Privacy policy
Version 2026-11-08.
Who is responsible
Tibor Czekay, c/o COCENTER, Koppoldstr. 1, 86551 Aichach, Germany, info@tiborczekay.com, is the controller under the GDPR. We have no data protection officer because we aren't required to.
What we process and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Email address, plan, billing period | Your account, sign-in, contract | Art. 6 (1) (b) GDPR | Until you delete your account |
| Session cookie (a random token, stored as a hash) | Keeping you signed in | Art. 6 (1) (b) GDPR, § 25 (2) TDDDG | 30 days |
| Video descriptions, music briefs, generated tracks | Making your tracks | Art. 6 (1) (b) GDPR | Until you delete them, your account, or 90 days after your plan ends |
| Credit history | Billing credits correctly | Art. 6 (1) (b) GDPR | Until you delete your account |
| Billing name, address, payment details | Payment, invoices | Art. 6 (1) (b) and (c) GDPR | Held by Stripe; 10 years for tax law (§ 147 AO, § 257 HGB) |
| Withdrawal and cancellation declarations | Processing them and proving we did | Art. 6 (1) (c) and (f) GDPR | 3 years |
| IP address, browser data (Turnstile, server logs) | Blocking bots and abuse | Art. 6 (1) (f) GDPR | A few days at Cloudflare |
We don't use analytics, advertising or tracking tools, and we don't use cookies other than the session cookie. That's why there's no cookie banner.
Who receives data
- Cloudflare, Inc. hosts songg (servers, database, file storage, email, bot protection with Turnstile). Data processing agreement in place.
- Stripe Payments Europe Ltd. (Ireland) processes payments. Stripe is partly an independent controller for payment data; see stripe.com/privacy.
- Google LLC / Google Cloud EMEA Ltd. processes your video descriptions through the paid Gemini API to write the music brief and generate the audio. Under Google's terms for paid services, Google doesn't use this data to train its models. Data processing agreement in place.
songg's database and file storage are kept in Cloudflare's EU jurisdiction. Cloudflare and Google may still process data in the USA (for example for email delivery or the Gemini API). Both are certified under the EU-US Data Privacy Framework; standard contractual clauses also apply.
Automated decisions
songg automatically blocks descriptions that ask for imitations of real artists or for unsafe content. This only affects whether a track is generated, and the credit is refunded. It's not a decision with legal effects under Art. 22 GDPR.
Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). In your account you can download all your data and delete your account yourself. For anything else, write to info@tiborczekay.com.
You can complain to a data protection authority, for example ours: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.
Do you have to provide data?
We need your email address and payment details to make and run the contract. Without them, you can't use songg.
Changes
We update this policy when our processing changes. The version date is at the top.