Privacy Policy

1. Introduction & Scope

MuseHey (“we”, “us”, or “our”) operates a web-based service that helps users create songs and background music with AI-assisted generation. The data controller is the operator identified in the Platform’s current legal or contact information. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use the Platform.

This Policy applies to the MuseHey website, account area, music generator, generation history, payment flows, support interactions, and related services. It does not apply to independent services that have their own privacy policies.

By using the Services, you acknowledge this Policy. Where consent is required, we request it separately and do not treat continued browsing as consent. If you do not agree with processing necessary for a feature, that feature may not work.

“Personal information” means information that identifies, relates to, or could reasonably be linked with an individual, directly or indirectly.

2. Information We Collect

2.1 Account and profile information

• Email address, display name, authentication identifiers, language preference, and account status.
• Information you provide when contacting support or managing your profile.
• We receive limited information from the sign-in service when you choose an external sign-in option.

2.2 Creation and generated content

• Prompts, stories, lyrics, scenes, moods, genres, instrument choices, vocal preferences, and other Creation Inputs.
• Uploaded audio, images, text, or reference files, together with file name, type, size, duration, and processing status.
• Generated audio, lyrics, artwork, metadata, generation task identifiers, generation status, error details, selected settings, and download history. For regenerations, we also record the regeneration type, lyric source, edited lyrics, rights-confirmation status, confirmation time, and applicable notice version.

2.3 Transaction and usage information

• Credit balance, generation and Regeneration consumption, package selected, order identifier, amount, currency, refund status, and payment result.
• We use payment processors for card or wallet details and do not store complete payment-card numbers.
• Feature usage, request timestamps, approximate cost or service usage records, and account limits.

2.4 Device, log, and security information

• IP address, browser and device type, operating system, language, time zone, referring page, and basic diagnostic data.
• Access logs, session identifiers, cookies, security events, rate-limit events, and information used to detect fraud or abuse.

3. How We Use Your Information & Legal Bases

We use information only as reasonably necessary for the purposes below and rely on the legal bases available in the place where you use the Services.

• Provide and personalize account, generation, playback, download, history, Credits, payment, and support features (performance of a contract).
• Send Creation Inputs and required metadata to external service providers needed for a request, store files, monitor task status, and return Generated Output (performance of a contract).
• Secure the Platform, prevent fraud, investigate abuse, troubleshoot failures, and protect users (legitimate interests and legal obligations).
• Measure reliability, improve prompt guidance and interface design, and plan capacity using aggregated, de-identified, or appropriately limited information (legitimate interests or consent where required).
• Send service messages, billing notices, and important policy updates; optional marketing messages are sent only where permitted and can be stopped.

4. Cookies & Tracking Technologies

We use cookies, local storage, and similar technologies to keep you signed in, remember settings, protect forms, and understand basic service performance. If non-essential technologies require consent, we will ask for it before using them and explain how to change your choice.

4.1 Necessary technologies

These support authentication, language selection, security, account continuity, checkout, and core navigation. They cannot generally be disabled without breaking part of the Services.

4.2 Preference technologies

These remember choices such as locale, playback state, or interface preferences so you do not need to set them again.

4.3 Measurement technologies

If analytics are enabled and lawful, limited data may help us understand page errors, feature usage, and performance. We do not use it to sell a profile of your music preferences.

4.4 Your controls

You can manage cookies through your browser and, where offered, the Platform’s consent controls. Blocking necessary cookies may prevent login or checkout from working.

We may record a privacy preference so that the same choice is respected on later visits.

5. Information Sharing & Disclosure

We do not sell personal information as a standalone data product. We share information only for the business purposes described below, with appropriate contractual or technical safeguards where required. If a use of information is regulated as a sale or sharing under applicable law, we will provide the required notices and choices.

• The music-generation service used for your request receives the inputs and task metadata needed to generate the requested output.
• Payment processors receive order and payment details needed to authorize, settle, refund, or investigate a transaction.
• Cloud storage, hosting, authentication, monitoring, email, analytics, and customer-support services process information only to provide the relevant feature and in line with applicable terms.
• We may disclose information to comply with law, court process, lawful requests, or to protect rights, safety, and the integrity of the Platform.
• If we undergo a merger, financing, restructuring, or asset transfer, relevant records may transfer subject to confidentiality and applicable law.

6. Sign-in Options

If you choose a sign-in option provided by an external identity service, that service may confirm limited account information such as an identifier, email address, or display name. We use the information needed to create or connect your MuseHey account.

• We do not receive your sign-in password.
• The sign-in service may independently process information under its own privacy policy.
• You can usually disconnect the sign-in service through account settings or by contacting support, although you may need another sign-in method to keep access.

The sign-in options available to you are shown on the Platform.

7. Service Operations and Supporting Technologies

The Platform may use supporting software and infrastructure to operate reliably. The specific services can change as the product evolves.

7.1 Music generation

• Receive selected settings, prompts, uploads, and task identifiers needed to process a request.
• May return audio, lyrics, metadata, status, moderation results, or technical errors.

7.2 Storage and delivery

• Private uploads and generated files may be stored in object storage and delivered through time-limited signed links.
• Storage systems may record file identifiers, size, type, and access events.

7.3 Payment and account services

• Payment and authentication services process the information necessary for checkout, sign-in, fraud prevention, and account recovery.
• Those services may set their own cookies or retain records under their policies and legal duties.

7.4 Operations and support

• Hosting, logging, error monitoring, email, and support tools help us diagnose issues and answer requests.
• We limit access according to role and seek to limit use of your content to the feature requested and the agreements that apply.

The technical services and infrastructure used to run the Platform may process information in countries different from yours. Their availability and practices are outside our direct control, so review their policies where appropriate.

8. Automated Decision-Making & Profiling

MuseHey uses automated systems to transform your inputs into audio and to track task status, Credit consumption, reliability signals, and potential abuse.

• Generation is not a decision about your eligibility, identity, employment, credit, housing, or other legal or similarly significant matter.
• Automated safeguards may delay, reject, rate-limit, or require review of a request when signals indicate security, payment, or policy risk.
• You may contact support to ask for a review of an account restriction or suspected error, subject to reasonable verification.

We do not use your private prompts or generated files to make advertising inferences about sensitive traits.

9. International Data Transfers

Supporting services and infrastructure may be located in countries other than the country where you live. This means personal information and uploaded or generated files may be transferred internationally to operate the Services.

Where required, we use an appropriate transfer mechanism, contractual protection, consent, or another lawful basis. You may contact us through the Platform to ask about the safeguards applicable to a particular transfer.

No online transmission or storage method is completely risk-free, but we apply the security measures described in this Policy.

10. Data Retention

We retain information for the period needed for the purpose described in this Policy. The period depends on the type of information, the feature involved, account status, security and dispute needs, and legal or accounting duties; there is no single retention period for all data.

• Account and profile information is retained while the account is active and for a limited period after closure where needed for security, billing, or legal reasons.
• Creation Inputs, uploads, and Generated Output are retained according to the relevant feature information, account controls, and the purpose for which they are used.
• Payment, Credit, refund, and tax records may be retained for the period required by financial and legal obligations.
• Backups and security logs may persist for a limited additional period before secure deletion or anonymization. Limited audit records needed for rights confirmations, complaints, disputes, and security may also be retained for the necessary period after content deletion.

11. Data Security

We use reasonable administrative, technical, and organizational safeguards appropriate to the nature of the information and the risks of an online AI service.

11.1 Platform safeguards

• Access controls, role-based permissions, authentication protections, and monitoring for unusual activity.
• Encryption in transit where supported, private object storage, and time-limited signed access links for protected files.
• Rate limits, validation, malware checks, backups, and incident-response procedures.

11.2 Your safeguards

• Use a unique password, protect your sign-in codes, and sign out of shared devices.
• Avoid placing sensitive personal information in prompts or uploads unless necessary and authorized.
• Tell us promptly if you suspect unauthorized access or an exposed file link.

No security measure can eliminate every risk. We will respond to confirmed incidents according to applicable notification requirements.

12. Your Rights (GDPR)

If the GDPR or a similar law applies to you, you may have rights to access, correct, delete, restrict, or receive a portable copy of your personal information, and to object to or limit certain processing. You may also have the right to object to solely automated decisions that produce legal or similarly significant effects, where applicable.

• You can update available profile details and manage eligible generated content in your account.
• You may withdraw consent where processing relies on consent; this does not affect earlier lawful processing.
• You may object to direct marketing at any time and may object to legitimate-interest processing where your situation warrants.
• You may complain to a data-protection authority in the country where you live or work.

We may request verification and may retain information that we must keep for legal, security, or dispute purposes. Contact us through the Platform’s support or privacy channel to exercise a right.

13. California Residents' Rights (CCPA/CPRA)

California residents may have rights to know about personal information collected, access or delete it, correct inaccurate information, obtain a portable copy, and limit or opt out of certain uses where applicable, including sale or sharing if those activities occur.

• We collect account, creation, transaction, usage, device, log, and security information described in Section 2.
• We use these categories to provide, secure, improve, and support the Services, not to sell personal information as a data-broker product.
• We do not discriminate against you for exercising a privacy right, except where a difference is reasonably related to the information or service involved.

Requests

Use the support or privacy contact shown on the Platform. We may verify your identity, limit the number of requests allowed by law, and explain any information we must retain. We will handle a valid request within the period required by applicable law.

Authorized agents

An authorized agent may submit a request where California law permits, subject to proof of authority and identity verification.

This section does not create rights beyond those provided by applicable California law.

14. Summary of Processing Activities

For accountability, our processing records may describe the following activities:

• Account and authentication management: identifiers, profile details, login events, and security data.
• Music generation and file delivery: prompts, uploads, settings, task metadata, outputs, and access events.
• Billing and Credits: order identifiers, package, amount, currency, usage, refunds, and fraud signals.
• Service operations and support: diagnostics, communications, requests, and incident records.

Processing purposes, recipients, retention periods, and safeguards are described in this Policy and may be documented in internal records where required.

15. Children's Privacy

The Services are not directed to children who cannot lawfully consent to online processing. We do not knowingly collect personal information from such children without legally valid parental or guardian involvement.

If you believe a child has provided personal information without appropriate permission, contact us through the Platform so we can investigate and delete it where required.

16. Account Deletion & Data Removal

You may request account deletion through available account settings or the Platform’s support channel. We may need to verify the request before acting.

Deletion normally removes or de-identifies account data and eligible creation files, subject to product controls and technical processing time.

• We may retain payment, tax, fraud, security, backup, or dispute records for as long as required or reasonably necessary.
• If a file has been shared by another user or incorporated into a lawful record, deletion may not remove copies already held by that person.
• A deletion request does not cancel an open payment dispute or erase obligations that arose before closure.

We will explain any material limitation on deletion and will not retain information longer than needed for the stated exception.

17. Policy Updates

We may update this Policy when the Services, technical arrangements, legal requirements, or our information practices change. The current version will be posted with a revised date.

• For material changes, we will provide notice through a reasonable channel where required.
• Your continued use after the effective date indicates acceptance of the updated Policy to the extent permitted by law.
• If you do not agree, stop using the Services and contact us about account or deletion options.

18. Contact

For privacy questions, data-rights requests, security concerns, or complaints, please email [email protected]. To help us process your request, include your account email, request type, and the necessary details. Please do not submit personal information about another person unless it is relevant and you are authorized to provide it.

We may ask for reasonable verification before disclosing, correcting, or deleting personal information. If you are not satisfied with our response, you may have the right to contact your local data-protection or consumer-protection authority.

This Policy describes how MuseHey handles personal information at the time it is published. We may update this Policy when our Services, technology, or legal requirements change, and will publish the revised version with a new effective date.