Privacy Policy

1. Who is responsible for your data

The controller of personal data processed through Vibe2Song is Semy WEB GbR, at Zaunkönigstraße 7, 82140 Olching, Germany. For privacy questions, email support@vemlee.com.

2. The data we process

• Account data: name, email address, a protected credential hash where present, Google account ID, email verified by Google, profile image URL when you sign in with Google, and the date and version of your acceptance of the Content Generation Rules.
• Creative data: music prompts, lyrics, generation settings, images you upload, generated audio tracks and related details, favourites and library history.
• Service and purchase data: credit balance and transaction records, selected plan, subscription status and dates, order identifiers and purchase tokens used to verify purchases and prevent duplicate credit grants.
• Content reports: track ID and title, the selected reason, any optional comment and a link to the reporting account.
• Technical data: session and request-protection data, plus service and error logs used to keep the service secure and troubleshoot faults.

Vibe2Song does not receive your bank card details or Google Play payment credentials. Google Play processes the purchase.

3. Why we use your data

• We create your account, provide sign-in with email or Google and maintain your library to perform our contract with you (Article 6(1)(b) GDPR).
• We process the prompts, lyrics, settings and images you provide to generate music and save the result to your library, as part of performing our contract (Article 6(1)(b) GDPR).
• We display your balance, verify purchases and subscriptions, and credit your account to perform our contract. We process records that must be retained by law to meet our legal obligations (Article 6(1)(c) GDPR).
• We check age eligibility and compliance with the generation rules, keeping the date and version of your confirmation to protect the service and enforce our terms (Articles 6(1)(b) and 6(1)(f) GDPR).
• We review reports about generated tracks and investigate possible violations based on our legitimate interest in keeping the service safe (Article 6(1)(f) GDPR).
• We secure accounts and the service, prevent abuse, troubleshoot faults and respond to requests based on our legitimate interest in operating and supporting the service (Article 6(1)(f) GDPR).

Your email address is required to register and sign in. To generate music, you need to provide a prompt and select any relevant settings or files; without them, we cannot fulfil that generation request.

4. Who we share data with

• Google Identity verifies Google sign-in and provides the basic profile information you authorise it to share.
• Google Cloud / Vertex AI (Lyria) processes prompts, lyrics, settings and selected images to generate music.
• Google Play processes subscription and credit purchases, verifies order status and sends us purchase-status updates.
• Hetzner Online GmbH hosts Vibe2Song's servers. Data stored by the service is hosted in Germany. Hetzner Online GmbH's address is Industriestr. 25, 91710 Gunzenhausen, Germany.

We do not sell personal data. The public website does not use advertising pixels or third-party web analytics. Google may process data outside the European Economic Area. Cross-border processing by Google Cloud and Vertex AI is governed by the Google Cloud Data Processing Addendum; where required, the EU Standard Contractual Clauses (SCCs) apply. Google describes the safeguards used by its other services, including adequacy decisions, the EU–US Data Privacy Framework for certified organisations and SCCs where required, on its page about international data transfers.

5. Retention and security

Your name, email address, profile image, settings, prompts, library, audio files, purchase data and record of accepting the Content Generation Rules are kept while your account remains active. Images you upload are deleted when generation completes or fails. If you delete your account, your profile and library data, sessions and related files are deleted. Reports are retained separately as described below.

If your account received a welcome bonus, after account deletion we retain an HMAC fingerprint of your email address only for as long as needed to prevent the same address receiving the bonus again. We retain hashes of Google Play purchase tokens only for as long as needed to prevent duplicate credit grants or link a purchase. These are pseudonymised personal data, not anonymous data: the original email address and token are not stored in these records, but a value provided again can be matched to its fingerprint.

Laravel error logs rotate daily and are limited to 14 daily log files; older files are deleted when the log is next written. Hetzner system and web-server logs are controlled by separate server and hosting settings. Records specifically retained for an ongoing incident investigation or legal obligation are kept until that need ends. Credentials for payment and music-generation services are stored on the server and are not included in the Android app.

Content reports and their link to an account are kept while needed to review the report and investigate the related incident. After that, they are deleted or anonymised unless the law requires longer retention. If you delete your account, the link between your report and your account is removed; information needed for an ongoing investigation may be kept until that need ends.

Deleting your Vibe2Song account does not cancel your Google Play subscription. If auto-renewal is enabled, charges will continue until you cancel the subscription separately in Google Play.

We use technical and organisational safeguards to protect data. No method of transmission or storage is completely secure.

6. Retention periods, deletion and your rights

You can delete your account in the app settings. If you cannot sign in, submit a request through the account deletion page. Where provided by applicable law, you may also request access to, correction of, restriction of or portability of your data, and object to its processing. Contact us at support@vemlee.com. To protect your account, we may ask you to verify that you own it.

You may lodge a complaint with a data protection supervisory authority. For the controller in Bavaria, this is the Bavarian Data Protection Authority (BayLDA).

7. Sessions and cookies

The public website does not use advertising or analytics cookies. The app interface uses a technical session and request-forgery protection required for sign-in and account functions. This data is not used for advertising profiles.

8. International processing and changes

Data stored by Vibe2Song is hosted on servers in Germany. Google Cloud, Google Identity and Google Play may process the data they receive in other countries under the terms of their respective services and with safeguards required by applicable law.

We will announce material changes in the app or on this page. The revised policy takes effect on the date shown above.