Privacy Policy

Welcome to Melodyc ("we", "our", or "us"). This Privacy Policy explains how SkyClouds SRLs collects, uses, shares, and protects your personal data when you visit melodyc.com and use the Melodyc AI music generation platform, including the free public demo (together, the "Service").

This policy is provided pursuant to Articles 13 and 14 of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and complies with the Italian Privacy Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018) and the decisions of the Italian Data Protection Authority (Garante per la protezione dei dati personali).

The data controller is SkyClouds SRLs, whose details are listed above. You can contact us about anything related to your personal data at info@skyclouds.co or by certified email (PEC) at skyclouds@pec.it.

We have not appointed a Data Protection Officer (DPO), as this is not required under Article 37 GDPR for our processing activities.

We collect the personal data you provide to us and some data that is generated automatically when you use the Service. We only collect what is needed for the purposes described in this policy.

3.1 Information You Provide

• Account information: name, email address, and password when you register, together with the date, time, and version of the Terms and Privacy Policy you accepted. Passwords are never stored in plain text: only a secure cryptographic hash is kept. You may also choose a public username and upload a profile picture from your account settings. Profile pictures are cropped, resized, and stored in our private cloud storage.
• Creative content: the song descriptions, prompts, lyrics, style tags, titles, and generation settings you submit, and the songs and cover images generated from them.
• Published content and public profile: when you choose to publish a song, its title, audio, cover image, categories, and your name, username, and profile picture become visible to other signed-in Melodyc users in Discover, in the player, and on your public profile page (/user/your-username), which lists your published songs. The generation prompt may be used to make the song searchable. You can unpublish a song, change your username, or remove your profile picture at any time.
• Free demo prompts: the description and options you submit when using the public demo without an account.
• Communications: the content of the emails you send us, for example to request support or exercise your rights.
• Cookie preferences: your consent choices, as described in our Cookie Policy.

3.2 Information Collected Automatically

• Session data: session identifiers, sign-in time, IP address, and browser user agent associated with your active sessions, used to keep you signed in and protect your account.
• Usage data: your credit balance, the likes you give, the creators you follow and who follows you, the listen count of published songs, and the in-app notifications generated by this activity (for example, who liked your song or started following you).
• Demo abuse prevention: to limit the free demo to one generation per visitor per day, we compute a one-way cryptographic hash of your IP address and browser user agent combined with the current date. We do not store your IP address in clear text for this purpose.
• Technical logs: our hosting provider automatically records technical information about requests (such as IP address, date and time, requested page, and browser type) to deliver the Service and keep it secure.
• Analytics: only if you consent to the Analytics category in the cookie banner, we use Vercel Web Analytics and Vercel Speed Insights to measure visits and page performance in aggregate (pages visited, referrer, country, device and browser type, loading times). These tools do not use cookies and do not track you across other websites.

3.3 AI-Processed Data

• Music generation: your prompts and lyrics are processed by open-source AI models (ACE-Step for music, Qwen2 for lyrics, style tags, titles, categories, and cover art descriptions, and FLUX.1-schnell for cover images) that we run on our own dedicated GPU infrastructure hosted by Modal.
• No third-party AI providers: your content is not sent to external AI services such as OpenAI or Google, and we do not use your prompts, lyrics, or songs to train AI models.
• Prompt cache: to reduce generation time, the text produced by the language model for a given prompt may be temporarily cached on the same GPU infrastructure. The cache does not contain your name, email, or account identifier.

• Service delivery: to create and manage your account, generate songs, titles, and cover images, store your library, provide downloads in multiple audio formats, show your public profile, and let you publish and discover music.
• Free demo: to generate a demo song without an account and prevent abuse of the free quota.
• Credits: to manage your free credit balance and any manual top-ups you request.
• Account emails: to verify your email address, welcome you once your account is confirmed, reset your password, and send service notifications (song ready, generation failed, new follower). You can turn notification emails on or off in your notification settings or with the unsubscribe link in every notification. Verification and password reset emails cannot be disabled because they are required for account security.
• Security: to authenticate you, protect accounts from unauthorized access, prevent fraud and abuse, and keep the Service available.
• Support: to answer your questions and requests.
• Legal compliance: to meet our legal, tax, and accounting obligations and to establish, exercise, or defend legal claims.

We do not sell your personal data, we do not use it for advertising, and we do not perform profiling.

Where we rely on legitimate interest, we have balanced it against your rights and freedoms. You can object to this processing at any time as described in Section 11.

Providing your name, email address, and password is necessary to create an account: without them we cannot provide the Service. Your prompts and lyrics are necessary to generate music. All other data is optional, and refusing optional cookies never limits your use of the Service.

We share personal data only with the providers needed to run the Service. Unless stated otherwise, they act as data processors on our behalf under a data processing agreement pursuant to Article 28 GDPR and may only use the data to provide their services to us.

Hosting and Infrastructure

Other Recipients

• Other Melodyc users: your name, username, profile picture, your follower and following lists and counts, and only the songs you decide to publish, as described in Section 3.1. When you follow someone, they may receive an email with your name and a link to your profile.
• GitHub: serves the profile pictures of the project contributors shown in the footer as an independent controller, and may receive your IP address when your browser loads them.
• Authorities: public authorities, when required by law or by a binding order.
• Professional advisors: accountants, auditors, and lawyers bound by confidentiality, when necessary.

Some of our providers are located outside the European Economic Area (EEA). When personal data is transferred outside the EEA, we ensure appropriate safeguards pursuant to Chapter V GDPR:

• EU-US Data Privacy Framework (DPF): for US providers certified under the DPF, based on the adequacy decision of the European Commission (Art. 45 GDPR).
• Standard Contractual Clauses (SCC): approved by the European Commission, for the other providers (Art. 46(2)(c) GDPR).
• EU storage: wherever possible we keep data in the EU. Our database is hosted in Frankfurt and generated audio is stored in Stockholm.

You can request a copy of the safeguards adopted by contacting us.

We keep personal data only for as long as necessary for the purposes described in this policy:

After these periods, data is deleted or irreversibly anonymized, unless we need to keep it longer to comply with a legal obligation or to defend a legal claim.

We adopt appropriate technical and organizational measures (Art. 32 GDPR) to protect your personal data, including:

• Encryption: all traffic is encrypted with HTTPS/TLS, passwords are stored only as secure hashes, and secrets are kept in encrypted environment variables.
• Authentication: secure, HTTP-only session cookies with limited duration and rate limiting on authentication endpoints.
• Access control: each user can access only their own private songs. Database queries go through the Prisma ORM to prevent SQL injection.
• Storage: audio files and cover images are kept in a private storage bucket and served through short-lived signed links.
• Infrastructure: AI models run in isolated GPU environments, and access to production systems is restricted to authorized personnel.

No method of transmission or storage is completely secure. If a personal data breach is likely to result in a risk to your rights, we will notify the Garante within 72 hours and, where required, inform you without undue delay (Articles 33 and 34 GDPR).

You have the following rights regarding your personal data:

• Right of access (Art. 15): obtain confirmation of whether we process your data and receive a copy of it.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure (Art. 17): request the deletion of your data. You can delete your account yourself at any time from Account > Security: this permanently removes your profile, songs, audio files, cover images, and preferences.
• Right to restriction of processing (Art. 18): limit the processing in certain circumstances.
• Right to data portability (Art. 20): receive the data you provided in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21): object at any time to processing based on legitimate interest, on grounds relating to your particular situation.
• Right to withdraw consent (Art. 7(3)): at any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint (Art. 77): with the Italian Data Protection Authority at www.garanteprivacy.it, or with the supervisory authority of the EU Member State where you live, work, or where the alleged infringement took place.

To exercise your rights, write to info@skyclouds.co. Requests are free of charge. We will reply without undue delay and in any case within one month of receipt, a period that may be extended by two further months for complex requests, in which case we will inform you (Art. 12(3) GDPR). We may ask you to verify your identity before fulfilling your request.

The Service is not directed to individuals under the age of 16, and we do not knowingly collect their personal data. If we learn that we have collected data from a child under 16 without valid parental authorization, we will delete it promptly. If you believe this has happened, please contact us.

Melodyc uses AI to generate music, lyrics, style tags, categories, and cover images from your input. This processing only provides the creative service you request: it is not used for profiling and does not produce decisions with legal or similarly significant effects on you (Art. 22 GDPR). You always decide which songs to keep, publish, or unpublish.

For detailed information about the cookies and similar technologies we use and how to manage your preferences, see our Cookie Policy.

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. We will publish the updated version on this page and change the "Last updated" date. In case of material changes, we will inform you through the Service or by email before they take effect.

For any questions about this Privacy Policy or to exercise your rights, contact us:

• Email: info@skyclouds.co
• PEC: skyclouds@pec.it
• Address: Corso del Popolo 161, 45100 Rovigo (RO), Italy