GDPR compliance

• Access & portability — download all your data as JSON from your Privacy controls.
• Rectification — edit your profile and lyrics anytime.
• Erasure (right to be forgotten) — one-click account deletion from Privacy controls. Completed within 30 days.
• Restriction & objection — email privacy@songcraft.app.
• Withdraw consent — manage cookie consent via the banner footer.
• Lodge a complaint — with your local supervisory authority.

We process personal data under: contract performance (running the studio you signed up for), legitimate interests (security, fraud prevention), and consent (analytics & marketing cookies, if accepted).

• Account: email, display name, OAuth profile (if you sign in with Google).
• Songs: lyrics, song maps, AI chat transcripts, Suno preset choices — stored under row-level security.
• Billing: payment provider IDs and amounts (we never see card numbers).
• Telemetry: minimal anonymous logs for security & uptime.

Enterprise customers can request our DPA at privacy@songcraft.app. See our DPA summary.

Our infrastructure runs in EU- and US-located data centres provided by Supabase and Cloudflare. Cross-border transfers rely on Standard Contractual Clauses (SCCs).

• Supabase — database & auth (EU/US).
• Cloudflare — edge runtime & CDN (global).
• Lovable AI Gateway — proxied AI inference (Google & OpenAI).
• Razorpay / Paddle — payment processing.

For all GDPR matters: privacy@songcraft.app.