Get started

Privacy policy

Version 2026-11-08.5.

Who is responsible

Tibor Czekay, c/o COCENTER, Koppoldstr. 1, 86551 Aichach, Germany, info@tiborczekay.com, is the controller under the GDPR. We have no data protection officer because we aren't required to.

What we process and why

Data Purpose Legal basis Kept for
Email address, plan, billing period Your account, sign-in, contract Art. 6 (1) (b) GDPR Until you delete your account. We delete accounts on our own 2 years after the plan ended, and accounts that never started a plan after 30 days
Sign-in links and 6-digit sign-in codes (stored as hashes), with the number of wrong code entries Signing you in without a password, blocking guessing Art. 6 (1) (b) and (f) GDPR 15 minutes, deleted a day later
Session cookie (a random token, stored as a hash) Keeping you signed in Art. 6 (1) (b) GDPR, § 25 (2) TDDDG 30 days
Checkout cookie (a random token) Signing you in after payment, only in the browser that started checkout Art. 6 (1) (b) GDPR, § 25 (2) TDDDG 1 hour
Email address entered at checkout, chosen plan Emailing you the link to continue to payment (or a sign-in link if the email already has an account, so nobody can buy into someone else's account), and closing an older open checkout so you aren't charged twice Art. 6 (1) (b) and (f) GDPR The link works for 1 hour and is deleted a day later; not kept beyond that unless you complete the purchase
Video descriptions, music briefs, generated tracks and their lyrics Making your tracks Art. 6 (1) (b) GDPR Until you delete them, your account, or 90 days after your plan ends. Deleting a track also clears its description from our job records, which are otherwise deleted after 30 days
Track proof: track ID, file fingerprint (SHA-256), length, date. No account, email or description Confirming that songg generated a file, for example to dispute a Content ID claim Art. 6 (1) (f) GDPR (defending you and us against claims) 3 years, also after the track or account is deleted
Download count and time of the last download per track Showing that tracks were delivered, for example when a payment is disputed Art. 6 (1) (b) and (f) GDPR With the track
Track reports (reason, your note) Refunding the credit, checking tracks that resemble existing songs Art. 6 (1) (b) and (f) GDPR Until you delete your account
New email address when you change it Sending the confirmation link to the new address Art. 6 (1) (b) GDPR The link works for 1 hour; the record is deleted with your account, or a day after an unused link expires
Account status (for example, generation paused while a payment is disputed) Preventing fraud and abuse Art. 6 (1) (f) GDPR Until it's lifted or the account is deleted
Credit history Billing credits correctly Art. 6 (1) (b) GDPR Until you delete your account
Billing name, address, payment details Payment, invoices Art. 6 (1) (b) and (c) GDPR Held by Stripe; 10 years for tax law (§ 147 AO, § 257 HGB)
Withdrawal and cancellation declarations, cancellation confirmation links Processing them and proving we did Art. 6 (1) (c) and (f) GDPR 3 years; confirmation links expire after 7 days
Emails you send us, and our notices about your withdrawals, cancellations, refunds, disputes and reports Answering you, processing your requests Art. 6 (1) (b), (c) and (f) GDPR As long as needed to handle the matter, and up to 3 years as proof
IP address, browser data (Turnstile) Blocking bots and abuse Art. 6 (1) (f) GDPR A few days at Cloudflare
Server logs (request path without query string, status, error messages, internal account IDs) Finding and fixing errors, security Art. 6 (1) (f) GDPR Up to 7 days at Cloudflare; error alerts emailed to us only as long as needed to fix the problem

We don't use analytics, advertising or tracking tools, and the only cookies are the session and checkout cookies, both needed for the service you asked for. That's why there's no cookie banner. Cloudflare may ask your browser to report failed connections to it (Network Error Logging); these reports contain technical connection data only, no page content.

Who receives data

Our database keeps an automatic restore history (Cloudflare D1 Time Travel) for up to 30 days, for recovery after errors. Data you delete, or that we delete, disappears from it after 30 days at the latest. If we ever restore the database, we delete again everything that was erased after the restore point, before the service goes back online.

songg's database and file storage are kept in Cloudflare's EU jurisdiction. Cloudflare and Google may still process data in the USA (for example for email delivery or the Gemini API). Both are certified under the EU-US Data Privacy Framework; standard contractual clauses also apply.

Automated decisions

songg automatically blocks descriptions that ask for imitations of real artists or for unsafe content. This only affects whether a track is generated, and the credit is refunded. It's not a decision with legal effects under Art. 22 GDPR.

Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). In your account you can download all your data, change your email address and delete your account yourself. The download covers our database and file storage; it also lists where other copies exist (Stripe, Google, our inbox, Cloudflare logs). When you ask us by email, we reply only to the address on your account, to make sure we're talking to you. For anything else, write to info@tiborczekay.com.

You can complain to a data protection authority, for example ours: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

Do you have to provide data?

We need your email address and payment details to make and run the contract. Without them, you can't use songg.

Changes

We update this policy when our processing changes. The version date is at the top.