1. Who is responsible for your data
SongLux is responsible for the personal data processed through SongLux. The legal operator name, business address and privacy contact must also appear in the checkout receipt and customer-support information used for the public launch.
Privacy contact: support@songlux.app.
2. Information we process
- Account information, including your email address, display name, security settings and sign-in records.
- Creative information you submit, including prompts, lyrics, stories, names, relationships, occasions, preferences and instructions.
- Generated music information, including project records, track metadata, private audio files, artwork and selected share settings.
- Billing information such as credit purchases, amounts, currency, payment status, refunds and disputes. SongLux does not store full payment-card details.
- Operational and security information such as request identifiers, error records, rate-limit counters, webhook records and administrative audit events.
- Messages and support information you choose to provide.
3. Why we use it
- To create, store, play, download and privately share the songs you request.
- To operate accounts, authentication, credits, payments, refunds and customer support.
- To protect SongLux, prevent fraud and abuse, enforce usage limits and investigate service failures.
- To send transactional messages about account security, payments and generation outcomes.
- To meet legal, accounting and dispute-handling obligations.
- To improve reliability using aggregated operational measurements that do not publicly identify individual users.
Depending on the activity, processing is generally necessary to perform the SongLux contract, comply with legal duties, pursue legitimate interests in operating and protecting the service, or act on your consent where consent is specifically requested.
4. AI music processing
Your creative prompt, lyrics, style instructions and related generation parameters are sent to the configured music-generation provider so it can produce the requested result. Generated provider media is copied into private SongLux storage. Raw provider identifiers and source URLs are kept server-side and are not exposed through normal account access.
Do not submit information you are not authorised to use. Avoid including unnecessary sensitive personal information about yourself or another person.
5. Service providers
SongLux uses specialist processors to operate the service. These currently include Supabase for authentication, database and private storage; Kie.ai and its underlying music-generation services for AI music processing; Stripe for payments; Resend for transactional email; and Vercel for application hosting and delivery.
These providers may process data in countries outside the UK. Appropriate contractual and legal safeguards should be maintained where international-transfer rules require them.
6. Retention
Active account and project information is generally kept while your account remains open. You may archive projects without deleting them. When you permanently delete your account through Account settings, SongLux removes your authentication account, related application records and generated media stored under your private user folder.
Some limited billing, fraud-prevention, security, dispute or legal records may need to be retained for the period required by law or necessary to establish, exercise or defend legal claims. Backups and provider-side deletion may complete on their normal secure rotation schedules.
7. Your choices and rights
Depending on the circumstances, UK data-protection law may give you rights to be informed, access data, correct inaccurate data, request deletion or restriction, object to certain processing and receive portable data.
- Use Account → Data and privacy to download a machine-readable JSON copy of your SongLux account data.
- Use the same section to permanently delete your account and private generated media after password and, where enabled, authenticator verification.
- Update creative preferences and account security from the Account page.
- Contact the published privacy contact for requests that cannot be completed through the account controls.
8. Security
SongLux uses row-level database security, private object storage, short-lived media access, server-only provider credentials, webhook verification, rate limiting, audit records, encrypted transport and optional authenticator-based two-step verification. No internet service can guarantee absolute security, so use a unique password and protect access to your email and authenticator device.
9. Children
SongLux may be used by adults to create appropriate songs for children, but the service is not designed for children to open accounts or make purchases independently. A parent or guardian should supervise any use by a minor and should avoid placing unnecessary personal information about children in prompts or lyrics.
10. Changes
This notice may be updated when the service, providers or legal requirements change. Material changes should be communicated through the service or account email where appropriate.