Privacy Policy

This Privacy Policy explains how Melody Box Limited (“Melodio,” “we,” “us,” or “our”), a company registered in England and Wales, collects, uses, shares and protects your personal information when you visit or use our website at https://melodio.co (the “Site”) and our AI-powered song generation services (the “Service”). It also explains the cookies we use and the choices and rights you have.

Short version: we use your information to make your songs, run your account and take payments. We use our own analytics to improve the Service, and you can switch them off (Section 5.1). We use advertising pixels from Meta, TikTok, Google and OpenAI to measure our ads. In the UK, the EEA, Switzerland and Quebec those pixels only run if you allow them. Everywhere else they run by default and you can switch them off at any time with the Cookie settings link at the bottom of this page and in the footer of our website. We only send marketing emails if you have said yes.

1. Who We Are

Melody Box Limited is the controller of your personal information, which means we decide how and why it is used. It is registered in England and Wales under company number 04076024, and its postal address is 31-33,Commercial Road,Poole,Dorset,United Kingdom,BH14 0HU. You can contact us about anything in this policy, including to exercise your rights, at support@melodio.co. The same address reaches our Director, who is responsible for the protection of personal information at Melodio (see Section 11 for Quebec).

2. Information We Collect

2.1 Information You Give Us

• Account information. Your email address and a password when you sign up with email (the password is handled by our authentication provider and stored only in hashed form), or your name, email address and profile picture when you sign in with Google or Facebook. We never receive your Google or Facebook password. You can also add a display name and upload a profile picture.
• Song requests and content. The text you write to describe a song (for example who it is for, the occasion, memories and names), lyrics you write or edit, genre, voice and language choices, and your messages to our Melodio AI assistant. If you paste a web link into Melodio AI, our server fetches that page to read its text.
• Photos. Images you upload as a profile picture, as a style reference for a song's cover art, or as the performer in a music video.
• Payment information. Payments are handled by Stripe on Stripe's own checkout pages. Stripe collects your card details and billing information; we never see or store your full card number or security code. We receive and keep the payment status, amount, currency, what you bought, your email address and a Stripe customer reference. See Stripe's Privacy Policy.
• Choices you make. Your marketing-email choice (with when and where you made it, and which wording you saw), your cookie choice, your product-analytics choice, and your settings.
• Communications. What you send us by email at support@melodio.co or through in-app feedback and ratings.

What you have to give us. To create an account you need an email address (or a Google or Facebook sign-in), and to buy credits you need to give Stripe your payment details; without them we cannot provide those parts of the Service. A song needs a description or lyrics, because that is what the song is made from. Everything else, such as a display name, a profile picture or photos, is optional.

Information about other people. Songs are often about someone else, such as the person receiving a gift. Please include only what the song needs (a first name and a few memories are usually enough) and only share details you are comfortable with them being in a song. Sensitive information. Please do not include health information, religious or political beliefs, or similar sensitive details about yourself or others in a request unless you really want them in the song; we do not ask for them and use anything you include only to create the song you asked for.

2.2 Information Collected Automatically

• Device and connection data. Your IP address, browser type and version, operating system, language settings, the page that referred you, and pages you visit. We use your IP address to work out your country (for prices in your currency, regional availability and which cookie rules apply to you), and we store the country with your account, not the IP address. If you have a subscription, we also use it to work out whether your connection comes from Quebec, so that we can show Quebec residents the online cancel button Quebec law requires (Section 11). Your IP address is kept only in these places: (a) when our free AI tools (the Melodio AI chat and the song-description improver) are used without an account, we keep the IP address with each request to enforce daily limits, and clear it after 30 days; (b) when Advertising is allowed and you start a payment, your IP address and browser user agent are saved with the Stripe checkout session or subscription for advertising measurement (Section 4.3); (c) our authentication provider records the IP address and browser of sign-ins and active sessions to protect your account; and (d) the technical logs of our hosting and authentication providers (Section 9).
• Product analytics. Records of steps you take in the Service, such as typing in the song composer, pressing Create, generating, playing, sharing, downloading or unlocking a song, viewing our prices and starting checkout. See Section 3.1.
• How you found us. The advertising campaign, ad or website that brought you to Melodio, taken from the link you arrived on (UTM tags and ad click IDs) and the referring page. See Sections 4 and 5.
• Cookies and similar technologies. See Section 5.

2.3 Information From Others

• Google and Facebook, if you choose to sign in with them: your name, email address and profile picture.
• Stripe: the outcome of your payment and the email address you gave at checkout.
• Advertising platforms and referrers: ad click IDs and campaign tags added to the link you clicked, and a friend's referral code if you used their invite link.

We do not buy personal information from data brokers.

3. How We Use Information and Our Legal Bases

UK and EU data protection law requires a legal basis for each use of personal information. As a UK company, we apply the UK GDPR and the Data Protection Act 2018; for people in the EEA we also apply the EU GDPR, and for people in Switzerland the Swiss Federal Act on Data Protection.

“Contract” means the use is necessary to provide the Service you signed up for (Article 6(1)(b)). “Legitimate interests” means we have a genuine business reason and have checked that it does not override your interests and rights (Article 6(1)(f)). “Consent” means you have said yes, and you can withdraw it at any time without affecting what happened before (Article 6(1)(a)). “Legal obligation” means the law requires it (Article 6(1)(c)).

3.1 Our Legitimate Interests, Explained

• Security, fraud and abuse prevention. We need to stop people abusing free previews, our free AI tools and referral rewards, protect accounts and keep the Service running. We use the minimum needed (country, account and referral records, IP addresses kept for 30 days in the usage logs of our free AI tools, security logs), and it protects you as much as us.
• Product analytics. We need to know where the Service works and where it doesn't, for example how many people who make a song go on to keep it. We record simple events (a name such as “song played”, a few details such as the song ID, and a time), linked to your account when you are signed in and otherwise to the random melodio_anon_id stored in your browser, which is replaced after 13 months. We also keep an arrivals log of how people reach Melodio from other websites and ads (the channel, campaign, ad, landing page and country, and the ChatGPT ad click ID only when Advertising is allowed). When Advertising is allowed we log this once, when our melodio_attr cookie is set; otherwise we log each arrival from another website while you are not signed in. The arrivals log is not linked to your account or to melodio_anon_id. These records stay in our own database; we do not share them with advertising platforms or sell them, and we delete them after 25 months. You would reasonably expect a service to know how it is used, the impact on you is low, and you can object at any time: switch product analytics off in Section 5.1 (this stops it in that browser and, if you are signed in, for your account on every device where you are signed in), or email us and we will switch it off for your account. We also use Vercel Web Analytics and Speed Insights, provided by our hosting company, which count page views and measure page speed without cookies and without identifying you across days.
• Measuring our own ad spend. When you create an account we record which campaign link brought you to Melodio, even if you have not allowed advertising cookies, so we can see which of our campaigns bring people who use and pay for Melodio. We take it only from the address you arrived on (no cookies, no ad click IDs), keep it in our own database and never send it to advertising platforms. You can object with the analytics switch (Section 5.1).
• Advertising outside the UK, EEA, Switzerland and Quebec. Where local law allows advertising cookies on an opt-out basis, we rely on our interest in knowing which of our ads work, so that we can keep the Service affordable. We do not send the platforms your song requests, lyrics, audio or photos (only the page addresses and titles described in Section 4.1); email addresses are hashed before they are shared; and switching Advertising off in Cookie settings stops it straight away.

3.2 Automated Decisions

Our AI systems create songs and images from what you write, but we do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

4. Advertising

We advertise Melodio on Meta (Facebook and Instagram), TikTok, Google and ChatGPT (OpenAI). To know which ads bring people who actually use and pay for Melodio, we use the following tools. All of them belong to the Advertising category in Cookie settings.

4.1 Advertising Pixels

We place four pieces of code (“pixels” or “tags”) on the Site: the Meta Pixel, the TikTok Pixel, the Google Ads tag (gtag.js) and the OpenAI ChatGPT Ads pixel. When they run, your browser sends the platform: the address and title of the pages you view (on a song or share page, the page title includes the song's title, which our AI writes from your request or which you chose); events such as signing up, starting a song, viewing a song or share page (with the song's ID), viewing prices, starting checkout, unlocking a song, and completing a purchase or subscription (with its value, currency and a transaction reference); technical data such as your IP address and browser; the platform's cookie identifiers (Section 5); and any ad click ID from the link you arrived on.

4.2 Matching With a Hashed Email Address

When you sign up with an email address, and whenever you are signed in, the pixels also send your email address in hashed form, and the Meta, TikTok and OpenAI pixels send your Melodio account ID too. Hashing converts the value in your browser into a one-way code (SHA-256) before it is sent: our own code does this for TikTok and OpenAI, and the Meta and Google tags do it themselves. Hashing means the platform does not receive your email address in readable form, but it can still compare the code with the codes of its own users' email addresses, so if you have an account with that platform it can recognise you. That is its purpose: it lets the platform connect a sign-up or purchase to an ad you saw.

4.3 Server-Side Purchase Reports

Browsers often block pixels, so when you buy a credit pack or the Premium add-on, or start a new subscription (renewals are not reported), our server also reports the purchase directly to Meta (Conversions API), TikTok (Events API) and OpenAI (Conversions API). The report contains the event, value, currency, product and transaction reference, your hashed email address (the one you gave at checkout, or your account email) and hashed account ID, and the advertising identifiers captured when you started checkout: for Meta and TikTok, your IP address, browser user agent and their cookie and click IDs (_fbp, _fbc, _ttp, ttclid); for OpenAI, its click and browser references (__oppref, __obref; if the ChatGPT click cookie has expired, we use the click ID kept in our melodio_attr cookie). To make this possible, we store these identifiers, your IP address and user agent with your Stripe checkout session (and, for a subscription, with the subscription), and we record whether Advertising was allowed when you started checkout. If it was not, none of these identifiers are stored and no report is sent.

4.4 How You Found Us, in Our Own Records

When Advertising is allowed, our melodio_attr cookie remembers for 30 days how you first reached Melodio: the channel (for example a Meta, TikTok, Google or ChatGPT ad, a search engine or another website), the campaign, ad and ad set IDs from the link, and the page you landed on. When you create an account, we copy this into your account record so we can see which campaigns bring people who go on to use and pay for Melodio. This stays in our own database; we do not send it to the advertising platforms, apart from the ChatGPT click ID used as described in Section 4.3. We also record your country and whether you signed up with email, Google or Facebook.

If you have not allowed Advertising, no cookie is set. When you create an account during the same visit, we still record the campaign of the link you arrived on: the channel, campaign, ad and ad set IDs and landing page, read from the address of the page you landed on, which your browser tab holds only while it is open. Ad click IDs are not kept, nothing is stored in your browser, and this is not sent to any advertising platform. If you sign up with Google or Facebook, the same campaign details travel on our own sign-in return address, encrypted so that only we can read them. We do this under our legitimate interest in measuring our own advertising spend (Section 3.1). You can object with the analytics switch in Section 5.1, and we then stop.

4.5 What the Platforms Do and What We Don't Do

• The platforms use this data to report which ads work, to decide who sees our ads, and to build groups of people who visited our Site, for example to show an ad to someone who viewed our prices but did not buy. They may also use it for their own purposes under their own terms and privacy policies.
• Who is responsible for what. For collecting data through the pixels on our Site and sending it to the platform, we and the platform may be joint controllers. The essence of these arrangements is: we are responsible for having a legal basis (including your consent where it is required) and for telling you about the data collection, which is what this policy does; the platform is responsible for what it does with the data once it has received it, including keeping it secure and answering your requests to access or delete the data it holds. You can exercise your rights with us or directly with the platform, and we will pass on requests that concern the platform. For Meta this is set out in its Controller Addendum. Google acts as a separate, independent controller under its Google Ads Controller-Controller Data Protection Terms. TikTok and OpenAI set out the roles in their business terms for their advertising tools; ask us if you would like more information.
• We do not currently upload customer lists (lists of our users' email addresses) to any advertising platform.
• We do not share your song requests, lyrics, audio or photos with advertising platforms. A song page's title, which includes the song's title, is sent with the page views described in Section 4.1.

4.6 Your Advertising Choices

• In the UK (including Jersey, Guernsey, the Isle of Man and Gibraltar), the EEA, Switzerland and Quebec, Advertising is off until you click Accept in our cookie banner or switch it on in Cookie settings. Until then none of the advertising code loads: no pixel scripts, no requests to the platforms, and no advertising cookies.
• Everywhere else, Advertising is on by default. You can switch it off at any time in Cookie settings.
• Changing your mind. Use the Cookie settings link at the bottom of this page and in the footer of our website. When you switch Advertising off, we stop loading the pixels and sending server-side reports, delete the advertising cookies on our domain (every cookie whose name starts with _fb, _tt, ttcsid, ttclid, __op, __ob or _gcl_, plus melodio_attr) and reload the page. Data already sent to a platform is held by that platform; you can manage it in Meta's ad preferences, TikTok's settings, Google's My Ad Center and your ChatGPT account settings. You can also use industry opt-out tools such as youronlinechoices.eu or optout.aboutads.info.

5. Cookies and Similar Technologies

5.1 How We Decide What Runs

Cookies are small text files stored by your browser; “local storage” and “session storage” are similar places in your browser where a site can keep information. We group them as follows:

• Necessary (always on): signing in, payment, language and currency, remembering your cookie and product-analytics choices, referral codes, setting up a new account, and keeping a song draft. The Site cannot work properly without them, so they do not need consent.
• Product analytics (on, based on legitimate interests): our own analytics and the melodio_anon_id identifier (Section 3.1). You can switch it off at any time with the switch below; this sets the melodio_analytics_off cookie, deletes melodio_anon_id from your browser and, if you are signed in, switches it off for your account. You can also email us and we will switch it off for your account.
• Advertising: the pixels, advertising cookies and cookie-based attribution described in Section 4. Off until you allow it in the UK, the EEA, Switzerland and Quebec (and whenever we cannot tell where you are); on by default elsewhere, with an opt-out.

In those consent regions we show a small banner with two equal buttons, Reject and Accept, and a Settings link where you can choose. The banner does not block the Site, nothing is pre-ticked, and scrolling or continuing to browse does not count as consent. We remember your choice for 12 months in the melodio_consent cookie, and you can change it at any time with the Cookie settings link at the bottom of this page and in the footer of our website.

5.2 Cookies

Durations for cookies set by Meta, TikTok, Google and OpenAI are those the platforms publish and may change; the platforms may also set or read cookies on their own domains (for example facebook.com or google.com) under their own policies. Stripe, Google and Facebook set their own cookies on their own pages when you pay or sign in there.

5.3 Local and Session Storage

The advertising platforms' code may also keep similar information in your browser's storage when Advertising is allowed.

5.4 Browser Controls

You can also block or delete cookies and site storage in your browser settings; blocking necessary cookies will stop sign-in from working. Our Site does not currently respond to browser “Do Not Track” or Global Privacy Control signals; please use Cookie settings instead. More about cookies: allaboutcookies.org.

6. Emails

• Service emails about payments, your credit balance, subscription renewals and account security are part of providing the Service and are sent regardless of your marketing choice. Credit-balance notices include a link to turn them off.
• Marketing emails (song ideas, occasion reminders such as Mother's Day or Christmas, and Melodio news) are sent only if you say yes: by ticking the unticked box at sign-up, accepting an offer in the app, or switching them on in Settings. We keep a record of when and where you said yes or no and which wording you saw. We tailor these emails to how you use Melodio (for example whether you have made or unlocked a song, bought credits, or have credits left) and to your country's occasions.
• Stopping them. Every marketing email has a one-click unsubscribe link, and you can switch marketing emails off in Settings at any time. Your right to object to direct marketing is absolute: once you opt out, we stop.
• We keep a log of the emails we send you. Emails are delivered by Resend on our behalf.

7. Who We Share Information With

We share personal information only as described here.

7.1 Service Providers Acting for Us

These providers process personal information on our instructions to run the Service:

• Supabase — database and account authentication, including sign-in and password-reset emails.
• Vercel — website hosting, plus cookieless page statistics and speed measurement.
• Cloudflare (R2) — storage of songs, cover art, profile pictures and uploaded photos.
• Stripe — payments, invoices and subscription management, including the advertising identifiers stored with checkout sessions and subscriptions when Advertising is allowed (Section 4.3).
• Resend — sending our service and marketing emails.
• Anthropic — AI models that write lyrics and titles, suggest improvements to your song request, write the image instructions for cover art and power the Melodio AI assistant. Receives your song requests, lyrics and assistant messages, and the text of any web page you link in Melodio AI. It does not receive your photos.
• KIE.ai — access to the third-party AI models that generate your songs (Suno) and your cover art and performer images (OpenAI's GPT Image). KIE.ai and those model providers receive your song requests, lyrics, style choices and any photo you use. Some generated audio and images are played or shown to you straight from the model provider's servers (for example Suno's), which then receive your IP address like any website you load content from.
• WaveSpeed AI — music video generation. Receives the song audio, the style you pick and any performer photo you use.
• OpenAI — speech-to-text (Whisper) on generated songs to time the lyrics to the music.

7.2 Others

• Advertising platforms — Meta Platforms, TikTok, Google and OpenAI, as described in Section 4, when Advertising is allowed.
• Google and Meta as sign-in providers, if you choose to sign in with them.
• People you share songs with. Anyone who has a song's share link can play it and see its title, lyrics, genres and cover art, and your display name if you have one. Your display name starts as the name on your Google or Facebook account or, if you signed up with email, the part of your email address before the @; you can change or remove it in Settings. The share link does not show the request you wrote to create the song.
• There's An AI For That. Our home page and footer show a badge image loaded from theresanaiforthat.com, so your browser sends that site your IP address and browser details when the page loads, as with any image from another website.
• Professional advisers (lawyers, accountants), and authorities when the law requires it or to protect rights, safety and property.
• Business transfers. If Melodio is merged, acquired or sold, information may pass to the new owner, who must respect this policy. We will tell you before that happens.

We do not sell personal information for money. Letting advertising platforms collect data through our pixels may count as “selling” or “sharing” under some US state laws; see Section 12.

8. International Transfers

We are based in the United Kingdom, and our providers process information in other countries, including the United States and other countries where they or their sub-processors operate. Transfers from the EEA and Switzerland to us in the UK are covered by adequacy decisions recognising the UK. When personal information goes to a country without an adequacy decision, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses and the UK International Data Transfer Agreement or Addendum, usually built into the provider's data processing terms, or, where a provider is certified under it, the EU-U.S. Data Privacy Framework and its UK Extension. You can ask us for more information about these safeguards. If you are in Canada or Quebec, your information will be stored and processed outside your province and country, and may be accessible to courts and authorities there.

9. How Long We Keep Information

• Account data: for as long as your account exists, then deleted as described in Section 14, except for what we must keep below.
• Songs, lyrics, requests, photos, videos and assistant conversations: until you delete them or your account. When you delete a Melodio AI conversation, it is removed from our database; we keep only the time of each message you sent, for the daily message limit (below). When you delete a song, a performer photo or a music video in the app, it disappears from your account straight away (and a song's share link stops working), but we keep the underlying files, and for songs and performer photos the underlying record, until your account is deleted, unless you ask us to erase them sooner.
• Payment and transaction records, including what is stored with Stripe checkout sessions and subscriptions (Section 4.3): for six years after the financial year they relate to, as UK tax and company law requires.
• Marketing consent and unsubscribe records, and the log of emails we sent you: while your account exists; they are deleted together with your account.
• Product analytics events and the arrivals log: 25 months, then deleted automatically. Product-analytics events linked to your account are deleted earlier if your account is deleted.
• Records of subscription cancellations made with the Quebec online cancel button, and of attempts that did not go through (Section 11): while your account exists; they are not deleted after 25 months like product analytics. The cancellation is also recorded with your subscription at Stripe and kept with the payment and transaction records.
• IP addresses in the usage logs of our free AI tools: 30 days, then removed automatically.
• The time of each message you send to Melodio AI (without its text), which we use to apply the daily message limit: 30 days, then deleted automatically, even if you delete the conversation sooner.
• How you found us (Section 4.4): with your account record.
• Support messages and feedback: as long as needed to deal with them and any follow-up.
• Technical and security logs kept by our hosting and authentication providers, including records of sign-ins and sessions with IP addresses: for a limited period, and no longer than 12 months; session records end when you sign out or the session expires.
• Cookies: see the durations in Section 5.
• Data held by advertising platforms: under their own retention policies.

10. Your Rights

10.1 UK, EEA and Switzerland

• Access — get a copy of the personal information we hold about you.
• Rectification — have inaccurate or incomplete information corrected.
• Erasure — have your information deleted, unless we must keep it (for example tax records).
• Restriction — ask us to limit how we use your information in certain circumstances.
• Portability — receive information you gave us in a structured, machine-readable format, or have it sent to another company.
• Objection — object to uses based on legitimate interests, including product analytics (you can also use the switch in Section 5.1) and advertising measurement (Cookie settings); we will stop unless we have compelling grounds. Your objection to direct marketing is absolute: we will always stop.
• Withdrawing consent — for marketing emails (Settings or the unsubscribe link) and for advertising cookies (Cookie settings), at any time, without affecting anything done before.

10.2 How to Exercise Your Rights

Email support@melodio.co from the address linked to your account, or tell us which address it is. We may ask for information to confirm your identity. Using your rights is free. We reply within one month; if a request is complex we may extend this by up to two further months and will tell you why.

10.3 Complaints

Please contact us first so we can try to fix the problem. You also have the right to complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, the authority in the country where you live or work, for example the AEPD in Spain (aepd.es) or the CNIL in France (cnil.fr) (full list at edpb.europa.eu); in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

11. Canada and Quebec

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies, and in Quebec, the Act respecting the protection of personal information in the private sector (as amended by Law 25). Marketing emails are sent only with your express consent, as Canada's Anti-Spam Legislation (CASL) requires.

• Person in charge of the protection of personal information. Our person in charge of the protection of personal information is the Director of Melody Box Limited, the person with the highest authority in our company. You can reach them at support@melodio.co, in French or English.
• Right to be informed. This policy tells you what we collect, why, how (directly from you, from your device through cookies and similar technologies, and from the sources in Section 2.3), who receives it (Section 7), and that it is processed outside Quebec and Canada (Section 8).
• Advertising tracking is off by default in Quebec. The advertising pixels and cookies in Sections 4 and 5 can identify and profile you, so for people in Quebec they stay off unless you switch them on with Accept or in Cookie settings. You can switch them off again at any time. Our own product analytics (Section 3.1) are on by default and can be switched off at any time in Section 5.1.
• Your rights. You can ask to access your information, have it corrected, receive information you gave us in a structured, commonly used technological format, withdraw your consent, and, where the law allows, ask us to stop disseminating your information or to de-index a link connected to your name. Contact the address above.
• Cancelling a subscription online. Quebec law requires a button to cancel a subscription online; subscribers in Quebec find it in Settings. To show it only to people in Quebec, when you open your account settings or plan page we check whether your connection comes from Quebec (from your IP address) or the billing address of the card that pays for your subscription (country, province and postal code, held by Stripe) is in Quebec. If you subscribe, or open those pages, from a connection in Quebec, we note “Quebec” on your subscription at Stripe, so the button stays available when you connect from elsewhere. When you use the button, we keep a record of the request with your account (when it was received, which subscription, when it ends and which of these checks applied), and the cancellation is also recorded with your subscription at Stripe (Section 9).
• Outside Quebec, in the rest of Canada, advertising cookies are on by default and you can switch them off at any time in Cookie settings.
• Complaints. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

12. United States (Including California)

This section applies to residents of California and other US states with comprehensive privacy laws, to the extent those laws apply to Melodio.

• What we collect (categories used by California law): identifiers (name, email address, account ID, IP address, cookie and advertising IDs); commercial information (purchases and credits); internet activity (pages and features used, how you found us); approximate location (country, and for connections from Canada the province, from your IP address); audio and visual information (photos you upload, songs you create); and inferences the advertising platforms may draw. We collect it from the sources in Section 2 and use it for the purposes in Section 3, and keep it for the periods in Section 9.
• “Sharing” for advertising. We do not sell personal information for money. But when Advertising is on, Meta, TikTok, Google and OpenAI collect identifiers, internet activity and purchase information through our pixels and server-side reports for cross-context behavioural advertising (Section 4). California law treats this as “sharing”, and it may be considered a “sale” or “targeted advertising” under some state laws. We do not knowingly sell or share the information of anyone under 16.
• Opt out of this sharing at any time with the Cookie settings link at the bottom of this page and in the footer of our website (switch Advertising off). The choice applies to the browser you make it in, so please make it in each browser you use. Our Site does not currently respond to Global Privacy Control signals.
• Your other rights. You can ask to know what personal information we collect, use and disclose; to get a copy; to delete it; and to correct it. We only use sensitive information (such as your account login) to provide the Service. We will not discriminate against you for using your rights. You can use an authorised agent; we may ask them for proof of authority and ask you to confirm your identity. To make a request, email support@melodio.co. If we decline your request, you can appeal by replying to our decision; we will answer the appeal in writing.

13. Australia

If you are in Australia, the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) give you the right to access the personal information we hold about you, to ask us to correct inaccurate, out-of-date, incomplete or misleading information, and to complain about a breach of the APPs. Your personal information may be disclosed to recipients outside Australia, including in the United Kingdom, the United States and the other countries described in Section 8; we take reasonable steps to ensure they handle it consistently with the APPs. To exercise your rights, contact us at support@melodio.co. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

14. Account Deletion

You may request deletion of your account and all associated data by contacting us at support@melodio.co. Upon receiving your request:

1. We will initiate the deletion process within 14 days.
2. You will have a 14-day window from the initiation date to cancel the deletion request.
3. If no cancellation is received, your account and all associated data (including generated songs) will be permanently deleted within 30 days from the original request date.

Certain data may be retained where required by law (for example transaction records for tax compliance), as described in Section 9. Data already sent to advertising platforms is held by them; see Section 4.6. Your marketing-consent records are deleted with your account.

15. Data Security

We use appropriate technical and organisational measures to protect your personal information, including encryption in transit (TLS), passwords stored only in hashed form by our authentication provider, time-limited signed links for song downloads, digitally signed records of marketing consent, and access controls that limit our own staff's access to what their work requires. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach puts your rights at risk, we will tell you and the relevant authority as the law requires.

16. Children

Melodio is only for people aged 18 or over, as our Terms of Use say. Some features help adults make songs for children; the account holder must still be an adult, and please include only the details a song needs (such as a first name). We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us at support@melodio.co and we will delete it.

17. Third-Party Links

The Site may link to other websites and services, such as Stripe's checkout or the platforms where you share a song. Their privacy practices are governed by their own policies, which we encourage you to read.

18. Changes to This Privacy Policy

We will update this policy when our practices, technology or the law change, and change the “Last Updated” date at the top. If a change is significant, we will tell you by email or on the Site before it takes effect, and where the law requires, we will ask for your consent again.

19. Contact Us

If you have any questions, concerns or requests about this Privacy Policy or our data practices, please contact us:

Melody Box Limited
Registered in England and Wales, company number 04076024
Postal address: 31-33,Commercial Road,Poole,Dorset,United Kingdom,BH14 0HU
Email: support@melodio.co
Website: https://melodio.co