musify.pl Privacy Policy
Draft 1.0 of 2026-09-08 — pending legal review. This is a translation; the Polish version is the binding one.
1. Controller
The controller of your personal data is Dariusz Sochacki, ul. Przechodnia 2, 34-400 Nowy Targ, Polska, osoba fizyczna ("we", "Musify"). Contact for anything about your data: hej@musify.pl. This policy covers musify.pl and all its pages.
2. What we process
- Account: e-mail address, chosen language and currency, time zone, account creation date, last login.
- Technical data: IP address, browser identifier (user agent), request timestamps — in server logs, rate limits and abuse protection.
- Order content: the description of the person or occasion you type (the brief), template fields, genre, song language, the lyrics before and after your edits. A brief may contain names and facts about third parties; you provide them on your own responsibility.
- Output: generated audio files, covers, share cards, lyrics synchronised with the recording, the karaoke version.
- Payments: token balance, top-up and charge history, Stripe customer and session identifiers. We never store card numbers; Stripe handles them exclusively.
- Consents: text, version and date of the terms and statements you accepted, your cookie choice.
- AI usage: technical logs of model calls (time, cost, job identifier), without which we cannot account for the service.
- Marketing (only with consent): Meta pixel identifiers and conversion events, including a hashed e-mail address sent server-side. Nothing here runs without your consent in the banner.
3. Why and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, magic-link login, creating and storing songs, payments and tokens, e-mails about a finished song | Art. 6(1)(b) — contract |
| Accounting, tax, handling complaints, proof of consents | Art. 6(1)(c) — legal obligation |
| Security, rate limits, abuse detection, content moderation, showing songs you yourself made public in the gallery, aggregate play statistics | Art. 6(1)(f) — our legitimate interest |
| Meta pixel and ad measurement | Art. 6(1)(a) — consent, withdrawable at any time |
4. Who receives the data
We use processors acting on our instructions:
- Google Ireland Ltd. / Google LLC — the Gemini language model writes and checks lyrics; it receives the brief and the lyrics.
- MIRA MUSE LLC (sunoapi.org), USA — access to the Suno music model; it receives only the lyrics and the style description, never your e-mail or brief. The United States is not covered by a European Commission adequacy decision (it covers only companies certified under the EU-US Data Privacy Framework, and this company is not on that list), and we have no standard contractual clauses with them. The transfer therefore rests solely on your explicit consent (art. 49(1)(a) GDPR), which we ask for with a separate checkbox before your first song. This carries a risk: enforcing your rights against a company outside the EEA may be harder. You can withdraw the consent at any time by writing to our contact address; it will not affect songs already recorded.
- Cloudflare, Inc. — DNS and storage of audio and images (R2), under its EU data processing addendum.
- Stripe Payments Europe Ltd. — card payments; Stripe is an independent controller of payment data.
- Brevo (Sendinblue SAS) — transactional e-mail (login links, notifications).
- dhosting.pl sp. z o.o. — hosting in Poland.
- Meta Platforms Ireland Ltd. — only after pixel consent; for the events collected on the site we are joint controllers.
Data may be disclosed to public authorities where the law requires it.
5. How long we keep it
- account data — while the account exists, and accounting records for 6 years from the end of the tax year;
- login link — 20 minutes, invalidated after use;
- technical logs — 90 days;
- songs, briefs and lyrics — until you delete them or delete your account; public songs leave the gallery the moment you unpublish them;
- consent records — 6 years;
- records at third-party services — per their policies; deleting your account triggers deletion of files from Cloudflare storage.
6. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent (without affecting earlier processing). Write to hej@musify.pl; we answer within a month. You may also lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw) or the authority in your country of residence.
If a song is about you and you did not order it: you can ask us to hide or delete it by writing to the same address with the link. We hide the song promptly, without asking the buyer for permission.
7. Cookies and similar technologies
- Strictly necessary:
MUSIFYSESS(session, 7 days), CSRF token, remembered language. The service does not work without them; no consent is required. - Marketing: Meta pixel — only after you click "Agree" in the banner. Change your choice at any time via the "Cookies" link in the footer.
We do not use cross-site tracking analytics. Song plays are counted in aggregate, without profiling.
8. Automated decisions
Before composition, every lyric passes automated content moderation (an AI model). A rejection has no legal effect and you can always appeal to a human at hej@musify.pl. We make no other automated decisions about users.
9. Children
The service is intended for people aged 16 or over. We delete accounts of younger users once we learn of them.
10. Security
Connections are encrypted (HTTPS), login uses a one-time link with no password, configuration files and keys are kept outside the public directory, and administrative access is password-protected and logged.
11. Changes
We will announce material changes to this policy by e-mail or an in-service notice at least 14 days before they take effect. The current version is always at musify.pl/legal/privacy.php.