Back to SongReelAI

SongReelAI Legal

Privacy Policy

A clear account of the data SongReelAI processes, the providers involved, retention periods, security controls, and the choices available to you.

Effective August 3, 2026Version 1.0support@songreelai.com
1

Scope and data controller

This Privacy Policy explains how SongReelAI collects, uses, shares, stores, and protects personal data when you visit songreelai.com, create an account, use our AI music or video tools, contact support, or purchase a subscription.

SongReelAI is operated by an independent individual operator based in the People's Republic of China and trading as SongReelAI. The Operator is the controller of personal data collected directly through the Service. For privacy requests, emailsupport@songreelai.com. We have not appointed a separate data protection officer.

This Policy works together with our Terms of Service. A payment provider may be an independent controller for payment, tax, fraud, and compliance data it collects during checkout.

2

Data we collect

CategoryExamples
Account and identityEmail address, user ID, username, avatar, authentication method, account status, and Google profile information you authorize when using Google sign-in.
Creative inputsPrompts, lyrics, song titles, genres, styles, negative instructions, uploaded audio, uploaded images, and source media used for generation or processing.
Generated and processed contentGenerated lyrics, songs, covers, stems, WAV or MP3 files, music-video clips, project metadata, model choice, and generation history.
Usage and entitlementPlan, credit balance and ledger, tools used, task status, downloads, generation settings, errors, timestamps, and support history.
Billing and transactionBilling email snapshot, plan and billing cycle, amount, currency, payment status, subscription or transaction identifiers, refunds, and provider environment. We do not receive or store complete card numbers.
Device, network, and securityIP address, user-agent string, browser and device signals, session and guest identifiers, rate-limit records, security events, request timestamps, and diagnostic logs.
CommunicationsMessages, attachments, feedback, reports, refund requests, and other information you send to support.

Please do not submit sensitive personal information, private recordings, or third-party material unless it is necessary for the requested feature and you are authorized to use it.

3

How creative content is processed

Inputs must be sent to the provider that performs the requested task. The data sent depends on the feature:

  • Lyrics prompts and context are sent to DeepSeek Chat.
  • Song titles, prompts or lyrics, style settings, and model selections are sent to Kie.ai for Suno music generation or extension using V4.5+, V5, or V5.5 model labels.
  • Selected source images, audio clips, and prompts are sent to Replicate for Pruna AI P-Video music-video generation.
  • Uploaded or generated audio is sent to Replicate for Demucs / htdemucs vocal removal and stem separation.

Providers return task identifiers and generated results to SongReelAI. We store the result and job metadata so you can access your library, retry or diagnose failed jobs, enforce credits, and investigate abuse. SongReelAI does not use private Inputs to train its own AI models unless you separately opt in. Third-party providers process data under their own contractual terms and privacy practices.

Human review is limited

We do not routinely read private creations. Authorized access may occur when necessary to answer your support request, investigate flagged or reported content, prevent fraud or security abuse, restore a failed job, or comply with a lawful request.
4

Why we use data and our legal bases

PurposeTypical legal basis
Create and secure accounts; provide generations, storage, downloads, and account historyPerform our contract with you
Process subscriptions, credits, refunds, receipts, and cancellationPerform our contract; comply with tax and accounting duties
Operate rate limits, detect fraud, protect users, and enforce the AUPLegitimate interests in security and abuse prevention; legal obligations where applicable
Respond to support, privacy, safety, and billing requestsPerform our contract; legitimate interests; legal obligations
Diagnose failures and improve reliability and usabilityLegitimate interests, using aggregated or minimized data where practical
Send essential account, billing, renewal, security, and policy noticesPerform our contract; legitimate interests; legal obligations
Comply with courts, regulators, law enforcement, sanctions, and payment-network rulesLegal obligation and legitimate interests
5

Cookies and local storage

We currently use cookies and browser storage needed for authentication, security, language or interface state, Google sign-in nonces, and guest-generation limits. These include Supabase authentication cookies and SongReelAI guest-trial identifiers that may remain for up to 30 days.

TypePurposeCan it be disabled?
Authentication and securityMaintain a signed-in session, prevent request forgery, and secure account access.Disabling may prevent sign-in or core account features.
Guest-trial controlsRemember guest usage and enforce fair-use limits.Disabling may prevent guest generations.
Functional browser storagePreserve temporary workflow state and Google sign-in verification values.Clearing it may reset the workflow or sign-in attempt.

We do not currently use third-party advertising pixels or sell cookie data for targeted advertising. If we introduce optional analytics or marketing cookies, we will update this Policy and provide any consent control required by law.

6

Third parties and data sharing

We do not sell personal data. We share only the data reasonably needed for the following providers to perform their functions:

RecipientPurpose and data involved
SupabaseAuthentication, account sessions, database records, user profiles, generation jobs, library data, credits, subscriptions, and row-level access controls.
VercelWebsite and API hosting, content delivery, request handling, operational logs, IP address, user agent, and error diagnostics.
Cloudflare R2Storage and delivery of uploaded or generated audio, covers, stem files, source images, and videos.
Google Identity ServicesOptional Google sign-in and the identity information you authorize Google to provide.
DeepSeekLyrics prompts and related generation context used to create lyrics with DeepSeek Chat.
Kie.aiSong or extension prompts, lyrics, titles, style and model settings, callback identifiers, and generated music results.
Replicate and relevant model publishersAudio, images, prompts, and task data needed for Pruna AI P-Video and Demucs / htdemucs processing.
PayPalCheckout, subscription, payment, refund, fraud, and dispute handling for PayPal transactions.
Waffo PancakeMerchant-of-record checkout, card or wallet processing, tax, receipts, refunds, subscription operations, fraud controls, and chargebacks for transactions routed through Waffo.

We may also disclose data to professional advisers under confidentiality, to a successor in a merger or sale subject to continuing protection duties, when you direct or consent to the disclosure, or when required by a valid legal process. We may preserve and report evidence of suspected CSAM, credible threats, fraud, or other illegal conduct as required by law.

7

International data transfers

SongReelAI serves users internationally. Our Operator is based in China, while hosting, storage, authentication, AI, and payment providers may process data in the United States, Singapore, the European Economic Area, or other countries where they operate. Those countries may have different data-protection laws from your country.

Where required, we use contractual protections, provider data-processing terms, transfer mechanisms such as standard contractual clauses, data minimization, encryption in transit, and other lawful safeguards appropriate to the transfer.

8

Retention and deletion schedule

DataTypical retention
Account and profileWhile the account is active; deletion or de-identification normally begins within 30 days after a verified account-deletion request, subject to exceptions below.
Prompts, lyrics, songs, stems, images, and videosUntil you delete the item, close the account, or the Service removes it. Residual backups and queued deletion records may remain for up to 90 days.
Guest-trial identifiers and recordsCookie identifiers generally last up to 30 days; server-side anti-abuse records may be retained for up to 12 months.
Generation and operational logsNormally up to 12 months, longer if needed for an active security, abuse, support, or payment investigation.
Support and safety correspondenceNormally 24 months after the request is closed, or longer for an active dispute.
Payment, subscription, tax, refund, and dispute recordsUp to seven years, or the longer period required by accounting, tax, anti-fraud, payment-network, or legal obligations.

Deletion may be delayed when data must be retained to complete a transaction, protect security, resolve a dispute, enforce an agreement, prevent repeat abuse, or comply with law. When possible, retained data is restricted from ordinary use.

9

Security measures

  • HTTPS/TLS encryption for data in transit.
  • Managed authentication and session controls through Supabase.
  • Database row-level access controls and restricted administrative credentials.
  • Private media proxying and controlled object-storage access where supported.
  • Rate limits, request guards, callback authentication, and payment-webhook verification.
  • Limited access to production systems and logs based on operational need.

No system can guarantee absolute security. Notify us promptly if you believe your account or content was compromised. If a breach creates a legally reportable risk, we will notify affected users and regulators within the period required by applicable law.

10

Your privacy rights and account deletion

Depending on your location, you may have rights to know, access, correct, delete, restrict or object to processing, obtain a portable copy, withdraw consent, and complain to a data protection authority. We do not discriminate against users for exercising a privacy right.

How to make a request

  • Email support@songreelai.com with the subject Privacy request.
  • Send the request from your registered email and state the right you want to exercise.
  • We may request limited information to verify identity and prevent unauthorized access.
  • We aim to respond within 30 calendar days; complex or legally extended requests may take longer, and we will explain the extension.

You can delete individual songs, stems, lyrics, or videos using available controls in your library. To delete the full account and associated personal content, email a verified request to support@songreelai.com. Canceling a paid subscription does not by itself delete the account, and deleting the account does not automatically reverse a payment.

California residents may also request the categories and specific pieces of personal data collected and request deletion or correction where applicable. We do not sell personal data or share it for cross-context behavioral advertising.

11

Service and marketing communications

We may send essential messages about sign-in, verification, generation status, security, subscription renewal, receipts, refunds, support, or policy changes. You cannot opt out of messages necessary to provide or secure an active account.

We do not currently operate a general promotional mailing program. If optional marketing is introduced, it will use consent where required and every marketing message will include an unsubscribe method. Withdrawing marketing consent does not affect essential service messages.

12

Children's privacy

The Service is for users aged 18 or older. We do not knowingly collect personal data from children. If you believe a child has provided data, contact support@songreelai.com; after reasonable verification, we will remove it and take any reporting or preservation step required for child safety.

Any attempt to create, upload, or process child sexual abuse material or other child-unsafe content is prohibited by our AUP and may be reported to appropriate authorities.

13

Third-party services and links

Our website may link to third-party sites or display a checkout, authentication, or media experience operated by another provider. That provider's privacy notice applies to data it collects directly. Review the provider's terms before supplying information. We are not responsible for unrelated third-party sites that we do not control.

14

Policy changes and contact

We may update this Policy as the Service, providers, or law changes. We will post the new version and effective date. For a material change that meaningfully affects existing users, we will provide at least 14 days' notice by email or a prominent in-service notice where reasonably possible.

RequestContact
Privacy access, correction, deletion, objection, or portabilitysupport@songreelai.com
Security incident or AUP safety reportsupport@songreelai.com
General customer or billing supportsupport@songreelai.com
Websitehttps://songreelai.com

Last updated August 3, 2026.