Privacy Policy for Melodious AI

Last updated: 3 October 2026

Melodious AI ("we", "us", "our") provides AI-powered music video generation at https://melodious.ai.

1. Data We Collect
- Account data: name, email, Supabase user ID.
- Billing data: Stripe customer, subscription, and invoice identifiers (we do not store full card numbers).
- Content data: uploaded audio, prompts, generated images/videos, and project metadata.
- Operational telemetry: error logs, request metadata, device/browser diagnostics.
- How you found us: when you create an account we save, with your account, the page you landed on, the site that referred you, any campaign tags in the link (utm) and any advert click ID, together with your country and how you signed up (email or Google). We save this whether or not you accept analytics in the cookie banner. It sets no analytics cookie. The signup is also recorded, with the same details and your account ID, in our analytics account (PostHog).
- Purchases: when you start a checkout we record which page and button it started from on the payment record at Stripe. Completed purchases are recorded, with your account ID, in our analytics account (PostHog). They are reported to Google Analytics only if you accepted analytics.
- Product analytics, only if you accept analytics: pages viewed, clicks and session replays of how you use the site (PostHog; what you type into forms is masked), and page-view statistics (Plausible, Google Analytics).

2. Why We Process Data
- Provide and secure the product.
- Process payments and enforce plan limits/credits.
- Support users and investigate incidents.
- Improve quality, reliability, and abuse prevention.

3. Subprocessors
- Supabase: authentication, database, storage.
- Stripe: payment processing and subscription billing.
- Google AI Studio API: Gemini-powered audio understanding and lyrics extraction.
- Replicate: hosted media generation for image and video inference.
- AWS: API gateway, Lambda, AgentCore runtime, infrastructure logging/monitoring.
- Vercel: web hosting and frontend delivery.
- Crisp: customer support chat.
- PostHog: product analytics, session replay, and the server-side record of signups and purchases.
- Plausible + Google Tag Manager + Google Analytics: analytics and product usage signals.
See the live subprocessor registry: https://melodious.ai/subprocessors

4. Cookies and Tracking
The cookie banner asks you to accept or reject analytics. You can change your choice at any time in Privacy Settings (https://melodious.ai/privacy-settings), and you can also block cookies in your browser.
- Only after you accept: PostHog (analytics and session replay), Plausible, Google Analytics and our own usage events are loaded. Google's cookies are set only after you accept.
- Before you choose, and if you reject: Google Tag Manager still loads, in Google's Consent Mode with all Google storage denied. In that mode Google sets no cookies and receives cookieless pings, which Google uses to estimate visits and conversions.
- Not controlled by the banner: the Crisp support chat loads so that you can contact us (its button is shown only on some pages), and it may set its own cookie. The record of how you found us (section 1) is kept in your browser tab until you sign up, then saved with your account. Your banner choice itself is saved in your browser.

5. Data Retention
- Account and subscription records: retained while account is active and as required for tax/accounting/legal compliance.
- Generated media/project history: retained until user deletion request, account deletion, or lifecycle policy cleanup.
- Operational logs: retained according to infrastructure log retention configuration.

6. Deletion and Access Requests
To request account/data deletion or data export, contact hello@melodious.ai from your account email with subject line:
"Data Request: Delete Account" or "Data Request: Export Data".
We will verify ownership and process requests within a reasonable timeframe.
Process page: https://melodious.ai/data-requests

7. Children's Privacy
Melodious AI is not directed to children. If we learn we collected personal data from a child, we will delete it promptly.

8. Policy Updates
We may update this policy periodically. Material changes will be posted on this page with a revised effective date.

9. Contact
Questions about privacy or data rights: hello@melodious.ai.