 3. VocalMatch recordings Microphone audio and files used solely for local processing remain on your device until you choose to upload them or save them to the cloud. We then process the recording, name, format, duration, job parameters, output and data required to associate the file and account for your granted allowance. Voice conversion through ElevenLabs or audio improvement through Auphonic sends material to the relevant provider only when you start an available feature. Listening to existing public demos does not request new processing. The service does not use your voice for biometric identification. Avoid unnecessary sensitive information and do not upload another person's voice without appropriate rights. Saving to your private library does not publish your recording. An authorised administrator has access necessary for operation, security and support. 4. Purposes and legal bases Account, library, order, licence and requested processing services, and steps before a contract at your request, rely on GDPR Article 6(1)(b). Legally required records, including tax records, and mandatory customer-rights handling rely on Article 6(1)(c). Security, abuse prevention, legal claims and replies to ordinary correspondence rely on the controller's legitimate interests under Article 6(1)(f). Optional push notifications rely on consent under Article 6(1)(a). Withdrawing consent does not affect the lawfulness of earlier processing. Providing data is voluntary, but information necessary for an account, delivery or contract is required to supply that particular service. Omitting optional details does not prevent browsing. 5. Providers and recipients Cloudflare provides hosting, security, databases and file storage. Supabase handles JUSSA authentication and Clerk handles VocalMatch authentication. Account messages may involve the email provider used by the authentication service. Push delivery involves your browser or operating-system provider. ElevenLabs and Auphonic receive data necessary for processing you actually request. OpenAI supports the producer's cover generator; browsing the catalogue does not automatically send customer accounts or recordings to that generator. HotPay, and PayPal after connection, receive data needed for the payment selected and may be independent controllers for their payment duties. Authorised support, accounting or legal providers and legally entitled authorities may also receive necessary data. We do not sell customer databases. 6. Transfers outside the EEA Infrastructure, authentication and AI providers may process data outside the European Economic Area, particularly in the United States. Transfers require an appropriate mechanism: an adequacy decision covering the recipient, or standard contractual clauses and any necessary additional safeguards. We do not promise that all data stays exclusively in Poland or the EU. Ask the controller for information about applicable safeguards and how to obtain a copy. Provider processing and subprocessor documents are available, for example, at cloudflare.com/cloudflare-customer-dpa, supabase.com/legal/dpa and clerk.com/legal/dpa. 7. Retention Data needed for accounts, favourites and private libraries is kept while you use the relevant service, until deletion or account closure, subject to legal records and claims. Saved VocalMatch library recordings have no automatic expiry; you can delete them from the library. Removing audio may leave a technical deletion marker to prevent a delayed retry from recreating the file. Temporary vocal-job files expire as indicated for the job, normally after 7 days; this does not apply to separately saved library recordings. Usage receipts and operation/error records may remain without audio for accounting and abuse prevention. Tax documents are kept for the statutory period, generally 5 years from the end of the year in which the tax payment deadline fell. Licence agreements and entitlement evidence are needed while the licence is performed and subsequently until the applicable limitation period for claims expires; a pending dispute or legal duty may extend retention. Non-contract correspondence is kept until the matter and possible related claims are resolved. Security logs are retained only as necessary to diagnose and protect against the event, within the relevant infrastructure service's scope and retention settings. 8. Cookies and device storage Necessary session cookies support sign-in and account security. The jussa-lang preference is saved in a cookie for up to one year and in local storage. Cart contents, preferences and the push-management token may remain in local storage until removed. Session storage retains information such as an ongoing checkout and the one-time purchase message. The PWA caches public resources to help with poor connectivity. Private orders, agreements and recordings are not intentionally stored in the service worker's public cache. Clearing browser data alone does not delete information stored in your account. The service currently runs no advertising pixels or marketing analytics. External authentication and payment functions may use their own necessary security mechanisms. Optional tracking would require separate information and appropriate consent; merely visiting does not provide that consent. 9. Notifications and communication Push is optional for each device. We store the subscription endpoint and encryption keys needed for new-beat notifications. Disable push in service or browser settings; unsubscribing in the service deletes the corresponding subscription, and expired endpoints are removed after a provider response. There is currently no marketing newsletter. Account or contract messages and replies to inquiries do not subscribe you to marketing. Microphone permission is not consent to publish recordings or advertise. 10. Your rights Subject to GDPR conditions, you can request access and a copy, correction, deletion, restriction and portability of data processed automatically on the basis of consent or contract. You may object to processing based on legitimate interests and withdraw consent at any time. Send requests to kontakt@jussagotthesauce.com. We normally respond within one month; any justified extension is explained within that period. Proportionate identity confirmation may be requested. Deletion does not include data that must be retained on another legal basis. You can complain to the Polish supervisory authority, the President of UODO, at uodo.gov.pl, or another competent supervisory authority. 11. Automation and security The service uses access controls, encrypted connections, private file storage and operation limits. It does not make solely automated decisions producing legal or similarly significant effects on you within GDPR Article 22. Audio processing, catalogue sorting and allowance checks are not advertising profiling. Protect your account and downloaded files. Material processing changes are explained in a new policy version; a new purpose requiring consent is not imposed retrospectively.