Legal
Privacy Policy
What changed in 1.5
- Deleting your account now deletes your feedback and the support mail from your verified address, with our replies, and also your token requests with their notes and your daily activity counts (section 4).
- Export my data now holds everything we keep about you, and section 4 lists it.
- Section 2 names what it did not before: the links we email you, your signed-in devices, token requests, daily activity and app logs. It also says plainly that the token ledger and what each AI request cost stay, pseudonymized, after you delete your account.
- The 30-day log of your instructions keeps only your own words, never the project, photo or document state sent with them.
- Feedback of every kind, signed in or not, is one row in section 2, kept to hear from you and improve the apps.
- Gusta Music's cloud backup holds the song, never your recordings or the audio files you import, and Publish to your Gusta library is named in section 2.
- Gusta Home is named: section 1 says your house plans and the photos you trace them from stay on your device, and section 2 says what its assistant requests contain.
- A request the AI model declines is recorded as declined, with the area it named, never what was asked; an error the AI provider returns joins the 30-day app logs.
We are in open beta and are not selling anything, so there are no purchases and no card data today. The ledger below records the free tokens we grant and what the AI consumes. The purchase rows only start existing when buying opens.
1. Most of your data never reaches us
The Gustalabs apps are local-first. Your songs, samples, recordings, 3D models, photos, video footage, the images you draw on in Gusta GIF, your house plans in Gusta Home and the photos you trace them from, and preferences live in your own browser's storage on your own device (Gusta GIF stores no images at all: they stay in the open tab) unless you save a project to the cloud (in Gusta Music, signing in backs up your songs as you work, without your recordings or the audio files you import). In Gusta Video that is absolute: imported video and audio never leave your device at all, and there is no setting that would send them. When you ask the AI assistant for help, what it needs to answer travels with that request; section 2 says what. We run no ads and no third-party trackers, and the sites set no cookies. We do measure usage (how many sessions and how long they last) to see whether the apps are working and used. This uses no cookies and no identifier that follows you between visits: each visit is an unrelated, throwaway session id held only in memory. A session record holds that id, which app it was, and when it started and last checked in, and it is deleted automatically after 90 days. If you are not signed in, that is all it holds and the session is anonymous. If you are signed in to a Gusta account during the visit, the session record is also linked to your account, so we can see how account holders use the apps: which apps, how often, and for how long. A session record never contains anything you made or typed. Your IP address reaches our server with each report, as it does with any web request; it is used only to limit how many reports one address can send, kept in the server's working memory for that, and never written to a database or a log. Basis: legitimate interest in knowing whether the apps are used and working, and how account holders use them. Feedback you send without an account is covered under Feedback in section 2. Apart from that, what follows is only about the data we actually store when you use a Gusta account.
2. What we store, why, and for how long
- Account: your email address, a salted hash of your password (never the password itself), and whether the address is verified. We send account emails only: the signup verification link, a password reset link when you ask for one, and confirmations when you change your email address. No marketing email. We store each link we email as a hash, with when it was sent, when it expires and when it was used, and for a change of email address the new address. A link lasts at most 24 hours, and we delete its record a day after it expires, also when you delete your account in the meantime. We also keep the ways you sign in until you delete the account, and, for each device you are signed in on, when it signed in and when it was last used; that record goes when you sign out there, when the device goes 6 months unused, or when you delete the account. Basis: contract. Kept until you delete the account.
- Token ledger: the tokens we grant you and what the AI consumed. Nothing is for sale during the open beta, so we hold no purchase or card data. The ledger is our books, so it is kept when you delete your account, pseudonymized: linked only to an account number that no longer carries your email. If buying opens, card details will go directly to Stripe and we will never see them; purchase records (amount, VAT, country, a VAT number if you give one, and any refund) are then kept as Swedish law requires (7 years), pseudonymized the same way after account deletion. Basis: contract and bookkeeping law.
- Cloud saves: projects you save to the cloud, and in Gusta Music the songs it backs up while you are signed in. Basis: contract. Kept until you delete them or the account. In Gusta Video, backup is off until you switch it on for a specific project, and what is stored is the edit document only: clip timings, titles you typed, section names, and the names, sizes and durations of the media files the edit refers to. No video, no audio, and no thumbnail of your footage is stored. In Gusta Music, a cloud save holds the song itself (its parts, notes and settings, and the names of the sounds it uses) and a small picture of its arrangement; your recordings and the audio files you import stay on your device and are never part of it. Audio that earlier Music backups uploaded stays until you remove it (Remove recordings from cloud backup, in the Project menu), delete the song or delete your account. When you choose Publish to your Gusta library, the song's mix as an MP3 is stored in your account's library so your other Gusta apps can use it, until you delete it or the account.
- AI requests: two records. What each request COST (which app, model, token counts, duration, success) is part of our cost records: it is kept, and if you delete your account it stays, pseudonymized like the ledger. When the AI model declines a request, that record also notes that it declined and the area it named for declining, such as cyber security or biology, never what was asked. Separately, the INSTRUCTION YOU GAVE (what you typed, or a suggestion you tapped) is logged for 30 days for abuse detection and support, then swept automatically; it is truncated, and it is only your own words, never the project, photo or document state sent alongside them. Basis: legitimate interest. The logged instructions are deleted immediately if you delete your account.
- What an assistant request contains: when you ask the assistant for something, your message is sent along with the context it needs to answer. In Gusta Video that context is the edit itself and what the app has measured about it: clip timings, section names, the text of any titles you added, the names of your media files, and where the silences and shot changes are. It never includes video or audio. In Gusta Photo it is the photo's file name and dimensions, your edit's settings and what the app measured, plus a reduced copy of the photo as it currently looks (at most 768 pixels on the long side), never the original. In Gusta GIF it is the GIF's words and numbers (frame timings, the words of your captions, the effects), plus one small contact sheet of chosen frames (at most 512 pixels on its long side, never larger) only when a request needs to see them or the assistant checks something it placed; Gusta GIF's free helper runs on your device and sends nothing. In Gusta Home it is the house's words and numbers (the rooms, walls, doors and windows with their sizes and where each size came from, the furniture, the garden, the finishes and the roof, the house's name and, if you chose one, its place on the map rounded to a tenth of a degree), plus one small drawing of a floor's plan (at most 512 pixels on its long side) only when a request needs to see it; never a photo you traced from. Gusta Home's free helper runs on your device and sends nothing. That context goes to the model provider (section 3) to answer the request; it is not kept in our own prompt log.
- Usage sessions while signed in: the session records described in section 1 for visits made while you were signed in, linked to your account: which app, when the session started, when it last checked in, and when it ended. Never what you made or typed. Basis: legitimate interest. Deleted automatically after 90 days; the link to your account is removed immediately if you delete your account.
- Token requests: when you tell us which token pack you would buy, or press Get more tokens: which pack, in which app, where in the app, the note you typed, and whether we granted tokens. Basis: legitimate interest in learning what people would pay for. Kept until you delete the account, then deleted; tokens we grant you appear in the token ledger.
- Daily activity: for each day and app, how many AI requests you made and what they cost us, how many cloud saves and exports you made, and the times of the first and last of these that day. Never what you made or typed. Basis: legitimate interest in usage and cost statistics. Kept until you delete the account, then deleted with it.
- App logs: while you are signed in, the technical reports an app sends us (an error: what went wrong, and when; or how an assistant request went, such as how many changes it proposed) are linked to your account, and so are problems our server logs for your account, such as an email it could not send or an error the AI provider returned for your request (its error code and message, never what you sent). Basis: legitimate interest in keeping the apps working. Deleted automatically after 30 days; deleting your account does not delete them sooner, but from then on they are linked only to the pseudonymized account number.
- Feedback: anything you send us through an app's Feedback button or to support@gustalabs.com, with the details the app attaches and the reply email if you leave one, and our replies. Basis: legitimate interest in hearing from you and improving the apps. What you send while signed in, or from your account's verified address, is deleted when you delete the account; anything else is kept until we delete it, and we delete it when you ask at support@gustalabs.com.
3. Who processes it
Four processors, no one else: Amazon Web Services hosts everything in Stockholm; Resend delivers account emails (verification, password reset, email changes) and receives your email address; Anthropic runs the AI models that answer assistant requests, which can involve processing outside the EEA under the EU standard safeguards; Stripe will process payments if and when buying opens. We never sell or share data for advertising.
4. Your rights, self-service
Both rights that matter most are buttons in the account menu of every app, no support ticket needed:
- Export my data: a JSON export of everything we hold about you: your account record, the ways you sign in and your signed-in devices, the links we emailed you (with a pending new address), the token ledger, any purchases, what each AI request cost, the instructions in the 30-day log, your token requests with their notes, your daily activity, the app log lines linked to your account, your cloud saves (saved files download separately), your feedback threads and the support mail from your verified address, with our replies, and the usage sessions linked to your account. It never contains a password or a sign-in secret.
- Delete account: permanently removes your email address and password, the ways you sign in and your signed-in devices, your cloud saves, the 30-day log of your instructions, your feedback and the support mail from your verified address, with our replies, your token requests with their notes, and your daily activity, and unlinks your usage sessions from your account. What stays is pseudonymized, linked only to an account number that no longer carries your email: that account record's dates (when it was created, verified and last active, and which version of the terms you accepted), the token ledger and any purchase records (our books, and for purchases what Swedish bookkeeping law requires) and what each AI request cost (our cost records). Tokens left in the account are forfeited. Links we emailed you are deleted a day after they expire, and app log lines after 30 days.
You also have the rights to rectification, restriction, and objection under the GDPR, and you can complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or your local supervisory authority. For anything else, use the in-app support channel or email support@gustalabs.com; both reach the same people, and section 2 (Feedback) says how long it is kept.
5. Security
Everything is served over TLS. Passwords are stored hashed, access tokens are opaque and revocable, the apps enforce a strict content security policy, and production access is limited to the operator. If a breach ever affects your data, we will tell you and the authority as the GDPR requires.
6. Changes
If this policy changes materially, we will show a notice in the apps before the change takes effect. The version and date at the top always tell you what you are reading.