1. Who can use the Service

You must be at least 16 years old to use the Service. If you are under 18, you need your parent or legal guardian's permission to use the Service, and they should read this policy with you.

We do not knowingly collect personal information from anyone under 16. If we learn that an account belongs to someone under 16, we will close it and delete its information. If you believe this has happened, contact us at [email protected].

2. Information we collect

Information you give us

• Account details: your email address, username and password (stored only in hashed form), or the basic profile details supplied by a sign-in provider such as Google if you sign in that way.
• Profile: display name, avatar, header image, bio, location, social links, and any artist profiles you create, including NFT-based artist profiles.
• Your content: everything you create or upload. This includes text prompts, lyrics, reference audio, voice recordings (for example from Freestyle and other vocal features), audio files, images and videos, and the tracks, stems, covers and visuals generated for you. Freestyle voice recordings in our mobile app are the exception: they are kept only on your device. We pass each recording to our AI provider to create your track and do not store it ourselves.
• Community activity: comments, favourites, follows, playlists, messages and other interactions.
• Payments: when you buy Coinz or other products, our payment provider (Stripe) collects your card or payment details. We do not see or store your full card number. We keep records of the transaction, such as the amount, date and what you bought.
• Crypto wallets: if you connect a wallet, we store its public address and read public blockchain data, such as NFT ownership, to power wallet and NFT features.
• Support and communications: messages you send us, and your email preferences.

Information from connected services

• SoundCloud: if you choose "Connect SoundCloud", SoundCloud tells us your SoundCloud account ID, username, profile link, avatar, follower count and list of public tracks, so you can verify your account and choose tracks to show. We do not store your SoundCloud access token. It is used once to read that information and is then revoked.
• Other links and imports: if you add Spotify, YouTube or SoundCloud links, we fetch public information about them, such as titles, artwork and durations, from those services.

Information collected automatically

• Usage and device information: IP address, browser and device type, operating system, pages and features used, and the date and time of your visits. We use this to run, secure and improve the Service.
• Cookies and similar technologies: see section 7.
• Reminders: if you turn on reminders in our mobile app, they are scheduled on your device and nothing is sent to us (see section 8).

3. How we use your information

• To provide the Service: create and run your account, generate and store your tracks and visuals, and show your public profile.
• To process payments, maintain your Coinz balance and keep financial records.
• To run community features such as charts, XP, comments, follows and notifications.
• To keep the Service safe: preventing fraud and abuse, enforcing our Terms, and moderating content.
• To understand how the Service is used and improve it (analytics, with your consent where the law requires it).
• To send you service messages and, if you opted in, news, new features and offers by email. Marketing email is optional: you choose it with a separate, unticked box, and you can unsubscribe at any time using the link in any email.
• To comply with the law and respond to lawful requests.

We do not sell your personal information.

4. What is public

Your username, public profile, released tracks, public playlists, comments and similar activity are visible to anyone using the Service and may appear in search engines. Your email address, payment details and private content are not public.

5. AI providers and other service providers

We use trusted providers to run the Service. They process information on our behalf and only for the purposes described here.

AI generation and audio processing. When you use an AI feature, the Input needed for that job (such as your prompt, lyrics, reference audio, voice recording or image) is sent to the provider that performs it, and the result is returned to you. Depending on the feature, these providers include MusicGPT, Mureka, Suno, fal.ai, Replicate, RunPod, Music.AI, ElevenLabs, Roex, OpenAI, Anthropic, Google (Gemini), OpenRouter, Recraft, TopMediaAI and Lovable's AI gateway. For example, voice recordings made in Freestyle are sent to MusicGPT, or to Mureka if MusicGPT is unavailable, for processing. We do not use your voice recordings to create a voice model of you. Each provider handles the data under its own terms and privacy policy.

Other providers:

• Hosting, database and sign-in: Supabase
• File storage: DigitalOcean (Spaces)
• Content delivery and security: Cloudflare
• Payments: Stripe
• Email: Brevo (newsletters) and Resend (account and service emails)
• Analytics and advertising, on our website only (with consent where required): Google Analytics and Google Tag Manager, Google AdSense, PostHog, TikTok Pixel
• Blockchain data: Alchemy, Moralis and Covalent
• Music metadata and lookups: Spotify, SoundCloud, YouTube, Last.fm, Discogs and MusicBrainz

We may also share information where the law requires it, to protect rights and safety, or with a buyer if our business is sold or reorganised.

6. Information sent overseas

Many of our providers store or process information outside Australia, mainly in the United States and the European Union. When we send personal information overseas, we take reasonable steps so it is handled consistently with the Australian Privacy Principles. Examples include choosing reputable providers and using their standard data-protection terms.

7. Cookies, analytics and advertising

We use essential cookies and similar storage to keep you signed in and remember your settings. With your consent, or where the law allows without it, we also use analytics and advertising technologies (Google Analytics, PostHog, TikTok Pixel and Google AdSense) to understand how the Service is used and to measure and show ads.

In regions where consent is required, such as the EU, UK and Switzerland, these stay off until you choose to allow them. You can change your choice at any time through our cookie banner or by clearing cookies in your browser.

These analytics and advertising tools are used on our website only. Our mobile apps do not contain analytics, advertising, tracking or crash-reporting tools.

8. Notifications and reminders

If you turn on reminders in our mobile app, the app schedules notifications on your device and sends nothing to us. You can turn them off at any time in the app or in your device settings. We do not currently send push notifications. If we add them in future, we will store a device token to send them and update this policy first.

9. How long we keep information

• Account, profile and content: while your account exists, or until you delete it or the content.
• Freestyle voice recordings (in the app): kept only on your device. We pass the recording to our AI provider (MusicGPT, or Mureka if MusicGPT is unavailable) to create your track and do not store it. The provider keeps it only as its own terms allow.
• Other audio you upload on the website, such as reference audio: kept with your account like your other content.
• Technical logs: up to 90 days.
• Payment and transaction records: 7 years, as required by Australian tax law.
• Backups: routine database backups roll over automatically after 7 days.
• Cached copies of files: may remain in our content delivery network for up to 30 days after deletion.

10. Deleting your account

You can permanently delete your account yourself at any time:

• On the website: Settings → Account → Delete account.
• In the app: Account → Delete account.
• By email: write to [email protected] from the email address on your account.

To protect you, we ask you to type DELETE to confirm, and to have signed in within the last 10 minutes.

Deletion is immediate and permanent and cannot be undone. Download anything you want to keep first.

What we delete:

• your account and login;
• your profile and any artist profiles, including NFT-based profiles;
• your avatar and images;
• all your music, including released tracks, covers and stems;
• playlists, comments, favourites, follows and messages;
• generations and saved samples;
• XP and your Coinz balance.

Other people's comments, favourites and playlist entries on your tracks are removed too.

Freestyle voice recordings were never stored by us: they stay on your device until you delete them there or remove the app.

What we keep: records of payments and Coinz transactions (amounts, dates and reference numbers only, with no profile details), for 7 years as the law requires.

Good to know:

• Files are removed from our storage straight after deletion. Cached copies can stay in our content delivery network for up to 30 days, and database backups roll over after 7 days.
• People who bought or collected your tracks will no longer be able to play or download them.
• Information already shared with third-party services, or published elsewhere, is outside our control.
• Accounts with staff access must be closed by contacting us.

11. Your rights

You can ask to access the personal information we hold about you, correct it, or delete it. You can edit most of your information yourself in Settings, and delete your account as described above. Depending on where you live, you may also have the right to object to or restrict some uses, to receive a copy of your data in a portable format, and to withdraw consent.

To make a request, email [email protected]. We will respond within 30 days and may need to verify your identity first.

12. Security

We use reasonable technical and organisational measures to protect your information, including encryption in transit, access controls and limited staff access. No system is completely secure, so please use a strong, unique password. If a data breach is likely to cause you serious harm, we will notify you and the regulator as required by law.

13. Changes to this policy

We may update this policy from time to time. The effective date at the top shows when it last changed. If we make significant changes, we will let you know through the Service or by email.

14. Contact us and complaints

Pure BPM Pty Ltd (ACN 690 461 815)
Level 1, 452 Flinders Street, Melbourne VIC 3000, Australia
Email: [email protected]

If you have a concern about how we handle your personal information, please contact us first and we will try to resolve it. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (www.oaic.gov.au), or to the data protection authority where you live.