# Privacy notice > What personal data SingingAds keeps, why, for how long, who processes it and how to see, export or delete yours. Source: https://singingads.com/privacy # Privacy notice *Last updated 17 October 2026* This notice explains what personal data SingingAds collects, why, who receives it, how long we keep it and how to use your rights. It is written for the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, for people in the European Economic Area, the EU General Data Protection Regulation (EU GDPR). ## 1. Who is responsible for your data The controller is RNIFY Limited, a private limited company registered in England and Wales under company number 16749515, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. For any privacy question or request, use the [contact form](https://singingads.com/contact) and choose the privacy topic. ## 2. What we collect ### Account data Your email address, password (stored only as a salted hash), optional name and business name, language, whether you agreed to marketing emails, the version of the terms you accepted and when, two-step sign-in settings if you turn them on, and how you heard about us if you tell us. If you sign in with Google, we receive your Google account identifier and email address. ### Your ads The product page address you submit, the text, price and images SingingAds reads from that page, a screenshot of the page for the proof shot, the brief, the claims, the lyrics, your edits and settings (length, look, language), and your rights confirmation. A product page can contain personal data about other people, for example a name or a photo; submit only pages you have the right to use. ### Generated files Songs, character images, frames, clips, captions and finished videos, stored in our Cloudflare R2 storage, with records of each step (what ran, when, how long it took, what it cost, whether it failed). ### Payment and billing Your plan, purchases, amounts, credit balance and credit history, your Stripe customer and subscription identifiers, and when you agreed to immediate supply at checkout. Stripe collects your card details directly; we never see or store your full card number. ### Support Messages you send through the contact form, your email address and our replies. ### Usage analytics (first party) We count how our own site and app are used: pages viewed, how far a page is scrolled, buttons clicked, steps of making an ad, sign-ups and purchases. Each record carries a random visit identifier, a random anonymous browser identifier, the page address, the referring page if your browser sends one, campaign tags in the link, your approximate country (from the network, not GPS) and the type of device. When you are signed in, the records are linked to your account. We use no third-party trackers, no advertising cookies and no advertising networks. See section 4 for how to opt out. ### Security and technical data Sign-in sessions (a hash of the session token, the browser type, the approximate country and when the session expires), failed sign-ins and lockouts, and a keyed hash of the IP address in our security log, which lets us spot repeated abuse without storing the address itself. Our hosting provider processes IP addresses to deliver and protect the site. ## 3. Why we use it, and our lawful bases - **To provide the service you asked for** (your account, reading your product page, making and storing your ads, taking payment, credits and refunds, account emails and support): *contract*. - **To keep the service and accounts secure** (rate limits, lockouts, bot checks, the security log, fraud and abuse prevention, enforcing our terms): *legitimate interests* in protecting our users and our service. - **To understand and improve the product** (first-party analytics and operational logs, such as which steps fail or are slow): *legitimate interests* in running and improving SingingAds. You can object at any time (section 4). - **To send marketing emails** (product news and offers): *consent*. The box at sign-up is unticked by default. You can withdraw consent at any time with the unsubscribe link in any marketing email or in your account settings. - **To keep tax and accounting records** and answer lawful requests from authorities: *legal obligation*. - **To deal with legal claims** and complaints: *legitimate interests* in establishing, exercising or defending legal claims. We do not sell your personal data. We do not use your ads, inputs or outputs to train AI models. ## 4. Our analytics, and how to opt out Our analytics is our own: the records go only to our own database, they are used only to understand and improve SingingAds, and they are not shared with advertisers or analytics companies. It uses an anonymous identifier in your browser's local storage and a visit identifier in its session storage (listed on the [cookies page](https://singingads.com/cookies)). You have the right to object. To stop us counting your visits in this browser, use the "Do not count my visits" switch on this page. It saves a setting in your browser, and our pages then send no analytics records from that browser. Because the setting lives in your browser, you need to switch it on in each browser you use, and again if you clear your browser data. You can also contact us to object to analytics linked to your account. ### Google Analytics (only with your consent) If you choose "Allow Google Analytics", we also use Google Analytics 4 (Google Ireland Limited / Google LLC) to measure visits and where they come from, on the basis of your *consent*. It sends the page path, campaign tags, an approximate location derived from your IP address and device information to Google; Google signals and ad personalisation are off, and data is kept for 14 months. You can withdraw consent at any time with the footer switch (see the [cookies page](https://singingads.com/cookies)). ## 5. Who we share data with We use these providers (processors) to run SingingAds. They act on our instructions under data processing terms and may not use your data for their own purposes, except where stated. - **Cloudflare, Inc.**: hosting and delivery of the site and app, the database, file storage (R2), the queue that runs each step, bot checks (Turnstile), the browser that opens your product page to take the proof-shot screenshot (Browser Rendering), video assembly, Workers AI speech-to-text to time the captions to the song, and a backup text model when others are unavailable. - **Google** (Google Cloud Vertex AI and the Google Gemini API, provided by Google LLC or Google Cloud EMEA Limited as applicable): making the music (Google's Lyria model), the character and frame images and the video motion, and writing text when our main text route is unavailable. Under Google's terms for these paid services, Google does not use the requests or results to train its models; it may keep them for a limited time to detect abuse. - **OpenRouter, Inc.**: routes text requests (the brief, lyrics and storyboard words) to DeepSeek models hosted by third-party providers. We send requests only to hosts that do not keep or train on prompts. If Google's own music service is busy, a song request may also go through OpenRouter to the same Google model. - **Stripe** (Stripe Payments Europe Limited, Stripe Payments UK Limited or Stripe, Inc., depending on where you are): checkout, payments, subscriptions and refunds. Stripe also acts as an independent controller for some purposes, such as fraud prevention and its own legal obligations; see [Stripe's privacy policy](https://stripe.com/privacy). - **Have I Been Pwned (Pwned Passwords)**: when you set a password, we send only the first five characters of a hash of it, so the service never learns your password, to check it against known breaches. - **Email delivery**: account emails (such as email confirmation and password resets) are sent through an email delivery provider, which we will name in this notice before it sends any email for us. Stripe sends payment receipts. When you submit a product page, SingingAds requests that page from the website that hosts it, as any visitor would. That website can see the request came from our service, not from you. We may also share data with professional advisers, with authorities when the law requires it, and with a buyer of our business, who would have to respect this notice. ## 6. International transfers Some providers process data outside the UK and the EEA, mainly in the United States. Where a country does not have an adequacy decision or regulation, the transfer is protected by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, by the EU Standard Contractual Clauses, or, for providers certified under it, by the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) or the EU-US Data Privacy Framework. These safeguards are part of each provider's data processing terms. Contact us for more detail. ## 7. How long we keep data - **Account data**: while your account is open. When you delete your account, it is erased within 30 days, except what we must keep below. - **Ads (page text, screenshot, brief, lyrics) and generated files (audio, images, videos)**: until you delete the ad or your account. We do not delete them on a timer while your account is open. Once you delete them, they are removed from live storage within 30 days. - **Backups**: copies in backups and recovery history are overwritten within 30 days. - **Payment, purchase and tax records**: six years after the end of the financial year they relate to, because UK tax and company law requires it. Stripe keeps its own records under its policy. - **Support messages**: 24 months after the conversation ends, or until you delete your account if sooner, unless we need them for a complaint or legal claim. - **Usage analytics**: 24 months, then deleted or reduced to totals that identify no one. Records linked to your account are deleted or stripped of the link when you delete your account. - **Sign-in sessions**: until you sign out or the session expires after 30 days. - **Security log**: 90 days. ** Error log**: 30 days. - **Record of your marketing consent or opt-out**: while we send you marketing and for two years after, so we can show we respected your choice. - **Data needed for a complaint, dispute or legal claim**: until it is resolved and any time limit for claims has passed. ## 8. Your rights You have the right to: - get a copy of your personal data, and receive data you gave us in a portable format; - have inaccurate data corrected; - have your data erased; - restrict how we use your data in some cases; - object to our use of your data based on legitimate interests, including analytics (section 4); - object to direct marketing at any time, which we always respect; - withdraw consent at any time where we rely on consent, without affecting what we did before. Your account settings let you download your data ("Export my data") and delete your account. For anything else, use the [contact form](https://singingads.com/contact). Using your rights is free. We reply within one month (longer for complex requests, in which case we tell you why), and we may ask you to confirm your identity. ## 9. Complaints If you are unhappy with how we handle your data, please tell us first through the [contact form](https://singingads.com/contact). You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO), at [ico.org.uk/make-a-complaint](https://ico.org.uk/make-a-complaint/). If you live in the EEA, you can complain to the data protection authority in your country. ## 10. Children SingingAds is not for anyone under 18, and we do not knowingly collect data from children. If you believe a person under 18 has opened an account, tell us and we will close it and delete the data. ## 11. How we protect your data - All traffic to SingingAds is encrypted in transit. - Passwords are stored only as salted hashes. New passwords are checked against known breaches without revealing them. - The sign-in cookie cannot be read by scripts in the page, and we store only a hash of the session token. - Your ads and files are private to your account. Providers receive files only to carry out a step. - Card details go straight to Stripe and never reach our servers. - Sign-in attempts are limited, accounts lock briefly after repeated wrong passwords, and you can add two-step sign-in with an authenticator app. No service can promise perfect security. If a breach is likely to put you at risk, we will tell you and the regulator as the law requires. ## 12. Automated decisions We make no decisions about you based solely on automated processing that have a legal or similarly significant effect. Some things are automatic without such an effect: SingingAds flags claims for you to check, model providers' safety filters may refuse a request (its credits come back), and rate limits slow down unusual numbers of requests. If you think one of these got it wrong, contact us and a person will look at it. ## 13. Changes to this notice We update this notice when what we do changes, for example when we add a provider. The date at the top shows the current version. If a change is significant, we tell you by email or in the app before it takes effect.