Privacy Policy

1. Who we are

Instamelo is an AI-powered music generation service. You can contact us at support@instamelo.com. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, we act as the data controller for the personal data described below.

2. Data we collect

We only collect what we need to run the Service.

• Account data: your name, email address, and a hashed (never plain-text) password. If you sign in with Google, we receive your Google account ID, email, name, and profile picture URL as returned by Google’s OAuth service.
• Two-factor authentication data: if you enable 2FA, an encrypted TOTP secret is stored so we can verify your one-time codes.
• Session data: a session identifier stored in a first-party cookie, plus device metadata (user agent, approximate IP address, timestamp) so you can review and revoke active sessions.
• Content you submit: prompts, lyrics, style selections, uploaded audio (when using Extend, Add Vocals, or Mashup), and the songs and metadata produced by the Service.
• Usage data: the songs you generate, credit balance, plan tier, and admin audit records for security-relevant actions.
• Communication data: emails we send you for account verification, password reset, or service notifications.

We do not knowingly collect special-category data (health, biometrics, political opinions, etc.) and we ask you not to submit it in prompts or uploads.

3. How we use your data

• To create and secure your account.
• To generate the songs, lyrics, and derivative works you request, and to store your library so you can access it later.
• To send transactional email (verification, password reset, security alerts). We do not send marketing email.
• To protect the Service against abuse, fraud, and automated attacks (rate limiting, bot detection, audit logs).
• To comply with legal obligations and enforce our Terms of Service.

4. Legal bases (GDPR)

Where GDPR applies, we rely on the following legal bases:

• Contract — to provide the Service you requested (account creation, generation, storage).
• Legitimate interests — to secure the Service, prevent abuse, and improve reliability. You can object to processing based on legitimate interests at any time.
• Consent — for any optional feature that we clearly flag as consent-based (e.g. if we introduce analytics in the future).
• Legal obligation — when we must respond to lawful requests or comply with applicable law.

5. Sub-processors and data sharing

We share data with the following third-party service providers strictly as needed to operate the Service. Each is bound by their own privacy terms and security commitments.

• Vercel Inc. — application hosting.
• Neon — managed PostgreSQL database (EU region).
• AI generation providers — third-party machine-learning services that produce the requested music and text output. Your prompts, lyrics, style selections, and any uploaded audio are transmitted to these providers strictly to generate and return the output you requested, and are handled under those providers’ own privacy and security terms.
• Resend — transactional email delivery (verification and password-reset messages).
• Cloudflare — Turnstile bot-protection widget on the signup form.
• Google — Sign-in with Google (OAuth), only if you choose to use it.

We do not sell your personal data. We do not share it with advertisers or data brokers.

6. International transfers

Our primary application and database infrastructure is hosted in the European Union (Frankfurt). Some sub-processors listed above are based in the United States. Where personal data is transferred outside the EEA or UK, we rely on the European Commission’s Standard Contractual Clauses or an equivalent transfer mechanism provided by the recipient.

7. Retention

• Account data is retained for as long as your account is active.
• Generated songs and prompts are retained until you delete them or your account is deleted.
• Session records are retained until you or the system revokes them, or after a period of inactivity.
• Security and audit logs are retained for up to 12 months and then deleted.
• Deleted account data is removed from active systems within 30 days; residual copies may persist in encrypted backups for a limited period before being overwritten.

8. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data (“right to be forgotten”).
• Restrict or object to certain processing.
• Receive a copy of your data in a portable format (data portability).
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at support@instamelo.com. We will respond within 30 days.

9. Cookies

We use a small number of strictly necessary first-party cookies for authentication and session management. We do not use tracking, advertising, or third-party analytics cookies. Cloudflare Turnstile may set short-lived cookies on the signup page to detect automated traffic.

10. Children

The Service is not directed at children under 13 (or under 16 in the EEA / UK, or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Security

We use industry-standard measures including TLS in transit, bcrypt password hashing, encrypted secrets, hardened session cookies, optional two-factor authentication, and rate-limited authentication endpoints. No system is perfectly secure — please keep your password strong and unique.

12. Changes to this policy

If we make material changes we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

13. Contact

Questions or requests about this policy or your data: support@instamelo.com.