Privacy Policy

Effective: 2026-08-27

Last updated: 2026-08-27

Controller: Masters Global Inc. (address: Harju County, Tallinn, Lasnamäe district, Sepapaja tn 6, 15551 · DPO: dpo@mastersglobalinc.com)

1 · Who we are

Trinity Studio ("Trinity", "we", "us") is operated by Masters Global Inc.. This notice covers every user of trinitystudio.example and its APIs.

2 · What we collect

Category	Examples	Purpose	Lawful basis (GDPR)
Account	email, name, hashed password, date of birth	Provide the service	Contract (Art 6.1.b)
Billing	Stripe customer ID (no card numbers)	Bill you	Contract
Content	Prompts, lyrics, generated audio/video, cover art	Deliver the creation	Contract
Consents	Cookie preference, marketing opt-in, voice-clone consent	Comply with the law	Consent (Art 6.1.a) + Legal obligation (Art 6.1.c)
Telemetry	IP, browser, device fingerprint (hashed), page views	Fraud prevention + product improvement	Legitimate interest (Art 6.1.f)
Support	Emails you send us	Resolve your ticket	Legitimate interest

We do not collect government IDs, biometrics, health data, or precise geolocation.

3 · How we use it

Deliver the service — running your generations, storing your library, honouring your subscription.
Fraud & abuse prevention — device fingerprint linking, rate limiting, moderation.
Aggregated analytics — number of active users, feature adoption. Never used to target you individually.
Marketing (only with your explicit opt-in) — product-update emails via Resend. Unsubscribe in one click.

4 · Who we share it with

Sub-processors: Stripe (billing), MongoDB Atlas (database), Emergent Object Storage (media), Suno + Udio + Sora + Kits AI + ElevenLabs (generation providers), Resend (transactional email), Google (YouTube OAuth if you opt-in), LALAL.AI (stem separation if you opt-in). Each sub-processor is bound by Data Processing Agreements.
Law enforcement — only on valid legal process, and we resist over-broad requests.
We never sell your data. The "Do Not Sell or Share My Personal Info" link is retained for CCPA transparency.

5 · Where it lives

Primary storage: US-East (AWS us-east-1) with encrypted replication to EU-West for redundancy. If you delete your account, all replicas expire within 30 days.

6 · Cross-border transfers

Data may transfer to the US. We rely on the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs) with all sub-processors.

7 · Retention

Record	Kept for
Account + billing	Until you delete, then 30 days for backups
Generated content	Until you delete it or your account
Voice clones + biometric embeddings	Deleted immediately if consent is withdrawn
Audit logs (safety, moderation, DMCA)	6 years (statutory)
Cookies (analytics)	13 months max

8 · Your rights (GDPR / UK GDPR / CCPA / LGPD / PIPEDA)

Access — full JSON export via Settings → Privacy → Export my data.
Erasure — one-click delete via Settings → Privacy → Delete my account.
Rectification — edit your profile in-app.
Portability — the export includes generations, lyrics, and settings in machine-readable JSON.
Restriction / Object — email dpo@mastersglobalinc.com.
Withdraw consent — flip the toggles in Settings → Privacy at any time.
Complaint — you can complain to your local supervisory authority (ICO, CNIL, NITDA…). We ask you to try us first at dpo@mastersglobalinc.com.

9 · Children

Trinity is not for children under 13 (US/global default) or 16 (EU/EEA without parental consent). See our Kids-Safety Policy at /legal/kids-safety.

10 · Security

Encryption in transit (TLS 1.3), encryption at rest (AWS-managed KMS), least-privilege IAM, mandatory 2FA on all engineer accounts, quarterly access review, and 24×7 alerting. A breach affecting your account is disclosed within 72 hours per GDPR Art 33.

11 · Changes

Material changes are announced by email 30 days before they take effect.

12 · Contact

Data Protection Officer — dpo@mastersglobalinc.com

Postal — Harju County, Tallinn, Lasnamäe district, Sepapaja tn 6, 15551