Privacy Policy

1. Who we are and what this policy covers

YourSongs (“YourSongs,” “we,” “us,” or “our”) makes custom, AI-assisted songs as keepsakes. This policy explains what personal information we collect, why, who we share it with, how long we keep it, and the rights you have — including under the California Consumer Privacy Act as amended by the CPRA, and under the EU and UK General Data Protection Regulation.

It applies to yoursongs.ai, the YourSongs applications, and the YourSongs API. It does not cover a third party’s own handling of your information — including a partner who introduced you to us, whose own privacy policy governs its relationship with you.

For the purposes of the GDPR, YourSongs is the controller of the personal information described here. Where we provide the Service to a business partner and that partner determines what happens to its end users’ information, we act as a processor on that partner’s behalf and under our agreement with it.

Our Terms of Use govern your use of the Service.

2. Notice at collection — the short version

The table below summarizes the categories of personal information we collect, why, and how long we keep them. The sections that follow give the detail.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use it to train our own generative models, and we require the AI providers we use not to train on it.

3. What we collect

Information you give us

• Account details — your email address, your password (stored only as a cryptographic hash, never in readable form), and optionally your display name, avatar, and time zone.
• Your mobile number, if you choose to add one, along with your opt-in to receive text messages. See Text messaging.
• What you tell us while writing a song — the person or occasion, the details and memories you share, names and how they should be pronounced, and any instructions or revisions you ask for. This is the heart of the product, and some of it will be personal information about someone other than you. See Information about other people.
• Payment details — handled by our payment processor. We receive a confirmation, the amount, and a token identifying the method; we do not receive or store your full card number.
• Support messages — what you send us by email, or from inside the app once you are signed in, including the page you were on and the app version, which we capture to help diagnose the problem.

Information we collect automatically

• Session and security data— your IP address, browser and device type, sign-in times, and the devices with active sessions (shown to you on your account’s Devices page).
• Usage data — which pages and features you used, and error diagnostics when something breaks.
• Essential cookies — see Cookies.

If you opened a share link and have no account

You can play a shared song without signing up, and we keep that light on purpose. When you open a share link we record that the link was opened and when, so the person who shared it can see their song was heard. To tell one listener from another without knowing who you are, we store a one-way fingerprint derived from your IP address and browser — a value we cannot reverse into either. We do not store the IP address itself against a share, we do not build a profile from it, and it is not used for advertising.

• A like records only that a listener liked the song, against that same fingerprint, so you can take it back.
• A commentrecords the name you type and what you write, and both are shown to the song’s creator and to anyone else holding a live link. Put in a display name, not your full identity, if you would rather not be identifiable.
• If you go on to create an account from a share link, we record which link brought you, so the person who shared it can be credited. That connects your new account to theirs.

Information from others

• From a partner, where a partner such as an event planner brings you to us: the details needed to set up your song.
• From the person who bought you a gift: your email address, and whatever they told us about you for the song.
• From our providers: delivery and security signals — for example, whether a text or email was delivered, or whether a password has appeared in a known breach corpus (checked without ever sending us or anyone else your password).

We do not collect sensitive personal information as a matter of course. If something you write in a song conversation happens to reveal sensitive details — a health condition, a religious belief, an ethnic origin — we use it only to write your song and keep it for you. We do not use it to infer characteristics about you, and we ask you not to share sensitive details you would not want us to hold.

4. How we use it, and our legal basis

We use personal information for the purposes below. The third column gives our legal basis under the GDPR, for people it applies to.

Where we rely on legitimate interests, we have considered your interests and rights and concluded ours do not override them; you can ask us for that assessment, and you can object — see Your rights in the EEA, UK, and Switzerland.

5. How AI processing works

Making your song means sending what you wrote to AI providers. Two kinds are involved: a conversational model that runs the intake and drafts the song package, and a music-generation system that produces the audio.

What we require of them:

• they process your content only to produce your song, on our instructions, under a written agreement;
• they do not use your content to train or improve their models; and
• they retain it no longer than needed to return the result and meet their own abuse-monitoring obligations.

We use Anthropic’s Claude models for the song conversation. We record which system produced each version of your song, so we can tell you what handled your content and what terms applied to it.

We do not use your content to train models of our own. No decision that has a legal effect on you, or that significantly affects you, is made by automated means — see Automated decisions.

6. Information about other people

A song is usually about someone else. When you tell us about that person, you are sharing their personal information with us, and we process it to write the song you asked for.

Please share only what the song needs, and only what you are comfortable sharing on that person’s behalf. Our Terms of Use set out when you must have that person’s permission — the bar rises with exposure, and a public streaming release requires you to confirm you have the right to feature a named private individual.

If you are the subject of a song and want to know what we hold, have it corrected, or have it deleted, write to privacy@yoursongs.ai. We will help, even though you may not have an account with us. Because the song is also the creator’s content, we will balance both interests and tell you what we did.

7. Text messaging

Text messaging is optional and off until you turn it on. To turn it on you add your mobile number and check a box agreeing to receive account and security messages — an affirmative opt-in, separate from creating your account. We then text a code to confirm the number is yours.

We use your number to send transactional messages only: verification and sign-in codes, and account or security notices you have opted into. We do not send marketing texts, and we do not share your number with anyone for their own marketing.

Messages are delivered by Twilio, acting as our processor. Message frequency may vary; message and data rates may apply. Reply STOP to opt out or HELP for help, or manage the number on your account page.

We keep a record of each opt-in and opt-out — the number, the exact wording you agreed to and its version, the date and time, your IP address and browser, and where the consent was given. We keep these for four years, because telecommunications rules require us to be able to show we had your permission. That record survives your removing the number, and it is kept for that purpose alone.

8. Cookies and similar technologies

We currently set only essential cookies — the ones that keep you signed in and protect the sign-in process. They are necessary for the Service to work, so they are not subject to consent, and you cannot turn them off while using the Service.

We also store a small amount of information in your browser’s local storage — your theme choice, your cookie preference, and the position you dragged the feedback button to. This is not used to track you.

We do not currently use analytics, advertising, or social-media tracking. The consent banner you see is the mechanism that will govern those if we ever add them: nothing non-essential will be set unless you accept it. We honour the Global Privacy Control signal — if your browser sends it, we treat that as a standing refusal of non-essential cookies and do not show the banner.

9. Who we share it with

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose it only as follows.

Service providers, who process it on our instructions under written contracts that restrict them to our purposes:

• cloud hosting, storage, and content delivery;
• AI providers who draft your song and generate its audio — including Anthropic for the song conversation (see How AI processing works);
• Twilio, for text messages;
• email delivery;
• payment processing;
• error monitoring and security tooling; and
• a music distributor, only if you ask us to release a song.

Partners. If a partner brought you to us, we share with that partner what it needs to serve you. A partner never gets access to another partner’s customers, and our staff do not reach into a partner’s end-user data as a matter of course — deeper access happens only for a specific issue, with the partner’s permission, time-boxed and logged.

People you share with. If you share or release a song, whatever it contains goes with it. That is your choice, and we cannot recall it once it has been heard or downloaded. A share link is unguessable and you can switch it off at any time, which stops new plays — but anyone you allowed to pass it on may already have done so, and a downloaded file is gone from your control.

What a listener sees. A share page shows what you chose to put on it — the title, the audio, and the lyrics only if you turned them on. It does not show your email address or your name unless you wrote your name into the song. Comments left on the page are visible to everyone holding a live link, and to you.

Legal and safety. We disclose information when the law requires it, in response to a valid legal process, to enforce our Terms, or to protect the rights, property, or safety of anyone. Where we are permitted to tell you about a request for your information, we will.

Business changes. If we are involved in a merger, acquisition, financing, or sale of assets, information may transfer as part of it. It stays subject to this policy until you are told otherwise, and we will tell you before it becomes subject to a materially different policy.

10. International transfers

We are based in the United States, and our providers may process information in the United States and elsewhere. Privacy law in those countries may differ from the law where you live.

When we transfer personal information out of the EEA, the UK, or Switzerland, we rely on an appropriate safeguard — usually the European Commission’s Standard Contractual Clauses, with the UK Addendum where the UK GDPR applies — together with technical and organizational measures such as encryption in transit and at rest and access controls. You can ask us for a copy of the safeguard we rely on for a particular transfer.

11. How long we keep it

We keep personal information only as long as we need it for the purpose we collected it, or as long as the law requires.

Your account

While your account is open. Close it and we begin deleting.

Your songs and the conversations behind them

While your account is open, unless you delete a song sooner. We keep them by design — a keepsake you cannot get back is not a keepsake, and your saved pronunciations apply to future songs.

After you close your account

We delete or de-identify your personal information within 30 days from our live systems, and within 90 days from routine encrypted backups. Anything we are required to keep — see below — is isolated and used only for that purpose.

Purchase and tax records

7 years.

SMS consent records

4 years from the consent or opt-out, to show we had permission.

Acceptance of these documents

4 years after your account closes.

Security and access logs

Up to 12 months.

Support correspondence

3 years after the matter is closed.

Content withheld or removed under our acceptable-use rules

Up to 12 months, so we can respond to an appeal or a legal request, and longer where the law requires it.

Share links, likes, and comments

While the song exists. Switching a link off keeps the record of it so the creator’s counts stay honest; deleting the song deletes the lot.

The listener fingerprint behind a play

12 months, then removed. The play still counts; what goes is the value that told one listener from another. The fingerprint attached to a like is kept while the like is — it is the only thing that lets you take one back.

Referral records

While both accounts are open, and 7 years for any credit that was applied to a purchase, with the purchase records above.

A song you released to streaming services cannot be unpublished by us alone — see our Terms of Use.

12. How we protect it

We encrypt data in transit and at rest, store passwords only as salted Argon2id hashes, support two-factor authentication and passkeys, restrict staff access to what a person’s job requires, log administrative access, and rate-limit sign-in and other sensitive operations. Payment card details never reach our systems.

No service can promise perfect security. If a breach affects your personal information and the law requires us to tell you, we will — without undue delay, and within any deadline that applies to us.

You can help: use a strong, unique password, turn on two-factor authentication, and review the active sessions on your account’s Devices page.

13. Your California privacy rights (CCPA/CPRA)

This section applies to California residents and uses the CCPA’s terms. The categories of personal information we have collected in the last 12 months, and the statutory categories they fall under, are:

We collect these from you, from your device, from a partner or gift purchaser who involved us, and from our service providers, for the business purposes in How we use it. We retain them for the periods in How long we keep it.

We have not sold personal information, and we have not shared it for cross-context behavioral advertising, in the preceding 12 months. We do not do either, and we do not knowingly do either with the information of anyone under 16. Because we do not, there is no “Do Not Sell or Share My Personal Information” opt-out to offer you — but if that ever changes, we will provide one and tell you before it takes effect.

As a California resident you have the right to:

• Know what personal information we have collected about you, where we got it, why, who we disclosed it to, and to get a copy of it — including in a portable form;
• Delete personal information we hold about you, subject to the exceptions the CCPA allows (for example, records we must keep for tax or consent purposes);
• Correct inaccurate personal information;
• Limit our use and disclosure of sensitive personal information — we already limit ourselves to what the CCPA permits without a request;
• Opt out of any sale or sharing for cross-context behavioral advertising, if we ever do either; and
• Not be discriminated against for exercising any of these rights. We will not deny you the Service, charge you a different price, or give you a lower quality of service because you exercised a privacy right.

To make a request, email privacy@yoursongs.ai from the address on your account. We will confirm within 10 business days and respond within 45 days, extending once by another 45 days if we need to and telling you why. We verify a request by matching it to your account — for a sensitive request we may ask you to sign in or confirm details we already hold. We do not use verification information for anything else.

An authorized agent may act for you if they give us written, signed permission from you; we may still ask you to confirm directly. If you are a California resident, you may also use the portability and access mechanisms described below.

14. Your rights in the EEA, UK, and Switzerland (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights over the personal information we hold about you. Exercising them is free.

• Access — to be told whether we process your personal information and to get a copy of it, with the details this policy sets out.
• Rectification — to have inaccurate information corrected and incomplete information completed.
• Erasure — to have your information deleted where it is no longer needed, where you withdraw consent we relied on, or where you successfully object and we have no overriding ground.
• Restriction — to have us pause processing while a dispute about accuracy or our grounds is resolved.
• Portability — to receive the information you gave us in a structured, commonly used, machine-readable form, and to have it sent to another controller where technically feasible. This covers what we process on the basis of your consent or our contract with you.
• Objection — to object to processing we base on legitimate interests. We will stop unless we have compelling grounds that override your interests, or we need to process for legal claims.
• Withdraw consent — where we rely on consent, such as text messages, you can withdraw it at any time. Withdrawal does not affect processing that already happened.
• Complain— to your local supervisory authority. In the UK that is the Information Commissioner’s Office; in the EEA it is the authority for your country of residence, work, or where the issue arose; in Switzerland it is the Federal Data Protection and Information Commissioner. You may complain without contacting us first, though we would like the chance to put things right.

To exercise any of these, email privacy@yoursongs.ai. We respond within one month, and may extend by two further months for a complex request, telling you why within the first month. We may ask you to confirm your identity before we act.

Where you decline to give information we need to perform our contract with you — an email address, for instance — we may be unable to provide the Service. Everything optional is marked as optional.

International transfers explains the safeguards we use when your information leaves your region.

15. Other U.S. state privacy rights

If you live in a U.S. state with a comprehensive privacy law — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as they take effect — you have rights to confirm and access what we hold, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale, and profiling with significant effects. We do not engage in targeted advertising, sale, or that kind of profiling.

Make a request the same way: email privacy@yoursongs.ai. If we decline, we will tell you why and how to appeal; where your state gives you a right of appeal, we will decide the appeal within the time your law allows and tell you how to contact your attorney general if you disagree.

Nevada residents may ask us not to sell their covered information; we do not sell it.

16. Children

The Service is for adults. You must be at least 18 to have an account, and we do not knowingly collect personal information from anyone under 18. Songs about children — a birthday, a lullaby — are welcome and common, and the information in them is the account holder’s to provide, subject to our Terms of Use. If you believe a child has created an account or that we hold a child’s information we should not, write to privacy@yoursongs.ai and we will delete it.

17. Automated decisions

We do not make decisions about you solely by automated means that have a legal effect on you or otherwise significantly affect you. AI generates your song, and automated checks help flag content for review — but a person decides whether to withhold or remove content, or to suspend an account, and you can ask us to look again by writing to privacy@yoursongs.ai.

18. Changes to this policy

We update this policy when what we do changes. The effective date and version are at the top. If a change is material, we will tell you — by email, by a notice in the Service, or by asking you to review the new version — before it applies to information we already hold. We keep the version you agreed to on your account record.

19. How to contact us

For privacy questions or to exercise any right in this policy, email privacy@yoursongs.ai.

For everything else, support@yoursongs.ai. For legal notices, legal@yoursongs.ai.