MyMelos Privacy Policy

BitDynamic (Shenzhen) Technology Co., Ltd. builds and operates MyMelos, an application that uses artificial intelligence to compose songs. This Policy describes the personal information we gather, why we gather it, how we handle it, who we may pass it to, how long we keep it, and the choices available to you.

It applies whenever you install the MyMelos app, sign in, visit our website, use the web console, take part in MyMelos Chat, generate or download a song, buy a subscription, or contact our support team. For the purposes of data protection law, BitDynamic (Shenzhen) Technology Co., Ltd. acts as the data controller of the information covered here.

We rely on your information only where we have a lawful reason to do so. Each purpose below is paired with the reason that supports it.

• Running the service — creating accounts, verifying sign-ins, processing prompts and media, producing songs, saving projects, syncing devices, managing subscriptions, handling checkout and payments, issuing refunds and invoices, and answering support requests. Basis: performing our contract with you, or steps you ask us to take before a contract.
• Operating AI and voice features — completing the generation, editing, remix, or voice-cloning requests you start. Basis: performing our contract, and explicit consent where the data is sensitive or biometric.
• Safety and fraud prevention — detecting fake accounts, bots, payment fraud, chargeback risk, unusual requests, policy-breaking content, infringement risk, risks to minors, and attacks. Basis: our legitimate interests, our contract with you, and legal obligations.
• Age-appropriate use and minor protection — where we later adopt platform age signals, using age bands and guardian-consent status to adjust access to posting, social features, purchases, voice cloning, adult content, and external sharing. We will not use those signals for cross-context advertising or profiling unrelated to age-appropriate experiences and compliance. Basis: our contract with you, legitimate interests, legal obligations, and consent where required.
• Reviewing content — checking material that may breach our Terms or involve child-safety risks, non-consensual content, infringement, fraud, hate, violence, or other high-risk activity. Basis: our legitimate interests, legal obligations, and the protection of important public interests.
• Improving the product and our models — within the limits set out in Section 4, using public content, aggregated or anonymised data, feedback, and data you authorise us to use. Basis: our legitimate interests, consent, or another lawful ground.
• Notices, marketing, and web analytics — sending service and security messages, subscription reminders, policy updates, and, where allowed, promotions or surveys, and using cookies for analytics and attribution. You can opt out of marketing through your email settings, in-app controls, or cookie preferences. Basis: our contract, legitimate interests, consent, and, for some messages, your prior request.
• Rights protection and legal requests — handling appeals, law-enforcement requests, regulatory enquiries, disputes, claims, audits, and our own defence. Basis: legal obligations and legitimate interests.
• Copyright matters — receiving and assessing notices, counter-notices, and infringement disputes, deciding repeat-infringer questions, and keeping the records the law requires. Basis: legal obligations, legitimate interests, and the protection of rights holders and the platform.

We may learn from material that is already public — published songs, public remixes, public settings, general prompts, feedback, and aggregated or anonymised data — to test, evaluate, and improve our models and safety systems.

We will not feed the following into public or third-party foundation models unless you separately and clearly agree, or the law otherwise requires it:

1. Private projects, uploads, prompts, audio, or images you have kept private;
2. Original voice recordings, voiceprints, personal voice models, and other biometric data used for cloning;
3. Material that plainly contains identity documents, financial or health information, children's data, intimate content, or other sensitive personal information;
4. Anything from a minor's account; and
5. Data we are barred from using by law, or which you have objected to, withdrawn consent for, or asked us to delete.

To keep data inside its permitted use, we apply access limits, classification, review rules, permission separation, logging, de-identification, aggregation, and retention controls.

Voice cloning and personal voice models work by analysing recordings to build a model of how you sound. In some places, the resulting voiceprints count as sensitive or biometric information, so we treat them with extra care.

We only begin once you switch the feature on, complete the authorisation steps, and accept the notice shown at the time. We use the data solely to:

• Create, run, maintain, and improve the personal voice model in your account;
• Check sample quality, authorisation, and the risk of misuse;
• Spot cloning without consent, impersonation, infringement, and unlawful content; and
• Meet legal duties, handle complaints, and protect users and the platform.

Unless you separately and clearly agree, we do not sell, rent, trade, or otherwise profit separately from your voiceprint or biometric data, and we do not use your original recordings or personal voiceprints to train public foundation models. When you close your account, delete the voice model, or withdraw consent — or when the retention period required by law runs out — we remove or anonymise the data, subject to the limited retention described in Section 8.

We do not sell your personal data, your media files, or your biometric data to advertisers, data brokers, or marketing networks. We share information only in these situations:

• Suppliers who help us run the service — cloud storage and computing, content delivery, databases, crash and log analytics, customer support, email, cookie management, web analytics, payment handling, anti-fraud, and content safety. They act on our instructions and are bound by confidentiality and security duties.
• AI Providers — Suno, Inc., Anthropic PBC, OpenAI, LLC, and other providers we select, which handle the text, audio, images, or settings needed to produce your songs, vocals, and lyrics.
• Payment platforms and app stores — Apple, Google, Stripe, PayPal, and others that process payments, refunds, chargebacks, and accounting records in their own right. We receive only the transaction and subscription details we need for service, tax, refund, and anti-fraud purposes.
• Sharing you start — when you publish a song, create a share link, join community features, allow remixing, or post to another platform, the song, your username, public settings, and related activity may be seen, saved, or reposted by others.
• Legal and rights reasons — when we receive a valid legal request, court order, subpoena, regulatory demand, child-safety report, or fraud or security investigation, or when disclosure is needed to protect the lawful interests of users, the public, rights holders, or the platform. We disclose only what is necessary.
• Business changes — if we are involved in a merger, acquisition, financing, reorganisation, asset sale, insolvency, or similar event, your information may move with the relevant assets, but the recipient stays bound by this Policy or equivalent protections.

We are based in Shenzhen, China, and our service relies on cloud providers, vendors, and teams in other countries and regions. If you use MyMelos from outside China, your information may be transferred to, stored in, or processed in places other than where you live.

Where the law requires it, we put safeguards in place for these transfers — such as data processing agreements, standard contractual clauses, transfer risk assessments, limited access rights, and technical security measures.

We keep personal data only as long as it is needed for the purposes in this Policy, or longer where the law, a dispute, security, anti-fraud, accounting, audit, minor-protection, or rights-protection need requires it. In general:

• Account details stay while your account is open and are usually deleted or anonymised from live systems within 30 business days of closure, unless a legal or safety reason requires limited retention.
• Prompts, uploads, and songs stay while your account is open or while you keep the project. Once you delete a song or close your account, they are usually removed or anonymised within 30 business days. Content already posted publicly, shared, remixed, or saved by others may not be fully retrievable.
• Voice data and personal voice models stay while the feature is on and your account is open, and are usually removed or anonymised within 30 business days of deleting the model, withdrawing consent, or closing the account, unless a legal, complaint, dispute, safety, or audit reason requires limited retention.
• Payment and accounting records stay for as long as tax, accounting, anti-fraud, app-store, Stripe, and PayPal rules require.
• Cookies and web logs stay as long as needed for sign-in, security, checkout, or preferences, with retention for non-essential cookies described in our cookie tool, your browser, or the relevant third-party notices.
• Security and anti-fraud records stay as long as needed to keep the platform secure and investigate misuse.
• Support, complaint, and legal records stay as long as needed to handle requests, disputes, defences, and legal duties.
• Backups are cleared, overwritten, or anonymised during the normal rotation cycle.
• Inputs sent to AI Providers are kept by them only as long as their processing needs, then cleared, unless a legal, regulatory, security, abuse-prevention, audit, or dispute reason requires limited retention.

You can delete some content inside the app, or write to service@bitdynamic.co to close your account, erase personal data, or withdraw consent. Once we confirm who you are, we handle the request as the law requires.

Depending on where you live, you may be able to:

• Ask what personal data we hold about you;
• Have incorrect or incomplete data corrected;
• Have personal data erased;
• Restrict or object to particular uses;
• Receive a copy of your data in a common, machine-readable format;
• Withdraw consent you previously gave;
• Opt out of sale, sharing, targeted advertising, profiling, or non-essential cookies where the law grants that choice;
• Appeal a decision we make about an automated process or a privacy request; and
• Complain to a data protection authority.

Send requests to service@bitdynamic.co. We may ask you to confirm your identity to protect your account, and if someone else is writing on your behalf, we may ask for proof that they are authorised.

MyMelos is not meant for children under 13, or under the higher minimum age set by local law, and we do not knowingly collect their personal data. If we find out, or are reliably told, that a child below the applicable age created an account or submitted personal data without proper consent, we take reasonable steps to delete the data and close the account.

Parents and guardians who believe a child used MyMelos without authorisation, or uploaded a photo, a recording, contact details, school information, or an identity document, can reach us at service@bitdynamic.co.

Accounts held by minors may be limited in public posting, direct messaging, social features, purchases, voice cloning, adult content, and external sharing, and we may require guardian consent or another reasonable check.

If we later adopt platform age signals, we may use the age bands, age categories, guardian consent, revoked approvals, or significant-update acknowledgements that Google, Apple, or other platforms return to trigger age-appropriate limits or consent steps. If those signals are unavailable or not enough, we may ask you or your guardian for another reasonable form of age or consent verification.

We use reasonable technical and organisational safeguards for personal data, including access controls, protected transmission and storage, separated permissions, log auditing, vulnerability fixes, anti-fraud checks, content-safety reviews, and vendor oversight. That said, no online service, cloud platform, or storage system can be guaranteed completely secure. Please keep your sign-in details safe and let us know promptly if you notice anything unusual.

We may revise this Policy from time to time. If a change materially affects the kinds of data we handle, the reasons we use it, cookies, third-party payments, AI Providers, how AI models are trained, voice cloning, biometric data, protections for minors, platform age signals, cross-border transfers, or your rights, we will tell you through an in-app message, a notice, an email, an app-store update note, or another reasonable and lawful method.

For questions about this Policy or about how we handle personal data, cookies, third-party payments, voice cloning, biometric data, protections for minors, AI training, or account deletion, write to:

© 2026 BitDynamic (Shenzhen) Technology Co., Ltd. All rights reserved.