← Back to Home

Privacy Policy

Last modified: 10.16.2026 · Effective date: 10.16.2026

Previous versions of this Privacy Policy remain available in our archive: version of 08.27.2026, version of 07.24.2026, version of 07.11.2025.

1. INTRODUCTION

SONG SYNTH LTD ("we," "us," or "our") takes your privacy seriously. This Privacy Policy explains what personal information we process, why, and what choices you have, when you use the "Song AI Maker: Generate Music" application for mobile devices — its iOS version distributed through the Apple App Store and its Android version distributed through Google Play (the "App") — and when you use our website at https://songsynth.com and our web application at https://app.songsynth.com (together with the App, the "Services"). References to the "App" in this Privacy Policy apply equally to the other forms of the Services unless the context requires otherwise.

Company Information:

  • Company name: SONG SYNTH LTD
  • Company number: 16821020 (registered in England and Wales)
  • Registered office address: 86-90 Paul Street, London, Greater London, England, EC2A 4NE
  • Company type: Private limited company
  • Contact for privacy and data protection matters: support@songsynth.com (please include "Privacy" in the subject). We have not appointed a data protection officer; privacy requests are handled by our team at this address.

We are the "controller" of your personal information under the UK General Data Protection Regulation and the Data Protection Act 2018 ("UK GDPR") and, where it applies to you, the EU General Data Protection Regulation ("EU GDPR"), unless otherwise stated. We are registered with the UK Information Commissioner's Office (ICO) as a data controller, registration number ZC161480.

In short:

  • You can use the App without an account login. We then know you only by a random identifier.
  • If you choose to sign in with Apple or Google, we receive the email address and name that provider shares with us.
  • What you type into the App (prompts, lyrics, Studio chat messages) is sent to AI providers to generate your songs.
  • We do not sell your personal information.
  • You can delete your account from inside the App (Settings → Account → Delete account) at any time.

2. US STATE PRIVACY RIGHTS (INCLUDING CALIFORNIA)

If you are a resident of California or of another US state with a consumer privacy law (for example Virginia, Colorado, Connecticut, Utah, Texas, Oregon), you may have the following rights, in addition to those set forth elsewhere in this Privacy Policy, to the extent those laws apply to us:

a) to know the categories of personal information we collect, the categories of sources, the purposes of processing, and the categories of third parties with whom we share it (all described in Sections 3–5);

b) to access the specific pieces of personal information we hold about you;

c) to correct inaccurate personal information;

d) to delete your personal information (you can do this yourself in the App — see Section 8);

e) to opt out of the "sale" of personal information, "sharing" for cross-context behavioral advertising, and targeted advertising;

f) not to be discriminated against for exercising these rights.

Sale and sharing. We do not sell your personal information for money. Some of our advertising and attribution integrations (see Section 5) may constitute "sharing" for cross-context behavioral advertising or "targeted advertising" under these laws. You can opt out using the mechanisms in Section 9, or by emailing us with the subject "Do Not Sell or Share".

Sensitive personal information. We do not intentionally collect sensitive personal information. Please do not include it in your prompts or lyrics (see Section 3).

How to submit a request. Contact us at support@songsynth.com or via https://songsynth.com/support and include the phrase "Privacy rights request". We will need to verify that the request comes from the account holder — for example, by asking you to send the request from the email address of your Apple or Google sign-in, or to provide your account identifier shown in the App's Settings. An authorized agent may submit a request on your behalf with your written permission. We aim to respond within forty-five (45) days; if we need more time, we will tell you why. If we decline a request, we will explain why, and where your state law provides for it you may appeal by replying to our decision.

Some information we hold (for example, technical data linked only to a random identifier) cannot reliably be matched to you. In that case we may not be able to include it in a response.

3. INFORMATION WE COLLECT AND PROCESS

Account Information.

  • Anonymous account. When you first open the App, we create an account linked to a randomly generated identifier. No name or email address is needed. On iOS the identifier is also stored in your iCloud so that your songs come back after a reinstall or on another device with the same Apple ID; on Android it may be backed up through Google's backup services.
  • Signing in (optional). You may sign in with Apple or Google (we use Google Firebase Authentication for this). We then receive a provider account identifier and, if the provider shares them, your email address and name. With Sign in with Apple you can choose "Hide My Email", in which case we receive an Apple relay address. We never receive or store your Apple or Google password. We use this information to keep one library across your devices and the web, to let a subscription bought on our website work in the App, to restore access to your account, and to identify your account when you contact support. On our website, signing in with Apple or Google is the only way to have an account.
  • Signing out. When you sign out, the device returns to its own anonymous account (or a new empty one). Your signed-in account and its songs stay on our servers and reappear when you sign in again.

Content Information. The prompts, song descriptions, lyrics, style choices, messages you exchange with the in-app lyrics assistant ("Studio" chat), and other text or materials you submit (your "Submissions"), and the songs, lyrics, and artwork generated from them ("Output"). Submissions are sent to the AI service providers listed in Section 5 to generate the content you request. Please do not include personal information about yourself or others, or any sensitive data, in your Submissions.

Certificate of Authorship Information. If you request a Certificate of Authorship, we collect the name and email address you enter. We do not verify them. We print them in the certificate PDF and store them with your account to pre-fill future requests. This is separate from the email address received through Apple or Google sign-in. We do not use the certificate email for marketing; if we ever do, we will first update this Privacy Policy and ask for any consent required by law.

Support Correspondence. Your email address, name, and the content of your message when you contact us. We provide email support with AI-assisted triage: an AI service (Google Gemini) may categorize your message and draft a reply, which a member of our team reviews. Our internal notification tools alert the team to new messages (the alert may include the content of your message) so that someone can pick them up.

Purchase Information.

  • App Store and Google Play. Payment is handled by Apple or Google. We never see your card details. Through our subscription-management provider (Apphud) we receive the product purchased, price, currency, country, purchase and renewal dates, and the subscription status.
  • Website (Stripe). Subscriptions bought on our website are processed by Stripe. We never receive your full card number. We create a Stripe customer record linked to your account and receive your email address, billing name and billing address (used, together with your IP address, to calculate sales tax), the last four digits and brand of your card, and the subscription and payment status. Stripe also processes your data as an independent controller for its own fraud-prevention and legal compliance purposes, under its own privacy policy.

Device, Usage, and Diagnostic Information (processed automatically).

  • Device details: model, operating system and version, language, time zone, app version, and device identifiers, including — if you allow tracking on iOS, or on Android unless you have deleted it — the advertising identifier (IDFA/GAID).
  • Connection details: IP address (from which an approximate country, region, or city may be derived), timestamps, network type.
  • In-app activity: screens visited, buttons tapped, songs generated, paywall views, purchases, and similar events, recorded by our analytics tools (Amplitude, Firebase Analytics) under your account identifier.
  • Attribution data: which ad or campaign led to your install or purchase (Adjust, Apple Ads, Google Ads, Meta, TikTok).
  • Diagnostics: crash reports, error reports, and performance traces (Sentry, Firebase Crashlytics). We configure these tools not to collect names or email addresses; they identify you only by your internal account identifier.
  • Push notification token, if you allow notifications (Firebase Cloud Messaging).
  • We do not collect your precise (GPS) location.

Cookies on our website. See Section 14.

3A. AI PROCESSING, CONTENT MODERATION, AND MODEL TRAINING

AI processing. The App generates lyrics, music, and artwork with artificial intelligence. Your Submissions (and, for the Studio chat, the conversation so far) are sent to the AI providers listed in Section 5 for this purpose. Output is generated by AI, and you should treat it as AI-generated content.

Automated review of content. To keep the Services safe and to understand how our features are used, we and our AI providers automatically analyze Submissions and Studio conversations — for example, to detect content that violates our Terms of Use (such as hate speech, harassment of real people, or sexual content involving minors), and to classify the topic or occasion of a song in aggregate. AI providers may also refuse to generate certain content under their own safety rules. Our team may review flagged content.

Model training. We do not use your Submissions, Studio conversations, or Output to train AI models, and we do not run our own model training. If this ever changes, we will update this Privacy Policy and our Terms of Use before we start and, where the law requires it, ask for your consent; you will be able to object. Our AI providers process your content under their business (API) terms. As of 16 October 2026, those terms say the following about training:

  • OpenAI (API): data sent to the OpenAI API is not used to train or improve OpenAI models unless the customer opts in (we have not). OpenAI may keep API data for up to 30 days for abuse monitoring.
  • Google (Gemini API, paid services): Google does not use prompts or responses to improve its products; it logs them for a limited period for abuse detection and legal purposes.
  • Mureka (API): Mureka uses customer content only to provide its service, comply with the law, and enforce its policies, and states that it will not use customer content to develop or improve its services.
  • Replicate and fal.ai (cover artwork): they process the text prompt for your cover to provide their service; their terms allow them to use aggregated or anonymised usage data to improve their services.

Providers' terms can change; we review them when we update this Privacy Policy.

4. THE PURPOSES OF PROCESSING AND OUR LEGAL BASES

Purpose Data used Legal basis (UK/EU GDPR)
Provide the Services: create your account, generate and store songs, Studio chat, sync between devices and the web Account, Content, Device Performance of our contract with you
Sign in with Apple or Google, restore access to your account Account (provider identifier, email, name) Performance of contract
Process subscriptions, check whether you have access, calculate taxes, keep accounting records Purchase, Account Performance of contract; legal obligation (tax and accounting)
Generate a Certificate of Authorship Certificate information Performance of contract
Answer support requests Support correspondence, Account Performance of contract; legitimate interests (helping you efficiently)
Keep the Services safe: content moderation, preventing fraud, abuse of free tiers, and illegal content (see Section 3A) Content, Account, Device Legitimate interests (safety, legal compliance)
Improve the Services: analytics, error monitoring, product research based on how features are used Device, usage, Content Legitimate interests (improving our product) — you can object, see Section 8
Measure and personalize advertising, attribute installs and purchases Device identifiers, attribution data Consent (iOS App Tracking Transparency prompt; cookie choices where required); legitimate interests where consent is not required by law
Send push notifications (for example, that your song is ready, or reminders about unfinished songs) Push token Consent (you can turn notifications off in your device settings)
Comply with law, respond to lawful requests, establish or defend legal claims Any relevant data Legal obligation; legitimate interests

We do not use your information to make decisions about you that produce legal or similarly significant effects based solely on automated processing.

5. HOW WE MAY SHARE YOUR INFORMATION

We will not rent or sell your personal data. We share personal information only as described below.

Shared links. When you share a song, we create a link (on songsynth.com) through which anyone who has the link can listen to the song and see its title, cover, and lyrics. The link stays active until you delete the song. Please share links only with people you want to hear the song.

Service providers. We use the following providers to run the Services. Where they act as our processors, they process data on our instructions under data processing terms; some (such as Apple, Google, Stripe, Meta, and TikTok) also act as independent controllers for their own purposes.

AI generation

  • Google Gemini API (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) — generating lyrics and text, understanding requests, Studio chat, content analysis, and AI-assisted triage of support emails. Google Privacy Policy, Google Cloud Terms;
  • OpenAI (OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA) — generating text and lyrics. Privacy Policy;
  • Mureka (SKYWORK AI PTE. LTD., 2 Science Park Drive, #01-08, Ascent, Singapore 118222) — generating music and audio. Privacy Policy, API Service Agreement;
  • fal.ai (Features & Labels, Inc., 2261 Market St. Suite 10467, San Francisco, CA 94114, USA) — generating cover artwork from text derived from your song (such as title and tags). Privacy Policy;
  • Replicate (Replicate, Inc., 548 Market St, PMB 77593, San Francisco, CA 94104, USA) — generating cover artwork. Privacy Policy.

We may add, remove, or replace AI providers, and we may generate some content with models running on our own or rented infrastructure (including open-source models). Where content is generated on such infrastructure, your Submissions for that feature are not shared with a third-party AI provider. We will update this list when third-party providers change.

Infrastructure and operations

  • Microsoft Azure (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA) — hosting of our servers, database, and file storage (songs, artwork, certificate PDFs; certificate PDFs are kept in private storage accessible only via time-limited links). Data is stored in data centers in the United States. Microsoft Privacy Statement;
  • Google Firebase (Google LLC) — sign-in (Firebase Authentication), app analytics (Firebase Analytics), crash reporting (Crashlytics), push notifications (Cloud Messaging), and remote configuration. Firebase Privacy;
  • Sentry (Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA) — error and crash monitoring for the App, website, and our servers. Privacy Policy;
  • Internal notification and collaboration tools — used by our team to receive alerts about new support requests (which may include the content of the request) and service incidents.
  • Apple (Sign in with Apple, iCloud for restoring your anonymous account) and Google (Google Sign-In) — identity providers you choose to use.

Payments and subscriptions

  • Apple App Store and Google Play Billing — payments for purchases made in the App;
  • Apphud (Apphud Inc., 1111B S Governors Ave STE 82558, Dover, DE 19904, USA) — subscription management for store and web purchases. Privacy Policy;
  • Stripe (Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA, and Stripe Payments Europe, Ltd.) — payments and sales-tax calculation for website purchases. Privacy Policy.

Analytics, attribution, and advertising

  • Amplitude (Amplitude, Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA) — product analytics in the App and on our websites. Privacy Policy;
  • Adjust (Adjust GmbH, Saarbrücker Str. 37a, 10405 Berlin, Germany) — install and purchase attribution, including on-device conversion measurement for Google Ads. Privacy Policy;
  • Meta (Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA; Meta Platforms Ireland Ltd.) — the Facebook SDK in the iOS App, used to measure ad campaigns. Privacy Policy;
  • Google Ads (Google LLC) — advertising and conversion measurement. Google Privacy Policy;
  • Apple Ads — attribution of installs from Apple Search Ads campaigns;
  • TikTok (TikTok Pte. Ltd., 1 Raffles Quay, #26-10, South Tower, Singapore 048583) — the TikTok sharing SDK, which lets you share a song to TikTok,. Privacy Policy.

Other disclosures. We may disclose personal information (a) where required by law or by a legally binding order (see Section 6); (b) as a narrow exception, where we believe in good faith that disclosure is necessary to prevent an imminent threat to a person's life or physical safety; (c) to a buyer or successor if our business is sold or reorganized, subject to this Privacy Policy. For any other request from a third party seeking to identify a user or obtain user data (for example, in connection with an alleged defamation, infringement, or fraud), Section 6 applies — we do not disclose user data voluntarily in response to informal requests.

International transfers. We are based in the United Kingdom, and most of our providers process data in the United States (and some in Singapore or the EU). Where personal data of UK or EU users is transferred to a country without an adequacy decision, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, the UK–US Data Bridge or EU–US Data Privacy Framework where the recipient is certified, or other lawful mechanisms. You can ask us for a copy of the relevant safeguards.

We are not responsible for the privacy practices of third-party websites or services that you open from the App, or of third parties processing data they collect by their own means outside our Services.

6. LEGAL DISCLOSURE AND LEGAL HOLD

We do not voluntarily disclose a user's identity or technical account data (including email address, IP address, device identifiers, or attribution identifiers) in response to informal requests from third parties. Where we receive such a request — including from a party alleging defamation or infringement of their rights — we will only disclose such information pursuant to a legally binding process recognized under the laws of England and Wales (such as a Norwich Pharmacal order or equivalent court order) or where otherwise required by applicable law. As a narrow exception, we may disclose information where we believe in good faith that disclosure is necessary to prevent an imminent threat to a person's life or physical safety.

Pending such process, we may preserve relevant data and content under legal hold rather than delete it, without disclosing it to the requesting party. Data preserved under legal hold is kept in secure storage, is not publicly accessible, and is retained only for as long as reasonably necessary in connection with the actual or reasonably anticipated legal claim.

Please note that for users who have not signed in, we may hold only limited identifying information: such accounts are linked to a randomly generated identifier, and a name or email address is held only if you have provided one (for example, through support correspondence or the Certificate of Authorship feature). For users who have signed in with Apple or Google, we hold the email address and name shared by that provider.

7. HOW LONG WE KEEP YOUR PERSONAL DATA

  • Account data and content (account identifier, sign-in details, songs, drafts, Studio chats, certificate details) are kept for as long as your account exists, unless you delete individual items earlier.
  • Songs you delete. A deleted song is removed from your library immediately and is no longer accessible through the Services, including via shared links. Its audio file and cover image are permanently erased from our storage within ninety (90) days. The song's text data (prompt, lyrics, title) remains with your account until the account is deleted.
  • When you delete your account (see Section 8):
    • immediately: your sign-in email and name, your Apple/Google sign-in link (we also revoke the Sign in with Apple token), IP addresses, push tokens, and advertising identifiers held by us, the link to your Stripe customer record, and your certificate contact details are deleted;
    • within ninety (90) days: your songs' audio files, cover images, and certificate PDFs are permanently erased from our storage;
    • retained de-linked from your identity: your lyrics, drafts, Studio chats, and prompts are retained de-linked from your identity after account deletion (they are no longer connected to your email address, name, or sign-in, only to a random internal identifier); we may purge them periodically;
    • kept in de-identified form: records that a song was generated (without its text), credit and cost records, and records of web purchases needed for tax and accounting purposes (generally six (6) years, as required by UK law). These records are no longer linked to your email address or name.
    • Data already sent to our analytics, attribution, and subscription providers (Amplitude, Adjust, Apphud, Sentry, Firebase) is linked only to your account identifier and is kept by them under their own retention periods. Purchase records kept by Apple, Google, and Stripe are governed by their policies.
  • Technical and diagnostic logs (including IP addresses in our infrastructure logs and error reports) are generally kept for no longer than ninety (90) days, and in any case no longer than twelve (12) months.
  • Support correspondence is kept for as long as needed to handle your request and for a reasonable period afterwards.
  • Data under legal hold (see Section 6) is kept for as long as reasonably necessary in connection with an actual or reasonably anticipated legal claim, even if it would otherwise have been deleted.

Backup copies may persist for a limited time after deletion before they are overwritten in the ordinary course.

8. YOUR RIGHTS AND HOW TO DELETE YOUR ACCOUNT

Delete your account. You can delete your account at any time, whether or not you have signed in:

  • In the App (iOS and Android): Settings → Account → Delete account. If you are signed in, you will be asked to confirm with Apple or Google.
  • On the website, or if you no longer have the App: email support@songsynth.com from the address of your Apple or Google sign-in, or include the account identifier shown in the App's Settings, and ask us to delete your account. We will confirm when it is done.

Deleting your account cannot be undone. Signing in again later with the same Apple or Google account creates a new, empty account. Deleting your account does not cancel a subscription purchased through the App Store or Google Play — cancel it in your Apple or Google account settings (see our Subscription & Refund Policy). A subscription purchased on our website is set to cancel at the end of the current billing period when you delete your account.

Your other rights. Depending on where you live, you have the right to:

  • access your personal information and receive a copy of it (portability);
  • correct inaccurate information;
  • erase your information;
  • restrict processing in certain circumstances;
  • object to processing based on our legitimate interests (for example, analytics and product research), and to object at any time to direct marketing;
  • withdraw consent at any time where we rely on consent (this does not affect processing before withdrawal).

To exercise these rights, contact support@songsynth.com (our contact for data protection matters, see Section 1) or visit https://songsynth.com/support. We will respond within one month (this can be extended by two further months for complex requests; we will tell you if so). We may need to verify your identity first. For data held by third parties as independent controllers (for example Apple, Google, Meta, Stripe), please also contact them directly.

Right to complain. If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the UK Information Commissioner's Office (ICO), https://ico.org.uk, 0303 123 1113, or to the data protection authority in the EU country where you live.

9. HOW TO OPT OUT

Tracking and personalized ads.

  1. On iOS: choose "Ask App Not to Track" when prompted, or turn tracking off in Settings > Privacy & Security > Tracking. More: Apple Support.
  2. On Android: open Settings > Google > Ads (or Settings > Privacy > Ads) and delete your advertising ID or opt out of ads personalization. More: Google Support.
  3. On our websites: see Section 14.
  4. You can also visit YourAdChoices.

When you opt out of interest-based advertising, you may still see contextual ads.

Analytics. To object to analytics processing linked to your account, contact us at support@songsynth.com.

Push notifications. Turn notifications off for the App in your device settings.

10. HOW WE PROTECT PERSONAL INFORMATION

We use industry-standard measures to protect personal information, including encryption in transit (HTTPS/TLS), encryption at rest provided by our cloud provider, access controls that limit our staff's access to what they need, and private storage with time-limited links for documents such as certificates. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you have questions about security, contact us.

11. CHILDREN'S PRIVACY

The Services are intended for users aged 13 and over. By using the Services, users confirm that they meet this age requirement; we do not verify age. Users aged 13 to 17 may use the Services only with the consent of a parent or legal guardian (see Section 3 of our Terms of Use).

We do not knowingly provide the Services to, or collect personal information from, children under 13 (or under the age of digital consent in their country — 13 in the UK, up to 16 in some EU countries). If we learn that we have collected personal information from such a child, we will delete it and close the account. If you are a parent or guardian and believe your child has used the Services, please contact us at support@songsynth.com.

12. UPDATES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes in our practices and Services. We will change the "Last modified" date at the top and keep previous versions in the archive linked above. If we make a material change — for example, collecting a new category of personal information or using it for a new purpose — we will also notify you in the App or by email where we have your address, before the change takes effect.

13. HOW TO CONTACT US

For any question about this Privacy Policy, contact us at support@songsynth.com, via https://songsynth.com/support, or by post at SONG SYNTH LTD, 86-90 Paul Street, London, EC2A 4NE, United Kingdom.

If you wish to notify us that content within the Services is defamatory, infringes your privacy, or is otherwise illegal, please use the same address and include the information described in our Terms of Use (Section 16, "Notice of Complaints and Content Removal"). We aim to acknowledge such notices within five (5) business days.

14. COOKIES ON OUR WEBSITES

Our websites (songsynth.com and app.songsynth.com) use:

  • Strictly necessary cookies — to keep you signed in (session cookie), remember your device and onboarding state, and enable secure payments (Stripe sets cookies for fraud prevention). These do not require consent.
  • Analytics — Amplitude, to understand how visitors use our websites, linked to a random device identifier or your account identifier.

Advertising click identifiers. When you arrive at our website from an ad, the link may carry a click identifier (for example Google's gclid or Meta's fbclid). We record it on our servers together with the time of your visit and, if you later create an account or buy a subscription, associate it with that purchase so we can report the sale to the advertising network and measure our advertising. This does not use cookies, and the networks receive only the click identifier, the fact and value of the purchase, and no song content. We do not currently use advertising pixels on our websites. Before we do, we will update this section and, for visitors in the UK and EU, ask for consent first. You can block or delete cookies in your browser settings; blocking strictly necessary cookies will prevent sign-in and purchases.