Privacy Policy
Effective date: October 4, 2026
For accounts opened before October 4, 2026, changes in this edition take effect 14 days after we notify you of them by email (section 17); until then the previous edition continues to apply.
In short: We use your account information, the audio you choose to submit, processing results, credit and purchase records, and limited technical information to provide Tonamorph. We never use your Input or Output to train, fine-tune or evaluate machine-learning models. Your audio and results are deleted from our storage automatically 24 hours after upload; account and transaction records have different retention periods below. Payment credentials are handled by Paddle. Marketing messages and optional plugin crash reports require your choice. Contact privacy@tonamorph.com about your information or a privacy complaint.
1. Who is responsible for your data
1.1 Gregory Diachenko, an individual (sole proprietor) carrying on business in Israel and operating under the Tonamorph trading name, is the controller (in Israel, the "database owner") of personal data processed to provide the Service you request and for our own account management, billing administration, security, support and marketing purposes. Our business address is 36 Brodetsky Street, Tel Aviv-Yafo 6905155, Israel, and our privacy contact is privacy@tonamorph.com. We refer to this operator as "we", "us" or "our". A trading name is not a separate legal entity. Our Israeli VAT registration number is stated where the contract is made: in section 1.1 of the Terms of Service and at checkout.
1.2 Contact us at privacy@tonamorph.com, or by post at the address above. You may use this contact for rights requests and complaints without creating an account.
1.3 A business customer may determine the purposes of processing personal data in audio it submits. Where we process that information solely on that customer's documented instructions, the parties' respective controller and processor roles and any required data-processing agreement apply to that activity. This does not change our role for the separate purposes in section 1.1, or remove anyone's statutory rights.
1.4 Paddle acts as an independent controller for its checkout, payment, tax, fraud-prevention and other seller-of-record activities. Its own privacy notice explains that processing. We receive the purchase information described below, not the payment credentials you enter into its checkout.
2. Scope
This notice covers the Tonamorph plugin, website at https://tonamorph.com, API and our support channels. It does not govern a digital audio workstation, an independently operated identity provider, the merchant of record's own activities, or other third-party services acting for their own purposes.
The service processes audio selected by the user. We do not provide a music catalogue or a public sharing service for uploaded audio. Our handling of copyright complaints is also described in the Copyright Policy.
3. What data we collect
| Category | Information and source |
|---|---|
| Account and authentication | Email address, user ID, optional display name, account dates and plan, and authentication information needed for the sign-in method you select. Our authentication provider stores password hashes. A password-based sign-in necessarily transmits your entered password securely for authentication; we do not store it as plaintext in our application database. Session and refresh tokens maintain sign-in. An enabled third-party sign-in method may provide the account information disclosed in its authorisation screen. |
| Audio you submit (Input) | The clip you deliberately choose to upload through the plugin or API, its encoded audio, and information needed to process it. The current processing limit is six minutes and 64 MiB (67,108,864 bytes). The plugin may prepare a shorter beginning of the file to meet the processing limit or your available credit balance; the selected excerpt is identified before the relevant confirmation. Direct API submissions over the limits are rejected. |
| Results (Output) | Separated stems, MIDI, tempo, key, note statistics and other analysis or instrument settings produced for your task. |
| Job information | Job ID, status, stage, timestamps, selected options, duration, sample rate, channels, truncation status where applicable, result metadata and error codes. Some information, such as tempo and key linked to a job, can remain after the audio files are deleted. |
| Credits, purchases and subscriptions | Credit grants, reservations, charges, releases, refunds, expiry and adjustments; order/subscription identifiers, prices, currency, status and renewal dates; relevant payment-confirmation data received from the merchant of record, which may include name, email and billing information. |
| API keys | Key hash, a short identifying prefix, label, creation and last-use times. Protect the full key provided to you. |
| Referrals and affiliates | Referral codes and qualifying activity. Where an affiliate programme is enabled, commission records and necessary payout or tax information supplied by approved affiliates. Ordinary checkout payment credentials are distinct from affiliate payout information. |
| Technical and security information | IP address, request and job identifiers, routes, response status, timestamps, plugin version, and relevant device, browser or host information. An IP address may indicate an approximate location; we do not request precise GPS location for this service. |
| Service diagnostics | Technical errors and diagnostic events from our API and workers. Where enabled, these are separate from a plugin user's optional crash-reporting choice. Diagnostic information may include pseudonymous user/job identifiers and stack traces. |
| Optional plugin crash reports | In a version that offers this feature, reports are sent only after it is enabled by the user. Reports may include a backtrace, plugin/OS/DAW versions, the device model, report time and a user identifier. We do not intentionally include audio or credentials in them. |
| Marketing and consent records | Email subscriptions, the choices you make, their time and version, withdrawal/suppression records, and permitted engagement information. Website tracking and email subscription are separate choices. |
| Support, complaints and legal notices | Messages and attachments you send us, verification information needed to handle a request, and relevant complaint, copyright-notice and response records. Avoid sending passwords, full API keys, payment credentials or unnecessary personal information. |
| Plugin sign-in and requests | When you connect the plugin through the website, the names of your DAW and your computer, shown on the approval page so you can recognise the request; with each request, the plugin version and the host application's name and version. |
| Ratings, surveys and plugin installations | A thumbs-up or thumbs-down you give a result, the reason you pick and any short note (up to 140 characters), and the time from dropping the clip to the result; your answer to the in-product satisfaction survey (a score from 0 to 10 and an optional comment); and, when the plugin signs in, its version and the host application, with the first and last time seen. |
| Listening-test votes (only if you take part at /listen) | Which of two versions of a loop you preferred, or that you could not tell; whether you played both versions before choosing; any note you type; the time of the vote; and a keyed hash of your IP address. The hash is a one-way code made with a secret server-side key that is not stored with the votes; we use it to count each visitor once per pair and to limit automated voting. It is pseudonymous, not anonymous, information. We do not store the IP address itself with the vote, and the test keeps nothing in your browser. Source: you, when you vote. |
| Website technologies | Cookies, local storage, referral attribution and website analytics, as explained in the Cookie Policy. A pseudonymous identifier is not necessarily anonymous information. |
We do not obtain the contents of your entire DAW project, contacts, unrelated files or audio you have not selected for submission merely because the plugin is installed. Information you separately send to support is also processed as support information.
Audio can contain identifiable voices and other people's personal information. A voice recording is not automatically biometric identification data; we do not use this service to recognise or authenticate a person's identity from their voice. Do not submit sensitive conversations or other material outside the music-processing purpose. A user's confirmation about rights does not itself supply another person's data-protection consent or remove our obligations.
4. Why we use your data and on what legal basis
Where the GDPR or UK GDPR applies, the following describes our purposes and legal bases. A basis applies only where its legal requirements are met; it is not a general permission to use every item of data for every purpose.
| Purpose | Data | Legal basis |
|---|---|---|
| Account creation, authentication, service messages and providing the requested processing | Account data, Input, Output, necessary job and technical information | Performance of our contract with the individual concerned, or steps they request before contracting. Where a customer is a business rather than that individual, necessary contact administration may instead rely on our legitimate interests. |
| Administering credits, purchases, subscriptions and agreed referral rewards | Account, credit, purchase and relevant referral information | Contract where the individual is a party; otherwise legitimate interests in administering the relevant business relationship. |
| Security, fraud and abuse prevention, API protection and necessary service reliability | Limited technical information, account/job identifiers and service diagnostics | Legitimate interests in protecting and maintaining the service, subject to necessity, proportionality and the individual's rights. |
| Creating anonymised, aggregated operational statistics to operate, secure and improve the service | Lawfully collected service metadata, such as job, credit and technical information; not the audio files themselves | Legitimate interests in operating, securing and improving the service. The statistics must not reasonably identify an individual or disclose a customer's confidential activity, and we do not attempt to re-identify individuals from them. Aggregation alone is not treated as anonymisation. |
| Optional plugin crash reporting and optional website analytics | Relevant diagnostic or analytics information | Consent where required and as described at the point of choice. Optional device-based reporting is not a condition of ordinary service use. |
| Marketing messages and optional marketing tracking | The relevant subscription, consent and engagement information | Consent for the activity concerned. Newsletter subscription does not by itself authorise unrelated browser tracking. |
| Understanding whether results are useful, handling the automatic refund of a result you mark as unusable, and knowing which plugin versions and hosts are in use | Ratings, surveys and plugin installations | Performance of our contract for the refund; otherwise legitimate interests in improving the service and supporting the versions people use. Survey answers are optional. |
| Running listening tests that help us choose which processing to ship, and keeping their results reliable by counting each visitor once per pair and limiting automated voting | Listening-test votes | Legitimate interests in improving the quality of the service and the reliability of test results, subject to the individual's rights. Taking part is voluntary and is not a condition of using the service. |
| Accounting, tax and financial record-keeping | Necessary transaction, invoice and accounting information | Legal obligation where recognised under the applicable data-protection law; otherwise, where lawful, legitimate interests in satisfying applicable accounting and tax requirements. |
| Requests, complaints, copyright notices and legal claims | Relevant correspondence and necessary account/transaction or incident records | Applicable legal obligations, necessary contract administration, or legitimate interests in resolving complaints and establishing, exercising or defending legal claims, as appropriate. |
When we act as a processor for a business customer, processing of its audio follows that customer's lawful documented instructions and the applicable data-processing agreement. Where we are a controller for information about someone who is not party to our contract, the contract with the uploader is not automatically our legal basis for that person's data. Any required additional basis and notices must be established for that processing. Special-category data requires an additional applicable condition; it is not authorised merely by a general legitimate-interest statement.
We do not use your Input or Output to train, fine-tune or evaluate machine-learning models, or to build model-evaluation datasets, and we do not allow our providers to do so. This does not prevent the analysis you request to produce your Output or technical checks needed to complete your job. We do not use a routine privacy-policy update to obtain permission for training on previously submitted audio. Creating anonymised, aggregated operational statistics does not transfer ownership of your Input or Output to us, authorise use of that content contrary to our commitments, extend audio-retention periods or modify this prohibition on model training.
Our processing of musical content is automated. Security and billing controls may also automatically reject a request, reserve credits or restrict a key. Contact support@tonamorph.com about an apparent error. We do not use the musical analysis to make decisions about your employment, creditworthiness or similar personal matters. Any applicable rights concerning significant solely automated decisions remain available.
5. How long we keep data
| Data | Retention rule |
|---|---|
| Input and Output files | Our commitment is to delete these files from our storage automatically 24 hours after the associated upload, by an automatic deletion process. This applies to retained operational audio/result copies, not merely to the expiry of a download link. Download links have their own, time-limited expiry and do not keep a deleted file available. Keep the copy downloaded to your device; the service is not a backup archive. |
| Job history and ordinary result metadata | Deleted shortly after the job's files; credit-ledger entries that refer to a job are kept as accounting records (below). This does not extend retention of audio files. |
| Invoices and accounting records | The applicable statutory record-keeping period. We retain only the transaction information needed for that purpose; keeping every raw webhook indefinitely is not necessary merely because some accounting information must be retained. |
| Account data and ordinary backups | Until account deletion, with residual account-database backups cycling out within 30 days under the configured backup schedule. Backup restoration must not reinstate data that has been marked for deletion without reapplying the deletion. This is not an exception extending the normal audio-file window. |
| API-key hashes | Until revocation or account deletion, with any narrowly necessary security/claim records retained separately. |
| Ordinary application logs | Kept on our servers in size-limited logs that are rotated and overwritten automatically, so older entries disappear as new ones are written; a limited relevant extract may be retained when a specific security incident or legal requirement justifies it. Provider operational logs may have a separately documented retention period. |
| Optional plugin crash reports | Up to 90 days under the reporting configuration; unnecessary personal data is removed earlier where feasible. |
| Marketing information | Until the relevant consent is withdrawn or it is no longer needed. We keep a minimal suppression record to respect an unsubscribe and limited evidence of consent or withdrawal while needed for accountability. |
| Ordinary support correspondence | Up to two years after the last interaction, unless an unresolved dispute or applicable law requires a different, justified period. Do not use support attachments as an alternative long-term audio archive. |
| Copyright notices, privacy complaints and specific security or legal-claim records | Only as long as needed to handle the matter and meet applicable legal obligations or establish, exercise or defend claims. Access is restricted and retention is reviewed when the matter ends. |
| Ratings, surveys and plugin installations | A rating and its note are deleted with the job record, shortly after the job's files. A survey answer is kept while the account is active; when you delete your account its comment is deleted and the score is kept, without your email address, in our service records. Plugin installation records are deleted with the account. |
| Plugin sign-in requests | Deleted one day after the sign-in code expires; a code expires ten minutes after it is issued. |
| Listening-test votes | Until that test is closed, and no longer than 12 months from the vote; a closed test's votes, including the hashes, are deleted together. The votes decide which processing we ship; once that is decided they have no further use. |
Deletion of an account does not require destruction of records that must lawfully be kept, nor does it entitle us to retain unrelated information indefinitely. An exceptional binding legal obligation may require us to preserve specifically identified material beyond the ordinary deletion period; in that event we isolate it, restrict its use and retain it only for that obligation. This is not a general exception allowing us to retain audio for product development or speculative future disputes.
6. Who receives information
6.1 Service providers and independent services
We use service providers for authentication, hosting, processing, communications and related operations. A provider receives only information needed for its enabled role. Merely listing a technical option does not mean every job is sent to every provider. A provider acting for our purposes is subject to the applicable processing terms; some providers separately control their own account, billing, security or legal-compliance data.
| Provider or service | Role and information involved |
|---|---|
| Supabase | Account authentication and database services; account, job, credit, purchase, API-key and listening-test information. Input and Output are also handled if Supabase Storage is the selected storage backend. |
| Amazon Web Services | Enabled API/worker hosting, storage, queues and logs; audio/results and necessary technical/job information. CloudFront, where enabled, also handles delivery requests and may cache results. |
| Modal Labs | Audio computation and necessary job information when the Modal processing route is enabled. |
| RunPod | Audio computation and necessary job information when the RunPod processing route is enabled. The selected service and hosting arrangements determine which infrastructure providers receive data. |
| Vercel | Website hosting and request information; optional website analytics according to the choices described in section 13. |
| Paddle | Independent checkout/payment controller as described in section 1.4. |
| Klaviyo | Consented marketing communications and the specific related profile or engagement information permitted for that purpose; browser tracking only after the corresponding choice. |
| Resend | Transactional email delivery where configured; recipient addresses, message content and delivery information. We do not send user audio to an email provider as part of the normal processing pipeline. |
| Porkbun (forwarding) and Google (Gmail mailbox) | Receipt and handling of messages sent to our support, privacy, security and legal addresses, including message content and attachments. |
| Anthropic | An AI assistant (Claude) that helps us sort messages sent to our support addresses and draft replies; it receives the message content and attachments. A person reviews every reply before it is sent, and no decision about your account is made by the assistant alone. |
| Google and Apple sign-in, if you choose it | Confirming your identity and giving us your email address. Each acts as an independent controller of your account with it. |
| Sentry | Service error diagnostics if enabled, and optional plugin crash reports where the feature is enabled by the user. These two functions are distinct. |
6.2 Other disclosures
We may disclose relevant information to professional advisers under confidentiality, where required by a binding legal process, to investigate a specific complaint or protect rights lawfully, or in connection with a genuine transfer of the business subject to appropriate safeguards and notice. A buyer does not acquire unrestricted permission to use your audio for unrelated purposes.
A copyright complainant or responding user may receive the information necessary to administer the relevant notice or counter-notice procedure. We do not automatically forward every attachment or every item of personal information merely because it accompanied a notice.
We do not sell personal information or disclose it for cross-context behavioural advertising. Any change involving such processing must first meet the applicable notice, consent or opt-out requirements. We do not allow our providers to use your Input or Output to train, fine-tune or evaluate machine-learning models.
7. International processing and transfers
7.1 Our operator is in Israel. Providers may process information in other countries, including the United States and countries in the EEA. Processing locations include relevant storage, support and subcontractor access, not just the region selected for a database.
7.2 Where an applicable adequacy decision covers a transfer, it can provide the transfer basis. The EU recognises Israel as adequate within the scope of its decision. That does not automatically approve every onward transfer to another country or establish that every US provider is certified under the EU-US Data Privacy Framework.
7.3 For a restricted transfer not covered by a relevant adequacy decision, appropriate safeguards must apply. These may include the European Commission's Standard Contractual Clauses and, for applicable UK transfers, the UK Addendum or another approved mechanism, together with supplementary measures where needed. We rely on a certification only where the correct recipient and activity are covered by a current certification. Ask privacy@tonamorph.com for information about the safeguards applicable to your data or a copy, with necessary security/confidentiality redactions.
7.4 Transfers from Israel must also meet the applicable Israeli rules on transfers to databases abroad. Acceptance of our Terms or this notice is not a blanket substitute for the required transfer arrangements.
8. Your rights and complaints
8.1 Depending on the law applicable to the processing, you may request access, correction, deletion, restriction, portability, or an objection to processing. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You may object to direct marketing. Rights may have statutory conditions and exceptions, including protection of other people's information.
8.2 Send requests to privacy@tonamorph.com, or use available account controls. We may request information proportionate to the need to verify identity or authority. We do not require an identity-document copy as a routine condition for every request. An authorised representative may act where the applicable requirements are met.
8.3 For GDPR rights requests, the usual deadline is one month, subject to the applicable law’s rules on verification, clarification and calculation of the response period, with an extension of up to two further months where permitted because of complexity or number of requests; we explain an extension within the original period. Other laws may prescribe different deadlines and we follow the applicable one. Requests are normally free; a charge or refusal is limited to circumstances permitted by law and must be explained.
8.4 Complaints about our handling of personal data may also be sent to privacy@tonamorph.com. Describe the issue and the outcome you seek; a special form or account is not required. We acknowledge, investigate and explain our response without undue delay. Section 10 describes the additional UK complaint-handling timetable.
8.5 You may complain to the relevant supervisory authority, including your EEA supervisory authority, the UK Information Commissioner's Office or Israel's Privacy Protection Authority, as applicable. This notice does not waive that right or require you to give up a statutory remedy.
9. Israeli privacy notice
9.1 This section provides information for the purposes of section 11 of Israel's Protection of Privacy Law. The controller responsible for our processing is the database owner identified in section 1.1, contact privacy@tonamorph.com. Our providers hold or process information for the functions described in section 6.
9.2 You are not generally required by law to create an account or give us audio. Necessary account and authentication information is required to provide an account; the selected audio is required to perform the processing you request. Required transaction information is needed to administer a purchase. Optional marketing, optional plugin crash reports and taking part in a listening test are not required for ordinary service use.
9.3 The purposes of processing and the recipients and purposes of disclosure are set out in sections 4 and 6. We do not treat information supplied for a job as an unrestricted asset for other purposes.
9.4 Subject to the applicable conditions, you may inspect personal information held about you and request correction or deletion of information that is inaccurate, incomplete, unclear or outdated, under sections 13 and 14 of the Law. Contact privacy@tonamorph.com. Other applicable rights are described in section 8.
9.5 Marketing and direct-mailing activities must meet the applicable Israeli notice, identification, consent and removal requirements. You can request removal from marketing communications at any time.
10. United Kingdom
Where UK data-protection law applies, rights and safeguards are applied under that law, including its rules on international transfers. You may raise a privacy complaint through privacy@tonamorph.com. We acknowledge a UK data-protection complaint within 30 days of receiving it, take appropriate steps to investigate without undue delay, keep you informed and communicate the outcome without undue delay. This complaint procedure does not replace the separate timetable for a subject-access or other rights request.
You may also contact the Information Commissioner's Office in accordance with its applicable complaint procedure.
11. California and other US states
11.1 This section describes relevant US privacy rights where the applicable state law covers our processing; it does not assert that every state privacy statute applies to our business. We also consider privacy requests under the rest of this notice.
11.2 The information categories described in section 3 include identifiers, commercial and account records, internet/network activity, uploaded audio and results, and relevant support or diagnostic information. The sources, purposes, recipients and retention criteria are described in sections 3 to 7. Authentication information and information contained in an uploaded recording may qualify as sensitive information under an applicable law; we do not claim otherwise simply because a password is hashed.
11.3 Where available, you may request to know/access, correct, delete or obtain a copy of personal information, or exercise applicable rights concerning sale, sharing, targeted advertising, sensitive information or qualifying profiling. We do not sell or share personal information for cross-context behavioural advertising. Submit a request at privacy@tonamorph.com. We verify requests proportionately, allow authorised agents as required, and do not unlawfully discriminate for exercising rights.
11.4 We process a recognised universal opt-out signal, including Global Privacy Control, as an opt-out of the sale or sharing of personal information and targeted advertising to the extent covered by applicable law. Our current model does not involve selling personal information or sharing it for cross-context behavioural advertising. We do not treat a general 'Accept all' choice as permission to disregard a statutory opt-out. The signal does not, by itself, unsubscribe you from emails you have separately asked for, prevent necessary service messages, or disable website functions and analytics that fall outside the processing it covers; separate choices you make in Cookie settings or through an email unsubscribe route continue to apply. If we decline a request, we explain the reason and any available appeal route. Applicable US request and appeal deadlines govern those requests.
12. Children
The service is not directed at children under 16. If you believe that a child under 16 has supplied personal information, contact privacy@tonamorph.com so that we can investigate and take appropriate deletion or account action. The Terms of Service separately address age and authority to contract. An age statement alone is not a substitute for any legally required parental-authorisation procedure.
13. Cookies and local storage
Necessary authentication and preference technologies support the website. Optional analytics and marketing technologies operate in accordance with the choices described in the Cookie Policy. We use Vercel Web Analytics for website measurement; describing it as cookieless does not mean there is no personal-data processing.
For visitors identified as being in the United States, limited cookieless analytics may run before a banner choice where the applicable rules permit it; elsewhere, or where the applicable regime cannot be determined, analytics waits for your choice, and it stays off once you have declined it. Page addresses are recorded without query strings, and pages that exist only for a signed-in person are not counted. Newsletter subscription does not itself enable browser marketing tracking. You can change choices through Cookie settings in the website footer.
The plugin is not a browser but stores settings, authentication tokens and locally downloaded results on your device. Device storage and transmissions are described in the EULA; absence of browser cookies does not mean absence of data processing.
14. Security
We use measures designed to protect information proportionately to the risks, including encrypted network connections, access-controlled storage, restricted administrative access, credential hashing where appropriate, and controls intended to prevent unauthorised access and unnecessary logging of sensitive content.
Results may be delivered using time-limited signed URLs. Such a URL is a bearer access credential: someone who obtains it may be able to use it until it expires or access is revoked. It is not necessarily single-use. Do not publish or forward private result links to people who should not access the files.
Optional diagnostic reporting and operational logging must be configured to minimise personal information and avoid including audio, credentials or unnecessary attachments. No system is perfectly secure. Protect your devices and API keys, and keep copies of results you need. Local plugin tokens may be readable by someone with full access to your computer account.
Report a vulnerability to support@tonamorph.com. The Vulnerability Disclosure Policy describes the scope of authorised research and the handling of reports; it does not authorise access to other users' data or grant permission over suppliers' systems.
15. Personal-data incidents
We assess suspected incidents promptly and take steps to contain, investigate and remediate them. Where GDPR or UK GDPR notification rules apply, a reportable personal-data breach must be notified to the competent authority without undue delay and, where feasible, within 72 hours after awareness. Where required because of high risk, affected individuals must be informed without undue delay. Applicable Israeli and other notification duties and time limits are assessed separately.
A reported vulnerability is not automatically a personal-data breach; a report may nevertheless provide enough information to establish awareness of one. We do not wait for an ordinary support-response target or a completed forensic investigation where the law requires earlier notice. Notification obligations depend on the relevant incident, our role and applicable law.
16. Marketing and service communications
Marketing email requires the relevant opt-in. Every marketing message includes a withdrawal route; you may also write to privacy@tonamorph.com. We retain the minimum suppression information needed to respect your choice.
Necessary account, security, purchase and service notices are not optional marketing and may still be sent. A communication provider that delivers such notices on our behalf may receive the necessary account and message information even if you have not subscribed to marketing; this does not subscribe you to marketing or permit the provider to use that information for unrelated advertising. We do not use that distinction to add promotional tracking or unrelated advertising to essential messages, and we do not add promotional offers to messages designated as transactional. We do not use service-message information to build an unrelated advertising profile merely because it is held by the same provider. Consent to an email subscription, optional email-engagement measurement and website tracking must each cover the activity concerned; one is not automatically permission for all the others. Newsletter subscription, website tracking choices and statutory sale/sharing opt-outs are separate.
17. Changes to this notice
We update this notice when relevant practices change. For material changes, our normal notice period is at least 14 days by email or a prominent service notice, unless an earlier change is needed to comply with law or address a security issue. Changes requiring consent do not take effect for that processing merely because this notice was updated. The effective date identifies the applicable version; prior versions are retained for accountability.
18. Contact
Tonamorph
Privacy requests and complaints: privacy@tonamorph.com
Support: support@tonamorph.com
Security: support@tonamorph.com
Website: https://tonamorph.com
Operator details: section 1.1 above and Terms of Service, section 1.1