Privacy policy

Last updated 1 November 2026

This policy explains what personal data StemHaus collects, why, which companies help us handle it, and what your rights are. StemHaus has not opened yet. The waitlist is running and the apps, accounts and billing arrive with the beta, so each part below is marked Live now or From the beta to show what applies today.

In short

• We collect as little as we can. Today that is an email address and, if you choose, your main DAW.
• We do not sell personal data, show advertising or follow you around the web.
• Your music stays yours: no AI training on your content, and no staff access to your projects unless you ask support for help.
• Your project files and account records are stored in the EU.
• StemHaus is for people aged 16 and over. See Children.
• We set nothing in your browser that needs your consent, so there is no cookie banner. See the cookie policy.

Who is responsible

Dellusion Music is responsible for the data described here (the “controller”). For questions or requests about it, write to info@stemhaus.io. We are a small company and have not appointed a data protection officer, so that address reaches the people who handle privacy.

This policy covers this website, the waitlist, and the StemHaus desktop app, web app and account. The cookie policy covers what is stored in your browser.

What we collect, why, and for how long

For each purpose, this is what we collect, why we may do so under the law (the “legal basis”) and how long we keep it. Where the basis is consent, you can withdraw it at any time and it does not affect what we did before.

Joining the waitlist Live now

• What: Your email address, the DAW you chose (optional) and the date and time you signed up. We do not add your IP address to the list.
• Why: To email you when StemHaus opens its beta, and to see which DAWs people want us to support first. We use it for nothing else.
• Legal basis: Your consent, which you give by joining the list. You can withdraw it at any time by asking us to delete your data.
• How long: Until you ask us to delete it, or until we have told you that StemHaus is open and you have had the chance to sign up.

Visiting this website Live now

• What: Your IP address, browser and device details, and the pages you ask for. Our hosting provider records these automatically in server logs. They are not stored in our database and not added to the waitlist.
• Why: To deliver the website, keep it secure and stop abuse, including the bot check on the waitlist form.
• Legal basis: Our legitimate interest in running a secure website.
• How long: Only as long as it takes to find and fix faults and abuse. We do not build visitor profiles from these logs.

Writing to us Live now

• What: Your email address, your name if you give it, and what you write.
• Why: To answer you and, if you ask, to act on a privacy request.
• Legal basis: Our legitimate interest in answering enquiries, or the contract with you if you are a StemHaus user.
• How long: As long as it takes to deal with your request and any follow-up, then we delete it.

Your account From the beta

• What: Your email address, your name, a profile picture if your sign-in provides one, the plan you are on, and the details of your sign-ins.
• Why: To create and secure your account and sign you in.
• Legal basis: The contract with you: we cannot give you an account without them.
• How long: While you have an account. We delete it when you delete your account or ask us to.

Your projects From the beta

• What: The files you push (project files, samples, audio) and previews; your version history with who pushed what and when; and a summary we read from supported project files (tempo, tracks, plugin names and sample file names, never the folders on your computer).
• Why: To store, version, sync and play back your work, and to show you what is inside each version.
• Legal basis: The contract with you.
• How long: Until you delete them or delete your account. If you move to a plan with lower limits, nothing is deleted for 90 days and we email you before anything is.

Working with others From the beta

• What: Who is a member of your workspace and project and in what role, invitations (including the email address of the person invited), comments, who is online in a project, and the check-out lock on a project.
• Why: To let you share projects and work on them together.
• Legal basis: The contract with you. For the person invited, our legitimate interest in delivering an invitation that someone asked us to send.
• How long: While the workspace or project exists.

Paid plans From the beta

• What: Your billing name, email address and country, your billing address and tax ID if you give them, your plan, the status of your subscription and your payment history. You enter your card details with Stripe, and they never pass through our servers.
• Why: To take payment, charge the right VAT and keep the records the law asks for.
• Legal basis: The contract with you, and our legal obligation to keep tax and accounting records.
• How long: Your billing details while you have an account. Invoices and tax records for as long as tax and accounting law requires.

Email from us From the beta

• What: Your email address, your name where we have it, and delivery details such as whether a message arrived or bounced.
• Why: To send transactional emails (an invitation to a workspace, a receipt, a security notice) and information emails (your invitation to the beta, planned maintenance, changes to our terms or this policy). We will not send you marketing without asking you first.
• Legal basis: The contract with you for transactional emails, our legitimate interest in keeping users informed for service information, and your consent for the beta invitation you asked for by joining the waitlist.
• How long: Delivery records only as long as we need them to deal with delivery problems.

Usage statistics and error reports From the beta

• What: A random installation ID, the app version and operating system, which features are used and the details of errors. Never the contents of your projects.
• Why: To fix bugs and decide what to build next.
• Legal basis: Your consent. The apps keep this off until you turn it on, and you can turn it off again.
• How long: No longer than 12 months.

You do not have to give us any of this, but we cannot put you on the waitlist or give you an account without an email address. We make no decisions about you by automated means that have legal or similarly significant effects, and we do not profile you. The one automatic rule is a technical one: a push that would take you over your plan’s limits is refused.

Your music

You keep all rights to everything you upload. We hold only the licence we need to store, process and send your files to the people you choose. We claim no A&R or first-look rights, we do not use your content to train AI, and our staff do not open your projects unless you ask support for help. These commitments will be written into the terms of service before the beta opens.

Who handles data for us

We use the companies below to run StemHaus. They handle personal data only on our instructions, under a data processing agreement, and are bound to keep it confidential and secure. We do not sell personal data, and we do not share it with advertisers or data brokers.

Cloudflare Live now

• What it does: Hosts this website and the StemHaus API, stores your project files and previews, carries live presence (who is online in a project) and runs the Turnstile bot check on the waitlist form. Its network also handles DNS and traffic for our domains.
• Personal data it handles: Your IP address and browser details whenever you connect, and waitlist sign-ups as they pass through. From the beta, your project files and previews. For the Turnstile check, Cloudflare is also a controller in its own right: it uses the check's signals to improve its bot detection.
• Where: Files and live presence data are kept in the EU. Requests are handled on Cloudflare's global network, so they can pass through servers outside the EU.
• Safeguard: Cloudflare's data processing addendum, which includes the EU Standard Contractual Clauses.

Neon Live now

• What it does: Hosts the database that holds our records.
• Personal data it handles: Today, waitlist sign-ups. From the beta, accounts, workspaces, project and version records, comments and subscription status. Not the contents of your project files, which are in Cloudflare storage.
• Where: Frankfurt, Germany.
• Safeguard: Neon's data processing addendum, which includes the EU Standard Contractual Clauses for any access from outside the EU.

WorkOS From the beta

• What it does: Handles sign-in for the desktop app and the web app (WorkOS AuthKit), including passkeys, multi-factor authentication and sign-in sessions.
• Personal data it handles: Your email address, your name, your sign-in credentials such as passkeys and multi-factor settings, and records of your sign-ins (for example the time, IP address and browser). We keep your WorkOS user ID, email address and name in our own database to link your account to your projects.
• Where: United States.
• Safeguard: WorkOS's data processing addendum, which includes the EU Standard Contractual Clauses.

Amazon Web Services (Amazon SES) From the beta

• What it does: Sends the emails StemHaus sends you: transactional emails (for example an invitation to a workspace, a receipt or a security notice) and information emails (for example your invitation to the beta, planned maintenance, and changes to our terms or this policy). We do not use it for advertising.
• Personal data it handles: Your email address, your name where we have it, the content of the message, and delivery details such as whether it arrived or bounced.
• Where: London, United Kingdom (AWS region eu-west-2).
• Safeguard: The European Commission has found that the United Kingdom protects personal data to an adequate standard (an adequacy decision renewed in December 2025 and valid until 27 December 2031), so sending data there from the EU needs no further safeguard. The Amazon Web Services data processing addendum also applies.

Stripe From the beta

• What it does: Takes payment for paid plans, issues invoices, and works out and collects VAT (Stripe Billing and Stripe Tax).
• Personal data it handles: Your name, email address, billing address and country, your tax ID if you give one, your payment method and your payment history. Card details go straight to Stripe and never pass through our servers. We keep only your Stripe customer reference, your plan and the status of your subscription.
• Where: The European Union and the United States.
• Safeguard: Stripe's data processing agreement, which includes the EU Standard Contractual Clauses. For some purposes, such as preventing fraud and meeting its own legal duties, Stripe is a controller in its own right and its privacy policy applies.

PostHog From the beta

• What it does: Collects usage statistics and error reports from the StemHaus apps so that we can fix bugs and decide what to build. In the apps this is off until you turn it on.
• Personal data it handles: A random installation ID, the app version and operating system, which features are used and the details of errors. Never the contents of your projects.
• Where: The European Union (PostHog's EU Cloud, in Frankfurt).
• Safeguard: PostHog's data processing agreement, which includes the EU Standard Contractual Clauses for any access from outside the EU.

These providers use sub-processors of their own, which they list on their own websites. We update this list before a new provider starts handling personal data, and the date at the top of this page changes when we do. We may also have to share data with the authorities when the law requires it, or with a buyer if StemHaus is ever sold, who would have to honour this policy.

Where your data goes

• In the EU: our database is in Frankfurt, and project files and live presence data are kept in Cloudflare’s EU storage.
• In the UK: email is sent through Amazon SES in London (AWS region eu-west-2). The European Commission treats the UK as providing adequate protection, so data can go there from the EU without further safeguards.
• In the US: WorkOS is in the United States, Stripe and PostHog can reach data from there, and Cloudflare’s network spans the world. For these we rely on the EU Standard Contractual Clauses in each provider’s data processing agreement. You can ask us for a copy of the safeguards.

Children

StemHaus is for people aged 16 and over. It is a tool for music producers: we do not design it for children and we do not market it to them. Anyone under 18 who is old enough to use it has the same protections as everyone else.

What we do

• We state the age limit where we collect data: next to the waitlist form, and in the terms when accounts open.
• We do not knowingly collect personal information from anyone under 16. That covers children under 13, whom the US Children’s Online Privacy Protection Act (COPPA) protects, and 13- to 15-year-olds, whom the GDPR and some national laws also protect.
• If we learn that someone under 16 has given us personal information, we delete it and close any account, promptly and within 30 days at the latest. We do not keep a copy.
• We do not show advertising, sell or share personal information, build profiles or follow anyone around the web. That is true for everyone, children included. The only tracking technology on our website is the bot check described in the cookie policy, which exists to keep the form safe.
• The providers listed above handle personal information only to run StemHaus for us, and they are bound to keep it confidential and secure.

If you are a parent or guardian

If you believe your child has joined the waitlist or created an account, write to info@stemhaus.io and give us the email address they used, which is all we need to find the record.

Under COPPA, a parent can ask to see the personal information a service holds about their child, ask for it to be deleted, and refuse any further collection or use of it. We give you these rights for any child under 16, wherever you live. We will not ask for identity documents. If we need to check that a request is genuine, we will do it by email. We answer within one month.

If you are in the United States

COPPA applies to websites and services directed to children under 13, and to operators that actually know they are collecting personal information from such a child. StemHaus is not directed to children. If we learn that we hold personal information from a child under 13, we delete it as described above, rather than ask a parent for consent, because children under 16 may not use StemHaus.

Personal information from a child that reaches us by mistake is kept only until we delete it, within 30 days of our finding it. We do not sell or share personal information, as California law defines those terms, and that includes the information of anyone under 16.

If you are in the EU or the UK

Where we rely on consent, as we do for the waitlist, the GDPR lets each country set the age at which a child can give it, between 13 and 16. Our minimum age of 16 is the highest of them, so we never need a parent’s authorisation anywhere in the EU. In the UK the age is 13.

Your rights

You can ask us at any time to show you what we hold about you, to correct it or delete it, to restrict how we use it, or to give it to you in a portable format, and you can object to our use of it. If we use your data on the basis of consent, you can withdraw that consent. To do any of this, write to info@stemhaus.io. We answer within one month.

You can also complain to the data protection authority in the country where you live or work. If you live in a US state with a privacy law, such as California, you may also have the right to know what we hold, to access, correct and delete it, and to opt out of the sale or sharing of your data and of targeted advertising. We do none of these, so there is nothing to opt out of, and we will not treat you differently for using your rights.

Security

All traffic to this site, the web app and the API uses HTTPS. Files travel to storage over short-lived, single-purpose links, and access to a project is limited to you and the people you invite. If a breach is likely to harm you, we will tell you and the data protection authority, as the law requires.

Changes to this policy

When we change this policy, the date at the top changes. If the change matters to you, for example a new provider or a new purpose, we email people on the waitlist and people with accounts before it takes effect.

Contact

Questions, requests and complaints: write to info@stemhaus.io.