Privacy Policy

1. Data controller

2. Personal information we collect

• Account and authentication information: email address, display name, profile image, authentication-provider identifiers, sign-in method, sign-in IP address, and account timestamps.
• Creative inputs: prompts, negative prompts, images, reference video, audio, model choices, duration, resolution, aspect ratio, seeds, and other generation settings.
• Generation and usage records: task identifiers, status, progress, model and parameter snapshots, output metadata and locations, timestamps, errors, delivery status, viewing or download actions, and credit reservations, releases, and settlements.
• Transaction records: product, billing interval, amount, currency, payment and subscription status, renewal period, transaction and receipt references, credits granted, and associated account identifiers. We do not receive or store complete payment-card numbers.
• Support communications: emails, requests, feedback, and the information you provide when asking for account, billing, refund, safety, or privacy support.
• Technical information: IP address, browser and device information, operating system, language, time zone, referring page, request timestamps, diagnostic logs, security events, and pages or features used.
• Third-party sign-in information: when you choose an available Google or GitHub sign-in method, we receive the profile fields that provider authorizes for authentication.

3. How and why we use information

• Provide accounts, authentication, uploads, AI generation, progress tracking, downloads, and history as necessary to perform our contract with you.
• Calculate, reserve, grant, settle, and display credits and subscription benefits as necessary to perform our contract with you.
• Process transactions, subscriptions, cancellation, refunds, and billing support as necessary to perform our contract and comply with accounting obligations.
• Screen prompts, secure the service, detect fraud or abuse, diagnose failures, and maintain reliability based on our legitimate interests and legal obligations.
• Respond to customer support and privacy requests as necessary to perform our contract, comply with law, or pursue our legitimate interests.
• Comply with legal requirements and enforce the Terms of Service and Acceptable Use Policy.
• Create aggregated or de-identified statistics that do not reasonably identify an individual.

4. Cookies and tracking technologies

5. Sharing and disclosure

• Payment processing: new SongLee checkouts use Waffo Pancake as the merchant of record and PCI-DSS-compliant payment processor. Creem may continue to process only legacy subscriptions or transactions originally created through a Creem checkout. Complete card data is processed by the applicable provider and does not pass through or reside on our servers. We receive transaction, subscription, and payment-status records needed to deliver and support the purchase.
• AI generation and content safety: prompts, uploaded media, reference materials, and settings are sent to the selected third-party AI or API provider and, before generation, to a content-safety provider. Those providers may apply their own privacy, safety, retention, and acceptable-use rules.
• Website analytics: Google processes website interaction and technical information for Google Analytics 4 so that SongLee can measure aggregate traffic, diagnose usability, and improve the service.
• Infrastructure providers: we use service providers for hosting, database services, object storage, authentication, security, email, and support. They process information under service and confidentiality obligations.
• Legal and safety disclosures: we may disclose information when required by valid law, court order, or government request, or when reasonably necessary to protect users, rights, safety, and service integrity.
• Business transactions: information may transfer as part of a merger, acquisition, financing, reorganization, or sale, subject to continued protection and notice where required.
• With consent: we may disclose information for another purpose after obtaining your prior consent.

6. Data security and incident notice

7. Retention and deletion

• Generated video delivery files stored by SongLee: 24 hours after generation completes, after which they are scheduled for deletion. Download any final video you need to retain.
• Account information, prompts, settings, and generation-history metadata: while the account is active and for up to 90 days after a verified account-deletion request, then deleted or de-identified unless another period below applies.
• Transaction, subscription, invoice, credit, refund, and accounting records: 7 years after the relevant transaction or longer when applicable tax, accounting, anti-fraud, or legal rules require it.
• Customer-support and privacy-request records: 2 years after the request is closed.
• Security and diagnostic logs: 12 months after collection, unless a longer period is necessary to investigate an incident, prevent fraud, or establish or defend legal claims.
• Backups: deleted personal information may remain in encrypted or access-controlled backups for up to 30 days before routine overwrite, unless preservation is legally required.
• Third-party providers may retain information under their own published policies. We will honor a valid deletion request by deleting or instructing processors to delete information where applicable and legally permitted.

8. Your privacy rights

9. Marketing communications

10. International transfers

11. Children and minors

12. Third-party links and services

13. Policy changes

14. Contact and operator details