Privacy Notice

Last updated: 9 October 2026

1. Who we are

SongWorlds is operated by Toye Falusi, a sole trader based in the United Kingdom. For the purposes of the UK General Data Protection Regulation (UK GDPR), Toye Falusi is the data controller for the personal data described in this notice.

Contact: [email protected]

2. What data we collect

  • Account data: your email address (used for magic-link sign-in)
  • Audio data: the audio file you upload for processing
  • Usage data: timestamps, track identifiers, render status, and technical logs
  • Payment data: handled entirely by Paddle (our payment processor) — we do not store card details

3. Why we process your data

  • To create and manage your account (lawful basis: contract)
  • To analyse your audio and generate your video (lawful basis: contract)
  • To process payments and issue entitlements (lawful basis: contract)
  • To detect and prevent fraud and abuse (lawful basis: legitimate interests)
  • To send service-related emails (lawful basis: contract)

4. Who we share your data with

We share data only where necessary to operate the service. All processors are bound by data processing agreements:

  • Supabase — authentication and session management
  • Cloudflare — content delivery, object storage (R2), and tunnelling
  • fal.ai — video generation (Vidu Q2, Happy Horse, Kling O3)
  • Anthropic — AI director (Claude)
  • Cerebras — AI director fallback
  • Google — Gemini vision quality-check
  • Paddle — payment processing

Where data is transferred outside the UK, we rely on the UK Extension to the EU-US Data Privacy Framework or Standard Contractual Clauses.

5. How long we keep your data

  • Tracks (audio files): 3 months after your last interaction, then deleted
  • Generated videos: 3 months after your last interaction, then deleted
  • Account data: 21 days after your last interaction, then deleted
  • Payment records: 6 years (HMRC record-keeping requirement)

6. Your rights

Under UK GDPR, you have the right to:

  • Access a copy of your personal data
  • Correct inaccurate data
  • Request erasure of your data
  • Restrict or object to processing
  • Receive your data in a portable format
  • Withdraw consent at any time (where consent is the lawful basis)

To exercise any of these rights, email [email protected]. We will respond within one month.

7. Cookies

We use only strictly necessary cookies for authentication (Supabase session cookies). We do not use tracking or advertising cookies. No cookie consent banner is required for strictly necessary cookies.

8. How to complain

If you have concerns about how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Website: ico.org.uk

Helpline: 0303 123 1113