Legal
Cookie Policy
Last updated: October 4, 2026
This document is available in Italian and English. In case of any discrepancy between the two versions, the Italian version prevails.
Data Controller
Sole Shareholder Company
45100 Rovigo (RO), Italy
1. What Are Cookies
Cookies are small text files stored on your device (computer, tablet, or smartphone) when you visit a website. Similar technologies, such as the browser's local storage, work in a comparable way and are covered by this policy as well.
This Cookie Policy applies to the website melodyc.com and to the Melodyc web application (together, the "Service") operated by SkyClouds SRLs ("Melodyc", "we", "us", or "our"). It is drafted in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the ePrivacy Directive (2002/58/EC), the Italian Privacy Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018), and the Italian Data Protection Authority's Guidelines on cookies and other tracking tools (Decision no. 231 of June 10, 2021). It constitutes the information notice required by Articles 13 and 14 GDPR for the data processed through cookies and similar technologies.
2. Who Is Responsible for Your Data
The data controller for the Service is SkyClouds SRLs, whose details are listed above.
We have not appointed a Data Protection Officer (DPO), as this is not required under Article 37 GDPR for our processing activities. For any privacy request you can contact us directly at info@skyclouds.co.
3. Legal Basis for Cookie Usage
Pursuant to Article 122 of the Italian Privacy Code and the Guidelines mentioned above, we use cookies on the following legal bases:
- Strictly necessary cookies: no consent is required (Article 122(1) of the Italian Privacy Code). They are essential to deliver the Service you explicitly requested (for example, keeping you signed in) and cannot be disabled. The related processing is based on the performance of a contract (Art. 6(1)(b) GDPR) and on our legitimate interest in keeping the Service secure and working (Art. 6(1)(f) GDPR).
- Analytics cookies: prior, informed, and specific consent is required (Art. 6(1)(a) GDPR). They are only activated after you accept them through our cookie banner.
- Marketing cookies: prior, informed, and specific consent is required (Art. 6(1)(a) GDPR). They are only activated after you accept them through our cookie banner.
4. Strictly Necessary Cookies
These cookies enable core features such as authentication, account security, and remembering your cookie choices. When the Service is served over HTTPS, authentication cookie names may carry the __Secure- prefix. All of them are first-party cookies set by Melodyc on its own domain and are never used for profiling.
| Cookie name | Provider | Purpose | Duration |
|---|---|---|---|
| better-auth.session_token | Melodyc (Better Auth) | Keeps you securely signed in to your account | 7 days, renewed while you use the Service |
| better-auth.dont_remember | Melodyc (Better Auth) | Ends your session when the browser closes if you did not select "remember me" | Session |
| cookie_consent_id | Melodyc | Links your cookie preferences to the record that proves your consent | 12 months |
| sidebar_state | Melodyc | Remembers whether the dashboard sidebar is expanded or collapsed | 7 days |
| legal_lang | Melodyc | Remembers the language (Italian or English) you chose for the legal pages | 12 months |
5. Local Storage
We also store a few technical values in your browser's local storage. They are never sent to third parties and are used only to make the Service work as you expect.
| Key | Provider | Purpose | Duration |
|---|---|---|---|
| melodyc-cookie-consent | Melodyc | Stores your cookie preferences so the banner is not shown again | Until you clear it, renewed every 12 months |
| theme | Melodyc | Remembers your light or dark mode preference | Until you clear it |
| melodyc-demo-generation | Melodyc | Lets you get back the song generated with the free public demo | Until you clear it |
6. Analytics Cookies
Analytics tools help us understand how visitors use the Service so we can improve it. With your consent to the Analytics category, we load Vercel Web Analytics (pages visited, referrer, country, device and browser type) and Vercel Speed Insights (page loading performance). Both are provided by Vercel Inc. and work without cookies: they do not store identifiers on your device and do not track you across other websites. Data is aggregated and the request-based identifier is discarded within 24 hours. If you do not give consent, or withdraw it, these tools are not loaded.
7. Marketing Cookies
Marketing cookies are used to track visitors across websites and show content relevant to their interests. At the moment, Melodyc does not use any marketing or profiling cookies. If we introduce them, this policy will be updated and your consent will be requested before activation.
8. Third-Party Services and Data Transfers
The Service relies on the following providers. Some of them process data outside the European Economic Area (EEA) or may set their own cookies on their own domains (for example, during checkout).
| Service | Purpose | Data location | Legal basis |
|---|---|---|---|
| Vercel | Website hosting and content delivery | Global CDN, United States (DPF) | Legitimate interest |
| Vercel Web Analytics and Speed Insights | Cookieless visit statistics and page performance | United States (DPF) | Consent |
| Neon (PostgreSQL) | Database for accounts, songs, credits, and consent records | EU (Frankfurt) | Contract performance / Legal obligation |
| Amazon Web Services (S3) | Storage and delivery of generated audio and cover images | EU (Stockholm) | Contract performance |
| Modal | GPU cloud infrastructure that runs the AI music models | United States (SCC) | Contract performance |
| Inngest | Background processing of song generation jobs | United States (SCC) | Contract performance |
| GitHub | Profile pictures of the project contributors shown in the footer | United States (DPF) | Legitimate interest |
Where data is transferred outside the EEA, we rely on appropriate safeguards: adequacy decisions under Article 45 GDPR (such as the EU-US Data Privacy Framework, "DPF") or Standard Contractual Clauses ("SCC") under Article 46(2)(c) GDPR. You can request a copy of these safeguards by contacting us.
Except where stated otherwise, these providers act as data processors on our behalf under a data processing agreement pursuant to Article 28 GDPR, and may only use the data to provide their services to us. GitHub serves the contributor images as an independent controller and may receive your IP address when your browser loads them.
9. Is Consent Mandatory?
No. Strictly necessary cookies are required for the Service to work and are therefore always active. Consent to analytics and marketing cookies is entirely optional: if you refuse it, or close the banner without making a choice, only strictly necessary cookies are used and you can keep using every feature of the Service without any limitation.
We do not use cookie walls, scrolling or continued browsing are never treated as consent, and no non-essential cookie is set before you make your choice.
10. How to Manage Your Cookie Preferences
When you first visit the Service, a banner lets you accept all cookies, reject all non-essential cookies, or choose them by category. Accepting and rejecting are equally easy. Closing the banner with the "X" button keeps the default settings, which means only strictly necessary cookies are used.
Your choice is remembered for 12 months. We will show the banner again only after this period, if this policy changes in a way that affects your consent, or if you clear your browser data.
You can change or withdraw your consent at any time by clicking the Cookies tab on the left side of the page. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out before.
You can also block or delete cookies through your browser settings. Disabling strictly necessary cookies may prevent parts of the Service, such as signing in, from working correctly.
11. Proof of Consent
To demonstrate that consent was given, as required by Article 7(1) GDPR, we keep a record of your choice containing only: a random identifier (also stored in the cookie_consent_id cookie), the categories you accepted or rejected, the version of this policy, the date and time of your choice, and, if you are signed in, the link to your account. We do not store your IP address or any other identifier for this purpose.
12. Your Rights Under the GDPR
Under the GDPR and the Italian Privacy Code, you have the following rights regarding personal data processed through cookies:
- Right of access (Art. 15): obtain confirmation and a copy of your data.
- Right to rectification (Art. 16): correct inaccurate data.
- Right to erasure (Art. 17): request the deletion of your data.
- Right to restriction of processing (Art. 18): limit how we process your data.
- Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
- Right to object (Art. 21): object to processing based on legitimate interest.
- Right to withdraw consent (Art. 7(3)): at any time, without affecting prior processing.
- Right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) at www.garanteprivacy.it, or with the supervisory authority of the EU Member State where you live, work, or where the alleged infringement took place (Art. 77).
To exercise these rights, write to info@skyclouds.co. Requests are free of charge and we will reply without undue delay and in any case within one month of receipt, a period that may be extended by two further months for complex requests, in which case we will inform you (Art. 12(3) GDPR). We may ask you to verify your identity before fulfilling the request.
No decision based solely on automated processing, including profiling, that produces legal or similarly significant effects on you is taken through the cookies described in this policy (Art. 22 GDPR).
13. Data Retention
Your cookie preferences and the related consent record are kept for a maximum of 12 months from the date of your choice, after which we will ask you to confirm them again. Session cookies are deleted when you close your browser, and persistent cookies expire as indicated in the tables above.
14. Changes to This Policy
We may update this Cookie Policy to reflect changes in our practices, technology, or legal requirements. The date at the top of this page shows when it was last updated. If a change affects the cookies that require your consent, we will ask for your consent again.
15. Contact Us
For any questions about this Cookie Policy or how we handle your data, contact us:
- Email: info@skyclouds.co
- PEC: skyclouds@pec.it
- More details: Privacy Policy