Privacy Policy

The controller is SONIZE SAS, 5 rue Jean-Marie David, 35740 Pacé, France, registered under SIREN 107390304, SIRET 10739030400015, RCS Rennes 107390304, RNE 107390304. The person responsible for privacy inquiries is Nicolas Goinvic, reachable at nicolas.goinvic@sonize.io. You may also send questions, data-rights requests and complaints to privacy@sonize.io or use the privacy controls in account settings. The publisher's full registered identity is in the Legal Notice.

Operational privacy and online-safety lead: Nicolas Goinvic, Managing Director. The President, Joël Goinvic, retains corporate accountability; contact privacy@sonize.io.

Depending on the features used, we process account and profile data; authentication, session, device and security data; prompts, lyrics, uploaded or generated media, and voice recordings you make to dictate a brief; event, guest questionnaire and collaboration data; comments, reactions, playlists, songs you send or share with others (including the recipient, the recipient's email address for email and gift links, your note or message, and whether the song was opened or played), the attribution tag on song links you share outside Sonize, and safety reports; purchase and billing identifiers; notification preferences and delivery data; support, copyright and privacy-rights submissions; and operational logs.

Voice search in the mobile apps uses your phone's built-in speech-recognition service. Depending on your device and settings, the audio may be processed by the provider of that service, such as Apple, Google or your device manufacturer, under its own terms. Sonize does not receive or store the audio. It receives only the resulting text, which it uses as your search query.

On the website, PostHog is loaded and initialized only after you accept analytics. This choice covers product analytics and browser error reports. Before a choice, and after refusal or withdrawal, Sonize sends no browser analytics or crash reports to PostHog. Necessary server security and service logs are separate.

With analytics consent, PostHog measures page views, feature use, clicks, scrolling, performance and errors, using cookies and local storage. Session replay is disabled on web, mobile and TV. Mobile product analytics is optional; native crash reporting has a separate diagnostics choice. No advertising tag is currently loaded. Withdrawal stops optional collection and clears the browser analytics identity.

Refusal stops PostHog browser measurement, including page views, replay, performance and errors; we do not switch to cookieless tracking. Identified server analytics also requires your analytics consent. You can change the choice in cookie or privacy settings. Necessary service and security operations remain separate; contact privacy@sonize.io to exercise applicable rights.

An organizer or guest may supply your name, memories or questionnaire answers about you for an event song. We receive this information from that person. The organizer’s contract is not a contract with everyone named. Processing information about you requires its own applicable legal basis, appropriate notice and proportionate safeguards. Access is limited to authorized collaborators and necessary providers. Source material normally expires after 12 months and event songs after 24 months, subject to lawful retention and copies kept by recipients. Contact privacy@sonize.io to exercise your rights. The organizer can also delete a cancelled or completed event permanently, which deletes its guests, their answers and all its songs at once, including songs someone had kept. An organizer may also add invitees to the guest list with a name and, if it chooses, an email address. We receive these details from the organizer and use them to send the invitation and other messages about the event, to run the event and, as described below for guests, to check the event's texts; the invitation email links to this Privacy Policy.

A guest who joins an event makes a participation contract with Sonize under the “Event guests” section of the Terms of Service; we record when, under which version of the texts and in which contract language. Making the event's songs from what guests share is the service a guest asks for: Sonize uses AI to turn a guest's name, answers, stories and messages into event content, and this is necessary to perform that contract (GDPR art. 6(1)(b)). Photos and other media a guest adds are stored and shown at the event as the organizer sets it up; Sonize does not send them to an AI model. A guest confirms being 18 or older before contributing for the first time, either when joining with the event code or on the guest page. A person under 18 must not join or contribute through the guest page, and nothing about them is stored through that page; the organizer or a parent may add a song request about them instead, which is information about the minor provided by that adult and handled as described above for people mentioned in an event. After contributing, a guest may also give an email address so that we can send them the event's song. It is used only for that, not for reminders, marketing or event news, it is not shown to the organizer, and it is deleted with the other guest contact data. An email address a guest gives when joining with the event code is used for reminders, a change of date or a cancellation and for the song, and the organizer can see it; the guest can also ask us to send their link to come back to the event to that address, once. After the event closes, the join page links to the event recap if the organizer has shared it publicly. A guest can take back their contribution at any event: this deletes their answers, the wall messages and stories they wrote, the media they added and the song made from their answers. Where the guest page shows no control for it, write to privacy@sonize.io. Please do not put health, religious, political, sex-life or other sensitive details about yourself or anyone else in answers, messages or media: Sonize does not ask for them. A dietary or accessibility note, if a guest chooses to give one, is erased with the guest's contact data 90 days after the event.

Legal bases for guests. Joining, the guest list, reminders, a change of date or a cancellation, the link to come back to the event and the event's songs are part of the participation contract (GDPR art. 6(1)(b)). Checking what guests write before it appears relies on Sonize's legitimate interest in protecting the people who take part in an event, or are named in it, from cruel, sexual or defamatory content, and in keeping the service free of abuse (art. 6(1)(f)). A guest's text is first checked by fixed rules and against the event's guest list. It may then be sent on its own, without any name or identifier, to OpenAI's moderation service. Only when that check cannot decide, for example because the text names someone who is not on the guest list, may it be sent to an AI moderation provider together with the names of the event's guests, the people it celebrates and its host, so that the provider can tell the people who belong to the event from those who do not. A guest may object to this use of their name by writing to privacy@sonize.io; we look at each objection and tell the guest what we decided. Handling reports of illegal content and orders from the authorities is a legal obligation (art. 6(1)(c)). Keeping the record of a guest's acceptance relies on Sonize's legitimate interest in being able to prove the contract. The optional participation choice offered at some confidential events relies on consent (art. 6(1)(a)): the guest may refuse it or withdraw it at any time and stays on the event, but cannot answer that event's confidential questionnaire without it.

Who is responsible. Sonize is the controller (the one responsible under data protection law) for the guest page, the participation contract, AI processing, the checking of contributions, how long data is kept and the record of acceptance. When the organizer is a company or another organisation holding the event for its activity, the organizer and Sonize are joint controllers for collecting guests' contributions at that event and using them for its songs: the organizer decides to hold the event, whom to invite and what to ask, and sees the answers and songs, while Sonize decides how the service processes them. Under their arrangement, set out in the Terms of Service, Sonize gives guests this information, handles their requests and keeps the service secure, and the organizer is responsible for its own use of what it sees in or exports from Sonize and for having a legal basis to add invitees. A guest may exercise their rights with either of them. When the organizer is a private person holding a private event, the organizer's own use is a personal activity and Sonize alone is the controller.

We process data necessary for your account, requested creation, sharing, purchases and support to perform our contract with you or take steps you request before contracting. Security, proportionate fraud prevention, moderation and essential operations may rely on legitimate interests, subject to necessity and balancing. Accounting and legally required responses rely on legal obligations. Claims records are limited to what the particular claim requires. A contract with an organizer is not a contract with each participant or person mentioned: event guests have their own participation contract with Sonize, and the legal bases for guests, invitees and people mentioned are set out under “Personal data we process”. Do not submit confidential or sensitive third-party information without a valid legal basis.

When you send a song to another member, we store who sent it to whom and when, any note you add (up to 150 characters), and whether it was declined, hidden, played or reacted to. By default, songs from members you are not connected with arrive as requests, and people who send you a song can see when you played it and any reaction you add. You can change both in your privacy settings. These records are kept until the song or either account is deleted.

When you give someone a song or credits, we also store the occasion, any scheduled delivery time and whether it is a gift. For a song, we store whether it was kept or hidden and, when it is shared or given inside Sonize, the recipient's account email address; for credits, the sender name shown, the address you entered, the number of credits, your message and how the gift was paid. A gift addressed to an email address is matched to a Sonize account only after the owner of that address has verified it; a song gift is then added to the recipient's Library and a credit gift can be claimed in the app. The recipient is told in the app, by one email to the address the gift was sent to and, depending on their notification settings, by push, and the sender is told once when a song gift is kept and when a credit gift is redeemed or expires. Someone without an account receives the gift by email: it shows the sender's username or, if the sender has none, the part of the sender's email address before the @, and for credits it also contains the sender's message. There is no automatic reminder; for a credit gift, the sender can have the same email sent again at most twice. Each gift or shared-song email has a “Don't email me again” link; using it puts the address on our do-not-email list. A song shared with a member without making it a gift is announced in the app and by push only, never by email. Removing a recipient's access, a recipient hiding a song, or a song gift's link expiring does not delete the record; it is kept for the periods set out below.

If someone gives you a song or credits, we keep your email address (or, for a gift sent inside Sonize, your account), the note written to you and whether you opened, claimed or hid the gift, as part of the sender's gift record. Your data export includes the gifts you received, with the sender's username, the date and the message you were shown, as well as the gifts you sent. If you delete your account, we remove your email address and the note written to you from other people's gift records, and the sender's notifications no longer show your address; what remains no longer identifies you, and the sender sees that the recipient deleted their account. Gifts still waiting for you can then no longer be claimed, even by a new account using the same email address; contact contact@sonize.io to review cancellation or refund of credit gifts that can no longer be claimed.

New profiles are public, show your listening activity, reactions and achievements to others, and can be mentioned, and people who send you a song can see when you played it. Songs from people you are not connected with arrive as requests you can accept or ignore. Your songs stay private until you share or publish them. You can change each of these in your privacy settings.

When you publish a song, anyone can see its title, cover, lyrics, audio, play count and your username, including in Explore, in its clips feed and on your profile, where the moving picture is drawn on the viewer's device from the song itself. Where Sonize has switched it on, a short video of each published song, showing your username, is also made automatically for the song's page and for link previews. Published songs and public profiles are also listed in our sitemap for search engines, which can index those pages. If you enter a song in a weekly challenge, it is shown to the participants of your challenge market, which we assign from the country and region of your internet connection; its final placement, with its vote and listener totals, then appears on the song and in a public archive of past challenges while the song stays public. No one is shown who voted for which song. To decide whether a vote counts, we check when your account was created and whether you listened to the entry after voting opened; we do this for every vote, and only the outcome affects the result. We keep a challenge market for every signed-in account, whether or not it enters a challenge: the latest country, region and time zone that our network provider derives from your internet connection, with your language setting and no network address. If your song wins, the result record keeps the winning entry, no longer linked to your name, after you close your account. If you make a playlist public, anyone with its link, including search engines, can see its name, description and cover, your username and profile picture, and the public songs in it; songs that are not public are left out.

Marketing consent is separate from analytics and email-open/click tracking. The weekly recap, weekly-challenge emails, low-credit reminders (at most one a day), event-anniversary and occasion reminders, and Sonize's marketing campaigns are sent only if you have agreed to receive marketing emails, and each of them carries a one-click unsubscribe link. You can also turn these emails off in Settings, under Privacy. Refusing optional processing does not prevent registration or core service use. Withdrawal stops future consent-based processing without affecting prior lawful processing. Recommendations and gamification use preferences and listening or interaction history; you may object to processing based on legitimate interests at privacy@sonize.io.

When you share a public song outside Sonize, the link carries your username, so its recipients can see who shared it and a sign-up through it can be credited to you. It also carries a random attribution tag that does not show your name but that we link to your account. When someone listens to enough of the song through that link, we record only that your link earned a listen and when; we store nothing about the listener. The listener’s network address is used briefly to limit abuse and appears in our server access logs. We use these records, based on our legitimate interest, to rank trending songs, and we delete them on the same schedule as listening history. On the same legitimate-interest basis, we show you only the aggregate qualifying listen count retained for your own links, without listener identities. Listens are deleted after 730 days by default or earlier with the link. You may object at privacy@sonize.io.

If you set an occasion reminder, we store the label, day and month you enter (never a year), which may concern someone else, so we can email you before it each year. You can delete a reminder at any time in your settings, and reminders are deleted with your account.

Optional browser analytics and browser error reporting use your consent. Session replay stays disabled on web, mobile and TV. Native diagnostics have a separate choice; enabling native product analytics also enables the diagnostic processing described here. Identified server events about purchases, music renders, in-app song sends (delivery, first play and reactions) and, while a price test runs, which price variant you were shown are sent to PostHog only with analytics consent, checked again before delivery. Refusal, withdrawal or an analytics restriction stops these optional exports. Guests are not tracked through an organizer account surrogate. Billing, fulfilment, security records and aggregate operational monitoring are separate and remain available to run the service. They are not all anonymous merely because they originate on a server.

Some of this data you have to give us. An email address and either a password or a linked sign-in are required to enter into the contract: without them no account can be created. Billing and tax identifiers are required to perform a paid order and to issue the invoice accounting law obliges us to keep: without them a purchase cannot be completed. A username is also required before you can use the app, because it is how you are identified on Sonize. Everything else is optional — a profile picture, a bio, a voice recording, a questionnaire answer, analytics consent — and refusing it costs you nothing but the feature it powers.

Connecting a music account is optional and available only where Sonize offers it. When you connect YouTube Music, Spotify or Apple Music, Sonize receives authorization tokens, the account or channel identity and display name available from that service, and the catalog information needed to match songs and save the playlists you request. We encrypt authorization tokens at rest; Sonize does not receive your music-service password. Your connection and save history are available only through your own Sonize login, not to other workspace members.

We use this information to maintain the connection, match tracks, show you the results for review, and create a playlist only after you confirm. We send the chosen service search terms and the playlist details needed for that operation. Sonize and its infrastructure providers process this information to deliver your requested connection and saves; the music service processes information under its own terms and privacy policy. Data obtained through connected music services is never used to train AI models.

Match reviews are valid for 24 hours. Provider match metadata and saved-playlist identifiers and links expire 30 days after the save request and are removed by scheduled cleanup. Cleanup can be delayed during an outage. Your connection identity is periodically refreshed while the connection remains valid. Disconnect in Settings > Privacy or in the playlist’s “Save to your music service” section to stop future access and immediately remove Sonize’s stored authorization tokens, connected identity, provider match metadata and saved-playlist links. The original Sonize playlist and a record of the expired save may remain under the general account retention rules. Playlists already created in the music service remain there; manage or delete them in that service.

The YouTube Music connection uses YouTube API Services. Google’s Privacy Policy applies to Google’s processing: https://policies.google.com/privacy. You can also revoke Sonize’s access in Google’s permissions settings: https://security.google.com/settings/security/permissions. For questions or deletion requests, contact privacy@sonize.io.

Spotify is a beneficiary of this Privacy Policy as described in our Terms of Service.

Authorized Sonize personnel and account collaborators receive only the data needed for their role. Infrastructure, storage, email, push, payment, app-store, analytics, authentication, AI, transcription, and music-generation providers receive the minimum data required for the requested function. The AI providers are Google (Gemini, Lyria and image creation), for lyrics, titles, moderation, AI-playlist curation, writing and translating weekly challenges, music, covers and clip illustrations; Anthropic (Claude), which writes your music clip's storyboard or film; and OpenAI, for voice transcription when you dictate, for moderating comments and guest submissions, and for researching public topics for weekly challenges. The current register, purposes and data categories are published in Subprocessors, with the processing location where it is fixed; the legal entity, location and transfer mechanism for any provider are available from privacy@sonize.io.

To suggest tracks for AI playlists, Sonize's servers search Apple's public iTunes catalogue using only artist and song names, without any account information. Track artwork in those playlists is loaded directly from Apple's servers, which therefore receive your device's network address, browser or app details and, on the website, the Sonize site address; Apple handles this under its own terms and privacy policy.

For support or security, authorized Sonize staff who use multi-factor authentication may access the service as your account for up to 15 minutes at a time, and only after recording a reason, which is kept in our audit log. During that time they can see and use your account as you would. They cannot change your consent or privacy choices, submit or cancel data-rights or deletion requests, create sharing links, or create lasting sign-ins to your account.

When personal data is transferred outside its originating country, Sonize uses the transfer mechanism recorded for that recipient in the processor register, such as an adequacy decision or Standard Contractual Clauses with supplementary measures where required. Each provider's contract status and transfer safeguards are recorded in that register. Some providers are established in the United States, or can access data from there or from another country outside the European Economic Area: Google, Anthropic, OpenAI, Stripe, Cloudflare, Resend and Expo, and, for support access to data hosted in the European Union, PostHog and Grafana Labs. Where the GDPR applies to such a transfer, the safeguard recorded for the provider is either the European Commission's adequacy decision for the EU-US Data Privacy Framework, for a recipient certified under it, or the Commission's Standard Contractual Clauses; where a provider's certification or signed agreement is still to be confirmed, the register says so. Write to privacy@sonize.io to learn what applies to a provider and to obtain a copy.

Your account and profile data, your song library, the prompts and lyrics behind it, the media you uploaded or generated, your playlists, comments, social connections and the attribution tags on links you share are kept for as long as your account exists (a tag is also deleted with its song), and are deleted or anonymized when it is closed.

A confirmed account deletion has a 72-hour grace period and can be cancelled from the same screen before execution.

Request account deletion in Settings > Privacy, or contact privacy@sonize.io if you cannot sign in. We verify the request proportionately. Local erasure and processor follow-up are tracked separately; we do not report full completion while required processor actions remain unresolved. We respond within one month; where the law permits an extension for complexity or volume, we notify you within that month with the reasons. Limited accounting, fraud-prevention and claims records may remain where justified and access-restricted. Backups expire under their separate lifecycle and must not reintroduce erased data when restored.

Everything else has its own clock. Expired one-time authentication state is deleted promptly. Each signed-in session keeps a record of the network address, browser and device description, and approximate location (city and country) seen when you signed in and each time the session was renewed. A session lasts at most 90 days. Its records are deleted 30 days after the session is revoked or reaches that 90-day limit, so no later than about 120 days after you signed in. Guest contact data is scrubbed 90 days after the event; questionnaire and event-wall data after 12 months; event songs after 24 months, unless the organizer or a guest has kept the song in their own library (the event's creator is warned 30 and 7 days before), and play-event analytics and listens earned by shared links after 24 months; for a credit gift that expired without being redeemed, the recipient's email, the address as the sender typed it and the gift message 90 days after the gift was created; the recipient address and message of a redeemed credit gift, and of a song given or shared privately outside an event, have no fixed time limit: a song's are kept until the song is deleted, even if its gift link expired unclaimed, and a redeemed credit gift's are kept with the gift record, and when the sender closes their account, the recipient addresses and messages in their gift and share records are removed, except that a paid credit gift still waiting to be claimed keeps the recipient’s address to identify its intended beneficiary for delivery and redemption, subject to the recipient’s erasure rights; funded pending gifts have no automatic claim deadline; processed delivery work after 14 days and local development email files after 7 days; support and contact submissions after 3 years; copyright notices 6 years from receipt. Spoken-brief audio is held only in memory while it is transcribed, then discarded; Sonize creates no reusable voice profile. A transcript persists only when you submit it as a song input. When you request karaoke or synced lyrics for an uploaded song that has no lyrics, its audio is sent to our transcription provider to write and time the lyrics, and the resulting timed lyrics are stored with the song. Songs that already have lyrics are timed on Sonize's own servers, with no provider involved. The scrub of guest contact data 90 days after the event also removes any dietary or accessibility note a guest gave.

Network addresses used to limit abuse are deleted within about a day.

Support requests you send while signed in are listed for you under Help, with their status, for as long as they are kept; our internal notes are not shown.

Records the law obliges us to keep outlive the account: invoices and accounting records for the statutory period of the seller's country — 10 years in France under art. L123-22 of the Code de commerce — and fraud, safety, moderation, copyright, and security evidence for the applicable limitation period. Access to them is restricted to the people who need it, and any deletion suspended by a legal hold is recorded with a case reference, a scope, and a review date. When an account is deleted, we clear the free-text notes in reports it filed or that concern the account itself, and in sanctions against it and appeals it made. The moderation case records themselves are kept.

PostHog product events currently have no verified automatic deletion deadline. The plan displays an 84-month query entitlement; it is not a deletion guarantee, and a query-retention filter does not erase stored events. Events contain pseudonymous identifiers and technical metadata. Withdrawing consent stops optional collection; erasure requests include PostHog. Session replay has a separate 30-day retention period. Contact privacy@sonize.io for retention and erasure questions.

Audit records are scheduled for deletion after five years. Superseded consent evidence is scheduled for deletion after five years; the latest choice is kept while needed to apply it, then for up to five years after completed account erasure. Daily expiry jobs process bounded batches. Relevant evidence for a specific dispute or legal obligation is separated and retained only as justified. Financial records follow their separate statutory schedule; legal document text contains no individual consent record.

Depending on your location and the processing involved, you may have rights to know or access data, correct it, delete it, restrict or object to processing, receive portable data, withdraw consent, opt out of covered sale, sharing, targeted advertising, or profiling, use an authorized agent, and appeal a refusal. Sonize does not sell personal data. Under French law you may also give us instructions on what should happen to your data after your death (Article 85 of the French Data Protection Act, Loi Informatique et Libertés); write to privacy@sonize.io. Use the privacy controls or open a rights request; identity will be verified and requests are tracked to the applicable deadline, which is one month from receipt under Article 12(3) GDPR, extendable by two further months for a complex request if we tell you inside the first month. Sonize's lead supervisory authority is the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr, to which you may lodge a complaint; you may also complain to the authority of the country where you live or where the alleged breach happened, and going to a regulator does not stop you going to court. When we close a request, we tell you the outcome in the app and by email; if we refuse it, we give you the reason and remind you that you can complain to the CNIL or another supervisory authority and go to court. If you have no Sonize account, or cannot sign in, you can make a request with the form at /privacy/request: we email you a link, valid for 48 hours, to confirm that the address is yours, and the one-month period runs from the day you sent the form. If you are in the United Kingdom, you can also complain to the Information Commission (ICO, ico.org.uk). The analytics software on our website is set to respect a browser's “Do Not Track” signal: while your browser sends it, that software records nothing, even if you accepted analytics. Nothing else changes in response to that signal; a Global Privacy Control signal is handled as the Cookie Policy describes.

Sonize account registration is restricted to people aged 18 or older. There is currently no child-account or parental-consent registration path. If we learn that an ineligible child created an account, contact privacy@sonize.io so the data can be reviewed and deleted. Each account holder confirms at sign-up that they are 18 or older. If we find that an account belongs to someone under 18, the account is restricted: its songs, playlists and profile are taken off public pages, and it can no longer create, publish, comment or buy. Signing in, exporting or deleting the data, contacting support and cancelling a subscription remain possible. Only our support team can lift the restriction.

Sonize uses encryption in transit and at rest, least-privilege access, forced tenant row-level security, credential hashing, rate limits, audit records, and automated database backups. Security incidents are assessed and notified to regulators and affected people when applicable law requires it. Automated systems may assist content safety and fraud detection, but account sanctions and privacy-rights refusals are not made solely by automation without an available human review path.

You can complain about our handling of personal data at privacy@sonize.io or through /contact?topic=privacy, including without an account. We acknowledge data-protection complaints within 30 days, investigate without undue delay, keep you informed and communicate the outcome. UK residents may also complain to the ICO at https://ico.org.uk/make-a-complaint/.

US residents can use /privacy/request to request access, correction or deletion, or to appeal a refusal. You may use an authorized agent; we may verify their authority and your identity. We do not discriminate for exercising privacy rights. If an appeal remains unresolved, you may contact your state Attorney General. We do not sell personal information or share it for cross-context behavioral advertising.

Sonize does not use your prompts, lyrics, uploads or generated songs, or what you contribute to an event as a guest, to train generative AI models. We send the material needed for the requested feature to the providers named in /legal/processors. Google's Gemini writes lyrics and titles, helps moderate content, curates AI playlists and writes and translates weekly challenges; Lyria 3.5 makes the music through the paid Gemini API; and Gemini image generation creates covers and clip illustrations. Anthropic's Claude writes the storyboard or the film of a music clip from its text, never from the audio recording, under Anthropic's commercial API terms, which prohibit training models on customer content. OpenAI transcribes the briefs you dictate, screens song comments and researches public topics for weekly challenges without receiving member content; guest-text screening may use Google Gemini or OpenAI. Paid Gemini and OpenAI API content is excluded from model training under the applicable service terms. Provider safety monitoring, limited retention and legally required disclosures are separate from training; no-training does not mean zero retention. Connected music-service data is never used for AI training.

Account, requested music creation, library and sharing — contract with the account holder; normally until account closure, subject to the exceptions in Retention.

Event guests — their participation contract with Sonize; checking event texts, including with the names of the event's guests, the people it celebrates and its host — legitimate interests; people mentioned in an event and invitees added by an organizer — legitimate interests; contact data 90 days after the event, source material 12 months and event songs 24 months unless kept in a library.

Optional product analytics and browser errors — consent; collection stops on withdrawal. PostHog event deletion has no verified automatic deadline; see Retention.

Security, fraud prevention and moderation — legitimate interests where necessary and balanced, or a legal obligation where applicable; the specific evidence and justified limitation period control retention.

Purchases and invoices — contract and accounting obligations; French accounting records 10 years. Support — contract or legitimate interests; 3 years. Copyright notices — legal obligations and defence of claims; 6 years from receipt.

This summary does not replace the detailed rules above, recorded legal holds, backup lifecycles or your privacy rights.