Privacy Policy

1. Who processes your data

The data controller is [COMPANY NAME], with its registered office in [CITY], [COUNTRY], publisher of the Mamusic service.

For any question about your data, or to exercise any of the rights described below, write to [CONTACT EMAIL].

2. The data we collect

We collect only what the service needs to work. Specifically:

• Account: your email address, your password in encrypted, non-reversible form, and — if you sign in with Google — your name and profile picture as Google provides them to us.
• Creations: the instructions you enter, the style and voice you choose, the lyrics written or generated, and the audio files produced.
• Payments: the amount, currency, date and status of your credit purchases, and the transaction ID at our provider. We never see your full Mobile Money number or any confirmation code, and we do not store them.
• Technical: your IP address, browser type and sign-in timestamps, used for security and to limit abuse.
• Ad measurement: if you arrive through an ad, a browser identifier set by the Meta pixel (see the section on cookies).

3. Why we process it

Each piece of data serves a specific purpose: your email to identify you and send you messages about your account; your instructions to produce the song you asked for; your payments to credit your account and meet our accounting obligations; your technical data to detect abuse and protect the service.

The legal basis is the performance of our contract for everything relating to the account, creations and payments; our legitimate interest for security and fraud prevention; your consent for ad measurement; and our legal obligations for accounting records.

We do not use your creations to train artificial intelligence models, and we do not sell your data to anyone.

4. Who it is shared with

The service relies on technical providers who act on our behalf and are contractually bound not to use your data for any other purpose:

• Vercel — application hosting and technical logs.
• Neon — database (account, creations, credits, orders).
• Cloudinary — storage and delivery of the audio files produced.
• APIPASS / Suno — lyrics and music generation; receives your instructions and chosen style, never your email.
• Chariow — collection of Mobile Money payments; receives the information needed for the transaction.
• Resend — sending verification and password reset emails.
• Upstash — temporary memory used to limit the number of requests.
• Sentry — reporting technical errors, with sensitive data removed before sending.
• Google — only if you choose to sign in with Google.
• Meta (Facebook) — only if you have accepted advertising trackers.

5. Transfers outside your country

Most of these providers are established in the United States or the European Union and host their servers there. Your data may therefore be processed outside [COUNTRY].

We select providers offering equivalent contractual safeguards, in particular the European Commission's standard contractual clauses where they apply.

6. How long we keep it

Account data and your creations are kept as long as your account exists. When you delete a creation, its audio files are destroyed at our file host and the creation disappears from your library; a minimal accounting record of the corresponding credit charge is kept, as it is needed to justify your account balance.

After your account is closed, your data is deleted within thirty days, except for accounting records relating to your purchases, kept for ten years in accordance with legal obligations, and security logs, kept for twelve months.

7. Cookies and trackers

We use strictly necessary cookies to keep you signed in and to protect forms against fraudulent submissions. They cannot be disabled without stopping the service from working, and they are not used for any advertising tracking.

If you consent, we also set the Meta pixel, which lets us measure how effective our ads on Facebook and Instagram are and how many people who came from an ad create an account or buy credits. This tracker stores an identifier in your browser and sends Meta the page viewed and the action taken.

We also send Meta, from our servers, confirmation of a credit purchase, so that measurement stays accurate when your browser blocks trackers. This only happens if you have accepted advertising trackers, and identifying data is turned into non-reversible fingerprints before sending.

You can refuse or withdraw your consent at any time from the cookie banner, without affecting your use of the service.

8. How we protect it

Communication with the service is encrypted. Passwords are stored as non-reversible fingerprints and can never be viewed, including by us. Session tokens are short-lived and limited to the paths that need them.

Access to production data is restricted to the people who need it, and every administrative action is logged.

No system is perfectly secure. In the event of a data breach likely to put you at risk, we will inform you and notify the competent authority within the time limits set by law.

9. Your rights

You have the following rights over your data at any time:

• to access the data we hold about you and obtain a copy;
• to have inaccurate data corrected;
• to ask for your account and associated data to be deleted;
• to object to processing based on our legitimate interest;
• to withdraw your consent to advertising trackers;
• to ask for your creations to be exported in a usable format.

10. Contact us

Write to [CONTACT EMAIL]. We reply within thirty days. If you are not satisfied with our answer, you can contact [COUNTRY]'s competent personal data protection authority.