Privacy Policy

The operator of Compose Your Song is the controller of personal data processed through the service. For privacy questions or data-protection requests, contact [email protected].

We process the following categories of personal data, where applicable:

• account data you provide when you sign up or sign in, such as your email address, display name, and language;
• prompts, lyrics, song ideas, styles, moods, settings, and other generation inputs;
• generated songs, MP3 files, cover artwork, and other generated outputs;
• song titles, public or private visibility status, and public song-page information;
• credit balance and credit transaction history;
• subscription plan, subscription status, and premium-feature status;
• purchase, refund, chargeback, and transaction information received from our payment providers, Paddle and FastSpring;
• saved AI-generated vocal profiles;
• reports, moderation records, and content-removal decisions;
• support messages and account-recovery information; and
• technical logs, generation errors, timestamps, security events, IP address, browser, device, and website usage information where collected.

We collect a specific field only where it is actually processed by the service.

We obtain personal data directly from you, automatically through your use of the service and the website, from our payment providers in connection with purchases and subscriptions, and from service providers used to operate the service.

We use personal data to:

• create and deliver songs and related outputs;
• provide AI text assistance;
• maintain accounts, credit balances, subscriptions, and purchase history;
• operate public song pages and the public song library;
• provide private-song and premium features;
• process payments, refunds, and subscription events;
• handle support, deletion, and account-recovery requests;
• moderate content and enforce the Terms of Service;
• detect fraud, abuse, automated activity, and security incidents;
• maintain, diagnose, and improve the service; and
• comply with legal, tax, accounting, and dispute-resolution obligations.

Where the GDPR or similar legislation applies, we process personal data on the following legal bases:

• performance of a contract, where processing is necessary to provide the service, generate content, manage credits and subscriptions, and deliver purchased features;
• legitimate interests, including service security, fraud prevention, abuse prevention, technical diagnostics, moderation, and service improvement, where those interests are not overridden by your rights;
• compliance with legal obligations, including tax, accounting, consumer-protection, and regulatory requirements; and
• consent, where consent is specifically requested and required by law.

Where processing is based on consent, you may withdraw consent at any time without affecting processing that occurred before withdrawal.

Certain personal data is necessary to create and manage your account, generate songs, maintain your credit balance, process purchases and subscriptions, deliver generated content, and provide support. If you do not provide the required data, we may be unable to provide some or all parts of the service.

Providing data for optional features is voluntary. Where possible, the service will indicate whether requested information is required or optional.

AI and generation providers. Prompts, lyrics, song settings, and other necessary inputs may be shared with third-party AI providers to generate or assist with content. These providers currently include OpenAI and music-generation services accessed through Kie.ai, including Suno-related generation services. Providers may change as the service develops.

Third-party providers process data according to their own terms and privacy policies. We do not send account identifiers to AI providers unless technically necessary and disclosed in this Policy.

We do not use your prompts or generated audio to train our own models. We do not control, and make no representation about, whether third-party providers use submitted data to improve their models; any such use is governed by their applicable terms and settings.

Storage. Generated audio and cover artwork are stored on Backblaze B2 (S3-compatible object storage). Files are served via signed, time-limited URLs.

Payments. Paddle and FastSpring act as Merchants of Record for purchases. Each independently processes the payment-method, billing, tax, and buyer information required to complete purchases, manage subscriptions, prevent fraud, and comply with legal obligations, and each is an independent controller of that data under its own privacy policy.

We receive from the payment provider the buyer, transaction, subscription, refund, and payment-status information necessary to provide purchased features and manage your account. Compose Your Song does not receive full payment-card details.

We do not sell your personal data and do not share it with advertisers.

Songs generated without an active subscription may be public by default. Public content may include the song, audio files, cover artwork, title, lyrics, description, generation details selected for public display, creation date, and other information displayed on the public song page.

Public songs may appear in a searchable library and may be played, shared, and downloaded by other users where those features are available.

Information displayed publicly can be accessed and copied by other users. Making a song private or deleting it removes it from normal public access through Compose Your Song, but copies previously downloaded or shared by third parties may remain outside our control.

A username, display name, or other account identifier will be displayed publicly only where the service specifically informs the user that it will be displayed.

The website does not use advertising cookies. If we introduce analytics or other non-essential cookies, we will ask for your consent where required by law and update this Policy.

The checkout pages of our payment providers are operated by them and may use their own cookies and similar technologies, as described in their privacy policies.

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy.

Generated songs, MP3 files, cover artwork, prompts, lyrics, settings, visibility information, and related library records are intended to remain available: while an active subscription remains in effect; for users without an active subscription, for at least one year after the last song generation or other meaningful account activity; and after subscription cancellation, for at least one year after cancellation or the last meaningful account activity, whichever is later.

These are intended availability periods and not guarantees of permanent storage.

Account, credit, and subscription records may be retained while the account is active and for a reasonable period afterwards for support, security, fraud prevention, and dispute resolution. Technical and security logs are retained for a limited period appropriate to their purpose. Support and moderation records may be retained for as long as necessary to handle requests, enforce the Terms, and resolve disputes.

Payment, tax, accounting, refund, and chargeback records may be retained for the period required by applicable law and by our payment providers in their role as Merchants of Record.

Some information may remain temporarily in backups after deletion from active systems.

You may request deletion of your account, personal data, or generated content by contacting [email protected]. We may require reasonable information to verify your identity and connection to the relevant account.

After verification, we will delete or anonymise eligible information unless retention is necessary for legal obligations, tax or accounting requirements, fraud prevention, security, dispute resolution, chargebacks, enforcement of the Terms, or the establishment, exercise, or defence of legal claims.

Deletion from active systems may not immediately remove data from backups, caches, or systems operated independently by third parties such as Paddle or FastSpring.

Some service providers may process personal data outside Poland or the European Economic Area. Where required by applicable law, international transfers are protected through recognised legal mechanisms, such as adequacy decisions, Standard Contractual Clauses, or other appropriate safeguards.

You may contact [email protected] for more information about the safeguards applicable to relevant transfers.

Depending on your jurisdiction, and where applicable, you have the right to:

• access your personal data;
• correct inaccurate data;
• delete data;
• restrict processing;
• object to processing based on legitimate interests;
• data portability;
• withdraw consent;
• receive information about international-transfer safeguards; and
• lodge a complaint with a competent data-protection authority.

We may require verification of your identity before acting on a request. A request may be limited or refused where permitted by applicable law. For data held by Paddle or FastSpring as independent controllers, you may also exercise your rights directly with them.

We may use automated systems to analyse prompts, generated content, usage patterns, and technical events for content moderation, fraud prevention, abuse prevention, and service security.

These systems may block a request, restrict public content, or flag an account for review. Where appropriate, users may request review of a moderation decision by contacting [email protected].

Compose Your Song does not use solely automated processing to make decisions that produce legal or similarly significant effects on users, unless permitted by law and accompanied by appropriate safeguards.

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, restricted credentials, encrypted transmission, signed file URLs, logging, and service-provider security controls.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The service is not intended for children under 13 or under the minimum age of digital consent applicable in their country, if that age is higher. Users who have not reached the legal age of majority in their country may use the service only with the permission and supervision of a parent or legal guardian.

If we learn that personal data was collected from a child without the consent required by applicable law, we may delete the data and restrict access to the service.

Material changes to this policy will be announced on the website. The "Last updated" date at the top of this page reflects the latest revision.

This Privacy Policy may be provided in several languages. The English version is the controlling version. If there is a conflict between the English version and a translation, the English version prevails, without prejudice to mandatory legal requirements.