KeepYourSong

Privacy Policy

What we collect, why, who we share it with and how to exercise your rights.

Last updated 2026-10-28

1. Overview

This policy explains how KeepYourSong ("we") processes personal data when you use KeepYourSong. We are the data controller for this processing. We keep data collection to what the Service needs and do not sell personal data.

2. What we collect

  • Account data: email address, display name, hashed password, email-verification status, two-factor settings and sign-in timestamps.
  • Content you submit: song descriptions, lyrics, titles, style tags, and audio you upload for features such as stem separation.
  • Generated material: songs, versions, stems and edits stored in your library, plus job metadata (model used, duration, cost, errors).
  • Billing data: PayPal order and subscription identifiers, plan, amounts and dates. We never see or store your card number.
  • Technical data: IP address, browser and device type, approximate country, and security logs such as rate-limit and bot-protection results.
  • Support conversations: messages you send us through the chat widget or by email.

3. Why we process it (legal bases)

  • To provide the Service you asked for (contract): accounts, generation, library, downloads, billing and support.
  • To keep the Service secure and prevent abuse (legitimate interests): rate limiting, bot detection, fraud and chargeback prevention, content safety checks.
  • To improve the product (legitimate interests): aggregated, privacy-preserving analytics.
  • To comply with legal obligations: tax and accounting records, responding to lawful requests, copyright notices.
  • With your consent, where we ask for it: for example optional marketing emails.

4. Who we share data with

We share personal data only with processors that help us run the Service, under contracts that restrict their use of it:

  • AI model providers (currently Google Cloud Vertex AI, with Replicate or fal.ai for stem separation): receive your descriptions, lyrics and audio in order to generate or process songs. Providers may be located in the United States.
  • Hosting and storage providers (for example Vercel, our database provider and Cloudflare R2) for the website, database and audio files.
  • PayPal for payments; Cloudflare Turnstile for bot protection; Resend for transactional email.
  • Umami for analytics. Umami is cookie-free and does not build cross-site profiles; we see page views, referrers, country and the product events listed in our documentation, never your name or email.
  • Tawk.to for the support chat. When you chat with us, Tawk.to processes your messages and, if you are signed in, your email and display name.

We may also disclose data where required by law, to protect our rights or users' safety, or as part of a merger or acquisition (with notice to you).

5. International transfers

We are based in Hong Kong and use providers in the United States and the European Union. Where data leaves your region we rely on the provider's standard contractual clauses or equivalent safeguards.

6. How long we keep data

  • Account and library data: for as long as your account exists, and up to 30 days after deletion for backups.
  • Billing records: 7 years, as required for tax and accounting.
  • Security and server logs: up to 90 days.
  • Prompts sent to AI providers: handled under the provider's retention policy; Google Cloud does not use customer prompts to train its models.

7. Cookies

We use only strictly necessary cookies: a session cookie to keep you signed in and a short-lived cookie for bot protection. Our analytics (Umami) does not set cookies. Because we do not use advertising or tracking cookies, we do not show a cookie banner.

8. Your rights

Depending on where you live (including the EU/UK GDPR, the California CCPA/CPRA and the Hong Kong PDPO) you may have the right to access, correct, delete or export your personal data, to restrict or object to processing, and to withdraw consent. You can download your songs at any time from your library and request account deletion or a data export by emailing us. We respond within 30 days. You may also complain to your local data protection authority.

9. Children

KeepYourSong is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

10. Changes and contact

We will notify you of material changes by email or on the website. Questions and requests: KeepYourSong · support@example.com