Privacy Policy
This Policy explains what personal data Melovia processes, why, who it is shared with, how long it is kept and how you exercise your rights. It applies to the Melovia app, to song sharing pages and to the melovia.app website.
1. Who is responsible for your data
The data controller is Digital Dream Negócios Digitais LTDA, CNPJ 24.378.761/0001-40, with its registered office at Rua Alberto Cintra, 161, sala 1203, bairro União, Belo Horizonte – MG, Brazil.
Data protection officer (DPO / "encarregado"): Melovia Data Protection Officer
Contact: privacidade@melovia.app
2. Summary
- To create a song, the story you tell, the first name of the person the song is for and your choices are sent to Google: Gemini models write the lyrics and the Lyria model generates the music. The app asks for your consent before the first time this happens.
- The story text and the recording of your voice are deleted after use.
- The song uses a first name or nickname only. Data such as addresses, phone numbers and ID numbers is removed from the story before it is used.
- For every song we keep a generation record (when, with which models and at the request of which account or device), without the story text.
- We do not sell personal data, we do not show ads and we do not use your data for targeted advertising.
- You can delete a song, or your account, at any time. Some records are kept for the periods in section 7.
- Melovia is for adults aged 18 or over only.
3. Data we process, why, and on what legal basis
The legal bases below refer to Brazil's LGPD (Law 13,709/2018) and, for people in the European Economic Area or the United Kingdom, to the GDPR.
| Category | What data | Why | Legal basis |
|---|---|---|---|
| Device and account | An identifier created by Melovia for the device and an access key; country and language. If you sign in: e-mail address, display name and the identifier of your Apple or Google account. With Sign in with Apple, we store in encrypted form a code used only to revoke access when you delete your account. | To provide the service, keep your library and credits, and let you sign in on other devices. | Performance of the contract (LGPD art. 7, V; GDPR art. 6(1)(b)). |
| Age and consent | The confirmation that you are 18 or older (the date of birth you enter is used only for that check and is not stored); the version, date and time of the consent you gave. | To restrict the service to adults and to prove consent. | Compliance with a legal obligation and legitimate interests (LGPD art. 7, II and IX; GDPR art. 6(1)(c) and (f)). |
| Story and choices | The story text; if you record, the audio of your voice and its transcript; who the song is for, occasion, style, mood, teasing level and voice type. | To write the lyrics and generate the song; to check that the request follows the content rules. | Performance of the contract; consent for sending to AI providers (LGPD art. 7, I and V; GDPR art. 6(1)(a) and (b)). |
| Person the song is for | First name or nickname and the facts you told about them. | To create the song you asked for. | Legitimate interests, with the safeguards in section 9 (LGPD art. 7, IX; GDPR art. 6(1)(f)). |
| Songs | Lyrics, title, audio (preview and full song), cover, the title you edited, favourites. | To deliver and store your songs. | Performance of the contract. |
| Generation record | For each song: identifier, date and time (UTC), AI models used, identifier of the account or device that made the request, the consent version accepted and technical data about the request, such as the IP address. It does not include the story text. | Security, fraud prevention, handling reports and removal requests, defence in legal claims, and proof of how and when each song was generated. | Legitimate interests; compliance with a legal obligation; establishment, exercise or defence of legal claims (LGPD art. 7, II, VI and IX; GDPR art. 6(1)(c) and (f)). |
| Purchases | Product or plan, purchase and renewal dates, subscription status and transaction identifiers, received from the stores through RevenueCat. We do not receive your card details. | To grant credits and plans; handle refunds; prevent fraud; meet tax and accounting obligations. | Performance of the contract; legal obligation; legitimate interests. |
| Notifications | The device's notification token, if you allow notifications. | To tell you when your song is ready and send other service notices. | Consent (the system permission, which you can withdraw in your device settings). |
| Usage and operation | Events linked to your songs (for example: preview played, plans screen viewed, plan selected), time and cost of each generation step, IP address and technical logs. Logs do not contain the story text; e-mail addresses appear masked. | To run the service, measure and improve the experience, apply usage limits, and prevent abuse and fraud. | Legitimate interests (LGPD art. 7, IX; GDPR art. 6(1)(f)). |
| Moderation and safety | The result of the review of each request (category, score and action taken, without the text), refusals, account and device blocks, reports you made or that were made about your songs. | To stop prohibited content, protect people named in songs, and respond to reports. | Legitimate interests; compliance with a legal obligation; exercise of legal rights. |
| Visitors to a sharing page | A code derived from the IP address and the browser, from which the IP cannot be recovered; the reaction chosen; reports and removal requests (reason and, if given, e-mail). The page uses no cookies. | To count plays without repeats, allow one reaction per visitor, and handle reports and removal requests. | Legitimate interests; compliance with a legal obligation. |
| Support | The messages you send to our e-mail addresses and what is needed to answer them. | To answer questions, requests and complaints. | Performance of the contract; legal obligation; legitimate interests. |
What we do not collect: precise location, contacts, photos, advertising identifier. The microphone is used only when you tap record, and you can always type the story instead of recording it.
Sensitive data. We do not ask for sensitive data. Avoid including in the story information about health, religion, sexual orientation or other intimate details, whether yours or someone else's. Your voice is used only to transcribe the story: we do not use it to identify you or to create or clone voices.
Where the data comes from. From you; from Apple or Google, when you sign in with one of those accounts; from the stores and RevenueCat, about your purchases.
4. How we use artificial intelligence
- Before any AI model receives the story, a filter removes data such as e-mail addresses, phone numbers, addresses, ID numbers and bank details. The name given for the song is reduced to a first name or nickname.
- The story text (or the audio, for transcription), the first name and your choices are sent to Google. Gemini models review the content, transcribe the audio and write the lyrics. The lyrics and the style description are sent to Google's Lyria model, which generates the music and the vocals.
- Audio generated by Lyria carries SynthID, an imperceptible Google watermark, and the file you download carries our "Generated by AI" tag.
- If Google's text service is unavailable, the text may be sent to OpenRouter, a routing service used only as a contingency for text generation (lyrics and content review). OpenRouter never receives audio.
- We use Google's paid services. Under Google's terms for those services, the content sent is not used to improve its products. Google keeps requests and responses for 55 days to detect abuse, and flagged content may be reviewed by authorised Google staff.
- Melovia does not use your stories, recordings or songs to train AI models.
- The app asks for your consent before the first time data is sent. You can withdraw it by deleting your data; without it, songs cannot be created.
Generation record. For every song we keep: song identifier, date and time (UTC), models used, identifier of the account or device that made the request, the consent version accepted and technical data about the request, such as the IP address. The record does not contain the story text or the recording. It is used for security, fraud prevention, handling reports and removal requests, and defence in legal claims, and lets us prove how and when each song was generated.
Automated decisions. Content review is automated. It may refuse or adjust a request and, in cases of repeated abuse, block the account and the device. You can ask for a person to review the decision by writing to suporte@melovia.app.
5. Who we share data with
We use the companies below to provide the service. They process data on our behalf and under our instructions, unless stated otherwise.
| Company | Role | Data | Where |
|---|---|---|---|
| Google LLC (Gemini API and Lyria) | Content review, audio transcription, lyric writing, lyric timing and music generation | Story text or audio, first name, choices, lyrics, generated audio | United States and other countries where Google operates |
| OpenRouter, Inc. | Routing service, used only as a contingency for text generation (lyrics and content review) when Google is unavailable | Story text, first name, choices, lyrics | United States |
| RevenueCat, Inc. | Subscription and purchase management | Melovia device identifier, products purchased, dates and transaction identifiers | United States |
| Google LLC (Firebase Cloud Messaging) | Sending notifications | Device notification token and the content of the notice | United States and other countries where Google operates |
| Amazon Web Services, Inc. | Hosting, storage, backups and technical logs | All the data described in this Policy | United States (us-east-1) |
| Amazon Web Services, Inc. (Amazon SES) | Sending the e-mail with the sign-in code | E-mail address and code | United States (us-east-1) |
Independent controllers. Apple (App Store and Sign in with Apple) and Google (Google Play and Google sign-in) process payment and sign-in data under their own privacy policies. We do not receive your card details.
Other cases. We may share data with authorities, when the law or a valid order requires it; with lawyers and auditors, to defend legal rights; and with a successor, in a merger, acquisition or corporate reorganisation, keeping the safeguards of this Policy.
We do not sell personal data and we do not share it for targeted advertising.
When you share a link, anyone with the link sees the first name, the lyrics and the cover and can listen to the song, until you turn the link off.
6. International transfers
The providers in section 5 and our servers are in the United States. Your data is therefore processed outside the country where you live, including outside Brazil, the European Economic Area and the United Kingdom.
These transfers are necessary to perform the service you asked for and are made with the safeguards required by law (LGPD, arts. 33 to 36; GDPR, Chapter V): standard contractual clauses and the data processing agreements in place with each provider. You can ask for more information at privacidade@melovia.app.
7. How long we keep data
We delete the most sensitive content right after use. Records that prove what happened are kept for as long as needed to meet legal obligations and to exercise or defend legal rights (LGPD, art. 7, II and VI, and art. 16).
| Data | Period |
|---|---|
| Recording of your voice | Deleted as soon as the song is created. Unused recordings are deleted within 24 hours. |
| Story text | Deleted when the lyrics are final: when you unlock the song, use the redo, or when the preview expires (7 days at most). If generation fails, within 24 hours. |
| Previews that are not unlocked | Expire after 7 days; the audio files are deleted. |
| Unlocked songs (lyrics, audio, cover, first name) | Until you delete the song or your account. |
| Account data (e-mail, display name, sign-in identifiers) | Until you delete your account. |
| E-mail sign-in code | Valid for 10 minutes; we store only a hashed version. |
| Sharing links | Until you turn the link off, delete the song or delete your account. |
| Record of consent and age confirmation | 5 years after the end of our relationship with you. |
| Purchase and billing records | 5 years (tax obligations and consumer claims). |
| Generation records for each song | 5 years from generation. |
| Moderation decisions, blocks, reports and removal requests (without the story text) | 5 years. |
| Support messages | 5 years. |
| Application access logs (date, time and IP address) | At least 6 months, as required by Brazil's Marco Civil da Internet, and at most 12 months. |
| Anonymous device record and usage and anti-abuse counters | 12 months after the last activity. |
| Backups | Up to 30 days. |
| Requests and responses in Google's systems | 55 days, for abuse detection, under Google's terms. |
After these periods, data is deleted or kept only in a form that does not identify you. A period may be extended for as long as legal proceedings, an investigation or an order from an authority requires the data to be kept. Details of what happens on deletion are in Delete account and data.
8. Your rights and how to exercise them
At any time you can:
- confirm whether we process your data and access it;
- correct incomplete, inaccurate or out-of-date data;
- ask for data to be deleted, anonymised or blocked; some records are kept for the periods in section 7, as the law allows;
- ask for portability of the data you provided;
- know who we share your data with;
- withdraw consent and be told the consequences of not consenting;
- object to processing based on legitimate interests;
- ask for a review of decisions made solely by automated means;
- lodge a complaint with the data protection authority.
How to exercise them
- In the app: delete a song in your library; delete your account under Account → Manage account → Delete account; without an account, erase your data under Account → Privacy and data → Delete my data.
- By e-mail: write to privacidade@melovia.app. We may ask you to confirm that the request is yours, for example by replying from the account's e-mail address.
We do not charge for this and you will not be treated differently for exercising your rights.
Deadlines and authorities
- Brazil (LGPD): we reply within 15 days. You can complain to the Brazilian data protection authority (ANPD).
- European Economic Area and United Kingdom (GDPR): we reply within one month, which may be extended in the cases set out in the law. You can complain to the data protection authority of the country where you live. At this time, no representative has been appointed in the European Union or the United Kingdom.
- United States: depending on the law of your state, you may have the right to know, access, correct, delete and receive a copy of your data, and to opt out of the sale of data and of targeted advertising. We do not sell data or use it for targeted advertising. We reply within 45 days. If we refuse a request, you can appeal by replying to our message; if the appeal is refused, you can contact your state attorney general.
- Indonesia (UU PDP): see section 14.
9. If you are the person named in a song
The song is created by someone else, who tells us the story. We handle the data of the person the song is for with these safeguards: only the first name or nickname goes into the song; addresses, phone numbers, ID numbers, health and financial data are removed; requests that humiliate, expose or accuse someone are refused; the story text is deleted after use.
If you are named in a song, you have the same rights as in section 8 and you can ask for its removal. See Report content.
10. People under 18
Melovia is not intended for people under 18 and we do not knowingly collect their data. To use the app, a person enters their date of birth; the app may also use the app store's age signal. Accounts we find to belong to people under 18 are closed and the data is deleted. If you believe this has happened, write to privacidade@melovia.app.
Teasing songs may not target minors, and any content that sexualises minors is refused and logged.
11. Security
- All communication with the service is encrypted (HTTPS). Data and backups are stored encrypted.
- Audio files have random names and are reached only through signed links that expire.
- Technical logs do not store the story text, names, codes or keys; e-mail addresses appear masked.
- Team access to production data is restricted and logged.
No system is completely secure. If an incident occurs that may cause significant risk or harm, we will notify you and the authorities as the law requires.
13. Changes to this Policy
We may update this Policy. The date and version at the top show the version in force. When a change is material, we will give notice in the app and, if it affects the consent you gave, we will ask again.
14. Indonesia
This section applies to people who use Melovia in Indonesia. It supplements the rest of this Policy, in line with Indonesia's Personal Data Protection Law (Law No. 27 of 2022, "UU PDP").
- Controller. The personal data controller is Melovia, based in Brazil (section 1).
- Consent. Before sending the story and the name to the AI providers, the app asks for your explicit consent, in Indonesian. You can withdraw it at any time, as described in section 8.
- Your rights. You have the rights in section 8, under the UU PDP, including to access and correct your data, withdraw consent, and ask for processing to end and for deletion. We reply within the periods set by law.
- Transfers to other countries. Your data is sent to the United States, where our servers (Amazon Web Services, us-east-1 region) and the providers in section 5 are located, and is processed by the controller in Brazil. We apply the safeguards in section 6 and will follow the transfer instruments that the Indonesian data protection authority defines.
- Incidents. If a failure in the protection of your personal data occurs, we will notify you and the competent authority in writing within 3 x 24 hours, as the UU PDP provides.
- Minors. Melovia is for adults aged 18 or over only. We do not knowingly process data of children, who in Indonesia are people under 18.
- Contact. Requests from data subjects in Indonesia: privacidade@melovia.app. You may write in Indonesian or in English.
15. Contact
Melovia Data Protection Officer: privacidade@melovia.app
Support: suporte@melovia.app
Digital Dream Negócios Digitais LTDA · CNPJ 24.378.761/0001-40 · Rua Alberto Cintra, 161, sala 1203, bairro União, Belo Horizonte – MG