Privacy Policy

This Privacy Policy explains what information SendTunes collects when you use sendtunes.app, how we use it, who we share it with, and the rights you have over it. It applies to the web version of SendTunes. The SendTunes iOS app is covered separately — see our iOS agreement and the in-app privacy notice for that platform.

For purposes of EU and UK data protection law (the GDPR and the UK GDPR), the data controller is Tuvo Labs Limited Co, an Arizona limited liability company. You can reach us at privacy@sendtunes.app.

1. What we collect

We collect only what we need to run the service.

Information you give us. When you sign in we receive your email address and, depending on the sign-in method you choose, your name or a third-party identifier. When you generate a song we receive the text prompt (lyrics) you submit and the choices you make (length, genre, mood, vocal). When you contact support we receive whatever information you put in your message.

Information collected automatically. When you use sendtunes.app, our servers and security tools see standard request data: your IP address, browser type, device type, approximate location (derived from IP), timestamps, and the pages or features you used. We use this for security, fraud prevention, debugging, and to keep the service running.

What we don't collect.We do not collect precise GPS location, facial recognition data, biometric identifiers, contacts, microphone or camera input, or any data that we don't need to provide the service.

2. How we use your information

We use the information we collect to:

• generate the songs you ask us to generate;
• operate, maintain, secure, and improve sendtunes.app;
• verify that requests come from real people and aren't coming from bots, scripts, or scrapers;
• send you transactional messages (e.g. sign-in links);
• respond to your support requests and the rights requests described in Section 8;
• comply with legal obligations and enforce our Terms.

We do not run advertising on sendtunes.app, we do not sell your personal information, and we do not use your songs, prompts, or account data to train AI models.

3. Legal basis for processing (EU/UK users)

If you are in the EU, the UK, or another jurisdiction with similar law, our legal bases for processing your personal data are:

• Performance of a contract— we process your email, prompts, and song output because you asked us to provide the service.
• Legitimate interests— we process device, IP, and usage data to keep the service secure, prevent abuse, and improve reliability. We balance these interests against your privacy rights.
• Legal obligation— we keep limited records where law requires (e.g. tax records for paid users).
• Consent— where we ever ask for it explicitly (e.g. optional emails). You can withdraw consent at any time.

4. AI generation — what happens to your prompts

SendTunes uses a third-party AI provider to render your song. When you tap Generate, we send the provider the text prompt you wrote and the parameters you selected. We do not send the provider your email, account ID, or any other identifying information — the prompt is delivered through our servers with our API credentials, not yours.

Our AI provider is contractually required to:

• process your prompt only to generate the song you requested;
• not use your prompt or the resulting song to train, fine-tune, or improve their models;
• delete your prompt and the generated song from their systems within a short window (typically days, not months).

SendTunes itself stores the generated mp3 in our own cloud storage so you can play and share it. See Section 6 for how long we keep it.

5. Who we share data with

We share personal data only with service providers who help us run SendTunes, and only the minimum needed for them to do their job. These providers fall into the following categories:

• Hosting and infrastructure— for serving the website and our backend.
• Authentication— for sign-in with Apple, Google, email, and magic links.
• AI model rendering— for turning your prompt into music.
• Bot and fraud protection— for verifying that requests come from real people.
• Payment processing— if you purchase a subscription or credit pack on the web.

Each of these providers is bound by a data-processing agreement that requires them to protect your data and use it only for the purpose we contract them for. We do not share your data with advertisers, data brokers, or marketing networks.

We may also disclose information if we're legally required to (for example, in response to a valid subpoena or court order), or if we believe disclosure is necessary to investigate fraud, protect our rights, or protect the safety of users or the public.

6. How long we keep your data

Generated songs: we automatically delete generated audio files from our storage 30 days after they were created. If you want a song longer than that, download it.

Prompts and generation history: retained for as long as you have an account, then deleted when you close it.

Account information: kept while your account is active. If you ask us to delete your account, we delete your account record and associated personal data, except for the minimum we are legally required to retain (e.g. billing records).

Logs and security data: retained for a limited period (typically up to 12 months) for security, fraud prevention, and debugging.

7. International transfers

SendTunes operates from the United States, and some of our service providers (including our AI provider) are located outside the US, the EU, and the UK. When we transfer personal data internationally, we rely on legally recognized safeguards, including the European Commission's Standard Contractual Clauses, to make sure your data continues to receive an adequate level of protection.

8. Your rights

Depending on where you live, you have one or more of the following rights over your personal data:

• Access — ask what we hold about you.
• Correction — ask us to fix inaccurate data.
• Deletion — ask us to delete your account and data.
• Portability — receive a copy of your data in a portable format.
• Restriction or objection— ask us to stop or limit certain kinds of processing.
• Withdraw consent— where processing is based on consent, you can withdraw it.
• Complaint— lodge a complaint with your local data protection authority. EU/UK users can find their regulator at edpb.europa.eu or ico.org.uk.

To exercise any of these rights, email privacy@sendtunes.app. We may need to verify your identity before responding. We'll respond within the timeframe required by applicable law (typically 30 days).

We do not discriminate against you for exercising your rights. You won't be charged a different price or given a different level of service for asking us to honor a privacy right.

9. California residents

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you the rights described in Section 8, plus the right to know the categories of personal information we collect and the purposes we use them for.

In the last twelve months, we have collected the following categories of personal information:

• Identifiers(email address, name, account ID) — collected from you when you sign in, used to operate the service.
• Internet activity(IP address, device type, pages visited) — collected automatically, used for security and reliability.
• Commercial information(subscription status, purchase records, song generation history) — collected when you generate songs or purchase a plan, used to provide the service.
• User-generated content(text prompts you submit for generation) — collected when you generate a song, used to render the requested output.

We do not sell or share personal information as those terms are defined under the CCPA/CPRA. We do not use sensitive personal information for any purpose beyond providing the service.

10. Children

SendTunes is not directed to children under 13, and we do not knowingly collect personal data from anyone under 13. Users between 13 and 18 (or the local age of majority) need a parent or guardian's permission to use the service. If you believe a child under 13 has provided us with personal information, contact privacy@sendtunes.app and we will delete it.

11. Cookies and similar technology

SendTunes uses only essential cookies and similar storage — the minimum needed to keep you signed in, verify that you're a real person (and not a bot), and remember a draft song while you sign in. We do not use analytics cookies, advertising cookies, or third-party tracking pixels.

Because we only use strictly necessary cookies, we do not show a cookie consent banner. If we later add anything non-essential, we'll ask for your consent first.

12. Security

We protect your data with industry-standard technical and organizational measures, including encryption in transit (TLS), encryption at rest, access controls, and bot/fraud-prevention systems. No method of transmission or storage is perfectly secure, but we take this seriously and continuously improve our defenses.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the “Last updated” date at the top and, where the change significantly affects how we handle your data, we'll notify you (for example, by email or an in-product notice). Continued use of the service after a change takes effect means you accept the updated policy.

14. Contact us

Questions, requests, or complaints about how we handle your data:

Tuvo Labs Limited Co
2345 East Thomas Road, Ste 100 PMB 118
Phoenix, Arizona 85016
United States
privacy@sendtunes.app