We built DeliverCC for creators who work with unreleased music. We take your privacy seriously, and we mean specifically, not just as a tagline.
DeliverCC (the "Service") is operated by Allen Productions LLC, a Tennessee limited liability company doing business as DeliverCC ("we," "us," or "our"). Our service generates broadcast-ready closed caption files (SRT, VTT, SCC, and Apple TTML formats) for music videos and other audio/video content.
This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have. It applies to your use of the Service through delivercc.io and any associated applications.
By using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.
We collect the minimum information necessary to provide the Service.
Account information. When you create an account, we collect your name, email address, and chosen plan type. If you sign up with Google OAuth, we receive your name and email from Google. We do not request additional permissions beyond name and email.
Payment information. Payment processing is handled by Stripe. We do not store your credit card number, CVV, or full payment details on our servers. We retain a record of your plan type, billing status, transaction history, and Stripe customer ID for billing and accounting purposes.
Service usage data. We collect anonymous information about how the Service is used, including the number of caption files generated, the formats requested, the languages selected, processing latencies, and error rates. This data does not include the content of your uploads, lyrics, or generated captions. It helps us monitor service performance and improve product features.
Communications. If you contact us by email, we retain those communications to respond to your inquiry and improve our support quality.
What we do not collect. We do not log IP addresses, user agents, or geolocation in our application logs. We do not collect device fingerprints, advertising identifiers, behavioral profiles, cross-site tracking signals, or any data not necessary to operate the Service. (Our hosting provider Vercel and our storage provider Supabase have infrastructure-level access logs governed by their own privacy practices; we do not maintain a first-party log of these identifiers.)
This section describes how we handle the content you upload and generate.
Audio files (your uploads). When you upload audio or video to the Service, your browser converts video files to audio locally on your device when applicable. The audio data is then uploaded to our encrypted storage in Supabase Storage (a private bucket, accessible only via signed URLs or our own service-role credentials), where it is associated with your account and processed for caption generation.
Your audio file is automatically deleted from our storage approximately 14 days after upload. The window covers the project review and revision phase of music-video and single-release pipelines, after which audio is no longer needed for re-opening the project. Mechanism: the database reference is cleared by a nightly job at 03:00 UTC for rows older than 14 days, and the orphaned storage object is removed by an automated cleanup process at 08:30 UTC the following day.
Where audio is processed. Audio processing — separating the vocal track and aligning it against your lyrics — runs entirely on an owner-operated Mac Studio (M2 Ultra) located in the United States, under our physical control. The Mac Studio fetches your audio from Supabase Storage using a service-role credential, processes it locally using open-source models (Demucs for source separation and WhisperX for forced alignment), and writes the resulting word-level timings back to our database. The audio bytes are discarded from the Mac Studio after processing completes.
We do not send your content to any third-party AI service. We do not send your audio, lyrics, or any content derived from them to any third-party AI service, hosted large language model, or external inference API for processing. All alignment runs on open-source models (Demucs and WhisperX) on our own Mac Studio, and your content moves only through the chain of Supabase Storage → Mac Studio → caption file. Our infrastructure providers (such as our storage and hosting providers) may use their own third-party tools, including AI tools, to operate their platforms; that is separate from, and does not involve, the processing of your DeliverCC content. No DeliverCC customer content is used by us or by any sub-processor for AI processing or model training. This is a deliberate architectural choice: keeping processing on owner-operated hardware in physical custody is a stronger privacy posture than routing audio through a third-party GPU service.
Lyrics text. The lyrics or dialogue text you paste into the Service is stored alongside your audio reference. During caption generation, this text is used by the alignment software running on the Mac Studio. After processing, the lyrics text is retained as part of your caption history so you can reload past sessions and re-export.
Generated caption files. The caption files (SRT, VTT, etc.) we generate from your audio and lyrics are stored as text in your account history. These files are kept indefinitely so you can download them again at any time, including re-exporting them in a different format. You can delete individual caption files or your entire history at any time through your account settings.
Word-level alignment data. During caption generation, our alignment software produces word-level timing data. This data is retained for 24 hours to enable session recovery and editing, then automatically cleared.
Timing blocks (post-edit). When you click Download in the app, the timing blocks reflecting any edits you made in the timeline editor are saved alongside the caption file. These blocks are kept indefinitely alongside the caption file so you can re-export your captions in another format at any later date.
Audio filename. We retain the filename of your uploaded audio (e.g., "Song Title - Artist.mp3") indefinitely as a display label in your caption history, so you can identify which captions correspond to which song. The filename is text only and does not contain audio content.
No-training guarantee. We do not use your uploaded content, lyrics, generated captions, or any data derived from them to train, fine-tune, or evaluate AI/ML models, ever, for any purpose. This commitment is unconditional. Our sub-processors operate under standard terms that restrict their use of customer data to providing their service to us, and do not permit using customer data to train AI/ML models (see Section 6).
We use the information we collect to:
We do not use your information for targeted advertising, behavioral profiling, or AI model training.
We do not sell, rent, or trade your personal information.
We share your information only in these limited circumstances:
Mac Studio is intentionally not a sub-processor. Audio alignment processing runs on a Mac Studio that we own and operate. It is not a third-party service. We list it here for transparency, but it is not a sub-processor in the GDPR Article 28 sense — there is no external entity to engage. We view in-house, owner-operated processing as a privacy strength compared to routing audio through third-party serverless GPUs.
We use the following third-party services to operate DeliverCC:
No AI processing or model training of DeliverCC content — unconditional. We do not send your audio, lyrics, captions, timing data, or any data derived from them to any AI service for processing, and we do not use any of it to train, fine-tune, or evaluate any AI/ML model. This commitment is unconditional and applies for any purpose. Our sub-processors operate under standard terms that restrict their use of customer data to providing their service to us; under those terms, customer data may not be used for unrelated purposes such as AI training or model evaluation. This scopes our commitment precisely: no DeliverCC customer content is sent to AI services for processing, or used to train or evaluate models, by us or by any sub-processor acting on that content.
We will notify active account holders by email at least 30 days before adding or replacing a sub-processor that handles personal data, and you may object to the change. If we cannot accommodate your objection, you may terminate your account before the change takes effect with a prorated refund of any unused subscription fees.
Current sub-processor list. The list above is the current, publicly disclosed list of sub-processors. The same list is included as Annex 3 of our Standard Data Processing Agreement, available for business customers (see Section 13).
Where your data is stored. Your account data, payment records, audio files, and caption history are stored in the United States (AWS us-east-1, Northern Virginia) by Supabase. Application processing happens in Vercel's US East region (iad1).
Where audio processing happens. Audio alignment processing is performed by an owner-operated Mac Studio (M2 Ultra) located in the United States, under our physical control. The Mac Studio is on private network infrastructure, with disk encryption enabled. Audio bytes are fetched from Supabase Storage to the Mac Studio for processing and are discarded from the Mac Studio after processing completes. No external GPU service or third-party AI processor is involved.
International transfers. For users in the European Economic Area, the United Kingdom, and Switzerland, your personal data is transferred to the United States when you use the Service. We rely on the European Commission's Standard Contractual Clauses (SCCs) with our US-based infrastructure providers (Supabase, Vercel, Stripe, Resend, and Google) for these transfers. We also rely on the UK International Data Transfer Addendum (IDTA) for transfers from the United Kingdom and on adequacy decisions where applicable.
EU-US Data Privacy Framework. Allen Productions LLC is not currently certified under the EU-US Data Privacy Framework. We rely on Standard Contractual Clauses for transfers between the United States and the European Economic Area, United Kingdom, and Switzerland.
We implement security measures appropriate to the scale and risk profile of our processing:
No method of transmission over the internet or electronic storage is 100% secure. While we implement commercially reasonable security measures, we cannot guarantee absolute security. See Section 14 for our breach notification commitments.
We retain different categories of data for different durations, tied to specific stated purposes per GDPR Article 5(1)(e):
Audio files (your uploads). Retained approximately 14 days from upload, then automatically deleted. The 14-day window covers the project review and revision phase of music-video and single-release pipelines — labels and reviewers operate on their own cadence (often end-of-week or later), quality control passes typically take two to three days, and the user may then need to re-open the project to revise. Retention beyond this realistic project tail would not serve a stated purpose and so is not retained.
Mechanism: the database reference to the audio file is cleared by a nightly job at 03:00 UTC for rows older than 14 days. The orphaned storage object is removed by an automated cleanup process at 08:30 UTC the following day.
Word-level alignment data. Cleared from our database within 24 hours of generation. This is the raw word-level timing data produced by the alignment software; it is an intermediate processing artifact, not a user-facing derivative.
Generated caption files. Retained for the lifetime of your account until you delete them. Purpose: enabling permanent re-export. You can delete individual caption files through your account history page, or delete your entire account (which deletes all associated data) through account settings.
Timing blocks (post-edit). Retained for the lifetime of your account alongside the caption file. Purpose: enabling re-export in a different caption format at any later date.
Lyrics text. Retained alongside generated captions for the lifetime of your account. Same deletion rules as caption files — you control when this data is removed.
Audio filename labels. Retained alongside captions as a display label so you can identify your work. Same deletion rules.
Account information. Retained while your account is active. If you delete your account, we will permanently delete or anonymize your personal information within 30 days, except where retention is required by law (such as transaction records for tax purposes, which we retain for 7 years).
Anonymous usage data. Retained for up to 12 months for operational analysis and service improvement, then deleted or further anonymized.
Communications. Email correspondence is retained for up to 24 months for support quality and reference, then deleted unless required for active matters.
You have the following rights regarding your personal information, subject to applicable law and identity verification:
To exercise any of these rights, contact us at privacy@delivercc.io. We will respond within 30 days. We may need to verify your identity before fulfilling your request.
For EU/EEA, UK, or Swiss residents. You have additional rights under GDPR including the right to lodge a complaint with your local supervisory authority. Our designated point of contact for EU/UK/Swiss data protection matters is privacy@delivercc.io.
For California residents. Under the California Consumer Privacy Act (CCPA), you have additional rights including the right to know what personal information we collect, the right to delete, and the right to opt out of the sale of personal information (though we do not sell personal information). To exercise CCPA rights, contact privacy@delivercc.io.
Account deletion process. When you delete your account, we mark it as pending deletion and send you a confirmation email with a 30-day cancellation link. During this period, your account is locked. After 30 days, all your data is permanently deleted from our systems, except records we are legally required to retain (such as tax-related transaction records).
We use minimal cookies necessary to operate the Service:
We do not use:
You can configure your browser to refuse cookies, but this may prevent you from logging in or using authenticated features of the Service.
DeliverCC is not directed at children under the age of 18. We do not knowingly collect personal information from individuals under 18.
If we become aware that we have collected personal information from a child under 18 without parental consent, we will delete that information promptly. If you believe we have inadvertently collected such information, please contact privacy@delivercc.io.
For business customers, especially those handling unreleased music content or operating under data protection regulations (GDPR, CCPA, PIPEDA, etc.), we offer a Standard Data Processing Agreement (DPA) that includes:
To request our Standard DPA, contact dpa@delivercc.io with your company name, signing authority, and any specific requirements. Most DPA requests are turned around within 5 business days.
In the event of a security breach affecting your personal information, we commit to:
Notification will be sent to the email address associated with your account. If we are unable to reach you by email, we will post notice prominently on our website.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations.
For material changes (changes that affect your rights or how we handle your data), we will notify active account holders by email at least 30 days before the changes take effect, update the "Last Updated" date at the top of this page, and for significant changes require you to re-acknowledge the updated policy at next login.
For non-material changes (clarifications, formatting, contact information), we will update the "Last Updated" date and may not send individual notification.
If you do not agree with changes to this policy, you should stop using the Service and may delete your account. Continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy.
For privacy-related questions, data requests, or concerns:
We aim to respond to all privacy inquiries within 30 days.
This section is provided pursuant to Article 30 of the EU General Data Protection Regulation ("Record of Processing Activities" or RoPA) and Article 32 ("Security of Processing"). It is also intended to satisfy similar requirements under the UK GDPR and similar frameworks. The information here is a plain written record of our processing posture, not a substitute for the other sections of this policy — read it alongside Sections 1 through 16.
(a) Controller identity. The controller of personal data processed under this policy is Allen Productions LLC, a Tennessee limited liability company doing business as DeliverCC. Postal address and contact channels are set out in Section 16.
(b) Purposes of processing. We process personal data to: (i) operate the Service — generating caption files from your audio and lyrics; (ii) authenticate users and manage accounts; (iii) process payments and manage billing; (iv) send transactional email; (v) monitor service performance through anonymous usage metrics; (vi) respond to support requests; (vii) comply with legal obligations (tax, accounting, regulatory). We do not use personal data for targeted advertising, behavioral profiling, AI/ML model training, fine-tuning, or evaluation.
(c) Categories of data subjects. Account holders (individual users and business customers of the Service), and the contact persons of business customers.
(d) Categories of personal data. Account information (name, email, plan); payment metadata (Stripe customer ID, billing status, plan and credit history; full card data is held by Stripe and not by us); Customer Confidential Audio (audio files uploaded by the user); lyrics text; generated caption files and timing-block derivatives; word-level alignment data (intermediate, 24-hour retention); audio filename labels; service usage metrics (anonymized at the event level); email correspondence; authentication session metadata.
(e) Categories of recipients. Personal data is shared only with the sub-processors listed in Section 6: Supabase, Vercel, Stripe, Resend, and Google (the latter only for users who choose Google OAuth sign-in). The Mac Studio used for audio alignment processing is owner-operated and is not a sub-processor; no external entity receives audio for processing. Personal data may be disclosed to legal authorities where required by binding legal process. Personal data may be transferred to a successor entity in a business transfer (see Section 5).
(f) International transfers and safeguards. All processing occurs in the United States. Storage and application processing occur in the United States via Supabase (AWS us-east-1) and Vercel (iad1). Audio alignment processing occurs on an owner-operated Mac Studio located in the United States. For users in the European Economic Area, the United Kingdom, and Switzerland, transfers of personal data to the United States are covered by the European Commission's Standard Contractual Clauses with our US-based infrastructure providers, by the UK International Data Transfer Addendum where applicable, and by adequacy decisions where applicable. Allen Productions LLC is not certified under the EU-US Data Privacy Framework.
(g) Retention periods. Audio files: approximately 14 days from upload, then automatically deleted, with the 14-day window tied to the project review and revision purpose stated in Section 9. Word-level alignment data: 24 hours from generation. Generated caption files, timing blocks, lyrics, and audio filename labels: lifetime of the account, deletable at any time by the user. Account information: lifetime of the account; deleted within 30 days of account deletion except where law requires retention (typically 7 years for tax records). Anonymous usage data: up to 12 months. Email correspondence: up to 24 months. Full retention table is in Section 9.
Technical and organizational security measures. A general description of our security measures (pursuant to Article 32):
Article 32 proportionality — access logging. Article 32 of the GDPR requires technical and organizational measures appropriate to the risk and to the scale of processing. We do not currently implement detailed per-read audit logging of every access to audio storage. This is a deliberate calibration to our actual processing posture: a single operator, single in-house machine, with physical custody of the processing hardware serving as the primary access control. Detailed per-read access logging is a control designed for multi-employee, multi-system vendor environments where many individuals have potential access to customer data and access must be governed across them. At our scale and posture, it would not provide a meaningfully different security outcome. If a business customer contractually requires per-read access logging as part of their specific risk assessment, we will evaluate the scope and feasibility under that specific contractual ask.
DeliverCC — a service of Allen Productions LLC, a Tennessee limited liability company.
delivercc.io