Who we are
Mixrounds is operated by Team Judas Limited, a company registered in England & Wales (company no. 10199335). Our registered office is 5th Floor, 111 Charterhouse Street, London EC1M 6AW, United Kingdom.
Under the UK GDPR and the EU GDPR, Team Judas Limited is the data controller for the personal data described in this policy — except where we act as a processor on behalf of an engineer using Mixrounds. See §3 for what that split means in practice.
Our Data Protection Officer can be reached at dpo@mixrounds.com, or by post at the address above marked "FAO Data Protection".
What data we collect and why
We process three broad categories of personal data. Each is collected for a specific, narrow purpose — never repurposed for marketing without your explicit consent.
a) Engineer account data
Your name, email, password hash, studio name, billing details (handled by Stripe), work-for-hire signatures, files you upload, and the projects, clients, contracts, invoices and messages you create in Mixrounds.
b) Client-side data flowing through the platform
When an engineer invites their client to a portal, we process the client's name, email, feedback comments, and any files the engineer uploads on their behalf (mix versions, references, stems). For this data we act as a processor — see §3.
c) Platform telemetry
Device type, browser, session events and error traces. We use these to keep the service running and to understand which features are used — via PostHog Cloud on their EU-hosted infrastructure, opt-in only (see §9). We do not maintain advertising profiles.
The engineer ↔ client split
Mixrounds sits between an engineer and their clients. That means we play two roles at once, and it matters who is asking what.
- For your engineer account, we are a controller. You have a direct relationship with us. This policy governs how we handle your data.
- For your engineer's clients, we are a processor. The engineer decides which client is invited, what audio they hear, and how long the project lives. We provide the infrastructure and process their data only on the engineer's documented instructions.
- The DPA sets the terms. Every engineer account is automatically bound to our Data Processing Addendum (Art. 28 UK/EU GDPR). No signature required — accepting our Terms accepts the DPA.
Lawful bases
We rely on the following Art. 6(1) UK GDPR bases:
- Contract (b). To provide the Mixrounds service you have signed up for — hosting your projects, running the review workflow, issuing invoices.
- Legitimate interests (f). Service integrity, fraud prevention, aggregate product analytics. Balanced against your rights and interests; balancing tests are documented and available on request.
- Consent (a). Non-essential cookies and any future marketing communications. Withdrawable at any time from the cookie banner or account settings.
- Legal obligation (c). Tax records, anti-money-laundering checks, and responses to lawful authority requests.
Sub-processors and international transfers
We rely on a limited, curated set of vendors — hosting, transactional email, payments, analytics, AI text processing. The current list, including purpose, region and each vendor's DPA, is maintained at /legal/subprocessors.
Some vendors sit outside the UK and EEA. For those transfers we rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, backed by a documented Transfer Impact Assessment. Copies available on request.
30-day notice. We notify engineers by email at least 30 calendar days before adding or replacing a sub-processor that handles their clients' data. You can object; if we can't accommodate you, you can terminate the affected project without penalty.
Retention
We don't keep data forever. Each category has a defined retention window.
- Account data. While the account is active, plus 12 months after closure for security and dispute-resolution purposes.
- Project audio and comments. While the project is open, plus a 90-day grace period after completion. Engineers can trigger earlier deletion from project settings; deletion cascades to backups within 30 days.
- Contracts and invoices. 6 years, as required by the UK Companies Act 2006 and HMRC record-keeping rules.
- Product analytics events. 12 months rolling.
- AI request logs. 30 days for abuse-prevention, then deleted. Anthropic (see §8) does not retain payload.
Your rights
You have the following rights over your personal data — regardless of where you sit relative to Mixrounds.
- Access. A copy of the personal data we hold on you.
- Rectification. Correct anything inaccurate.
- Erasure. Delete it, subject to legal retention obligations (§6).
- Restriction & objection. Pause a specific processing purpose while we work out a disagreement.
- Portability. A machine-readable export of the data you provided. Available self-service from account settings, or on request.
- Withdraw consent. Any time, without affecting processing that already happened.
If you are a client (as opposed to an engineer who has a Mixrounds account), the engineer who invited you is your first point of contact — they control the data. If you can't reach them or need to escalate, email dpo@mixrounds.com and we will forward it and, where required, act as your route to erasure or portability.
You can lodge a complaint with the UK Information Commissioner's Office, or with your local supervisory authority if you are in the EU (e.g. CNIL in France, CNPD in Portugal, Datatilsynet in Denmark). We'd prefer you contact us first — email dpo@mixrounds.com.
AI features and text sent to Anthropic
Three features on Mixrounds use large-language-model inference: the feedback translator, the round summarizer, and the scope-creep flag. All three operate on text — not audio.
What we send
- The specific client comment or set of comments being processed.
- The free-text portion of the engineer's project brief, where relevant to translation.
- A short system prompt describing the task.
What we do not send
- Audio. Not the mix, not stems, not references, not deliverables. Your audio never leaves our storage.
- Identity fields. Not engineer or client names, not project titles, not contact details, not billing info. We strip these before the request.
Our provider is Anthropic, PBC, operating under a zero-retention arrangement: inputs and outputs are not stored beyond the request and are not used to train models. Transfers to Anthropic (US) rely on the EU SCCs / UK IDTA with a TIA on file.
AI suggestions are always labelled and never applied automatically. Every action stays with you.
Cookies and analytics
Strictly necessary cookies
Session cookies keep you signed in, hold your CSRF token, and remember a client-portal handshake so the client doesn't re-authenticate on every page. No consent needed — Art. 5(3) e-Privacy Directive exemption.
Analytics — PostHog Cloud (EU host), opt-in only
We use PostHog Cloud on their EU-hosted infrastructure. PostHog is only initialised after you accept analytics via our cookie banner. Signed session tokens in URLs (portal, intake) are stripped before any event leaves your browser.
What we do not use
- Advertising cookies.
- Cross-site trackers or third-party marketing pixels.
- Session replay on the client portal or engineer app.
Full breakdown, retention windows and vendor identifiers: /legal/cookies.
Contact
- General enquiries — hello@mixrounds.com
- Data protection & rights — dpo@mixrounds.com
- Privacy inquiries — privacy@mixrounds.com
- Security disclosure — security@mixrounds.com
- Sub-processor change notifications — subprocessors@mixrounds.com
- Postal — Team Judas Limited, 5th Floor, 111 Charterhouse Street, London EC1M 6AW, United Kingdom, FAO Data Protection.
We respond to verified requests within 30 calendar days. If a request is complex or numerous, we may extend by up to two further months — we'll tell you within the first month if we need to.