Privacy policy

1. The data controller

The data controller is the merchant named in the "Merchant details and contact" section of the Terms and conditions. For any request about personal data, you can write to us at contact@aimuzica.ro.

2. What data we may process

• account and identification data: email address, account identifier, first name, last name and town/city;
• sign-in data: session tokens, sign-in status and technical data needed for login; AiMuzica does not store the password in plain text;
• order data: requests, music settings, dedications, lyrics entered, generation status;
• generated content: title, audio files, cover, lyrics or related metadata;
• payment data: amount, pack, payment status, payment identifiers, without full card details;
• data for payment and documents: first name, last name, email, town/city, country and the copy of these details linked to each order;
• technical data: IP address, browser, device, security logs, cookies and local identifiers;
• support communications: the messages you send us and our replies.

The current flow is intended for individuals and does not ask for a personal identification number (CNP), a postal address, a county or a personal phone number. For accounts where a phone number was provided before this update, it may temporarily remain in the historical profile until it is corrected, erased or the applicable period expires.

3. Where the data comes from and what is mandatory

We receive the data directly from you, from the account settings and from the form shown before payment. The payment status and identifiers come from the payment processor. Technical data is generated when you use the website, and sign-in data may come from the sign-in service you choose.

First name, last name, email and town/city are mandatory to start the payment and identify the order. If you do not provide them, checkout cannot start. Creative data is needed only to the extent it is used for the requested song.

4. Purposes and legal bases

• performance of the contract and pre-contractual steps: managing the account, preparing and confirming the payment, generation, delivering the content, order history and support;
• legal obligations: payment records, invoicing, accounting, RO e-Factura, fraud prevention required by law and replies to authorities;
• legitimate interest: security of accounts and of the platform, abuse prevention, defending our rights, diagnosing errors and improving the service, after weighing the interests of the people concerned;
• consent: Google Analytics, Meta Pixel and other non-essential technologies, if they are enabled and you choose “Accept all”. Refusing them does not block the service.

5. How we use data for payment and invoicing

The details filled in under Settings or in the payment form are saved in the profile for reuse. When each payment starts, we also keep a copy linked to the order, so that later profile changes do not alter the record of a transaction already started or paid.

We send NETOPIA Payments the first name, last name, email, town/city, country, the order details and a technical phone number set by the merchant, which the NETOPIA interface requires. This technical number is not the customer's number, is not stored in the profile as customer data and is not used to contact the customer. Full card details are entered and processed directly in the payment processor's environment and are not stored by AiMuzica.

When the tax integration is active, the data needed for the document may reach Oblio directly or through the integration configured in NETOPIA, to issue and submit the invoice, including through RO e-Factura when this obligation applies. We do not send a CNP because we do not collect it in the current flow.

In the AiMuzica Android app, credits are bought through Google Play's billing system. The payment, card details and payment receipt are handled by Google under Google's privacy policy. From Google we receive only the product ID, the order ID, the purchase token and the payment status, which we use to verify the payment and add the credits to the account.

6. Partners, recipients and authorities

We use external services for hosting, database and sign-in, payment processing, invoicing, email, support, AI generation, file storage and technical analysis. These may currently include Supabase for accounts and the database, NETOPIA Payments for payments on the website, Google Play for payments in the Android app, Oblio for tax documents and Google services for optional sign-in, generation, storage and, only with consent, Analytics.

Partners receive only the data needed for their service and process it according to their own contracts and policies. NETOPIA also processes the data of the person making the payment as a controller for the operations set by its own procedures. Data may also be disclosed to public, tax, judicial or supervisory authorities when the law requires it.

7. Transfers outside the EEA

Some technical services may process data outside the European Economic Area. In such cases we use, as appropriate, an adequacy decision, standard contractual clauses or other safeguards recognized by the applicable law. You can request more information at the contact address.

8. How long we keep the data

Profile data is kept while the account is active and afterwards only as long as needed to close requests, defend our rights or comply with the law. Content and orders are kept as long as needed to provide the service and the history requested by the user. Payment records, the copies of data linked to orders and tax documents are kept for the period required by tax and accounting law, including when a paid order is hidden from the account.

Security and diagnostic logs are kept for limited periods set according to risk. Browser data has the durations described in the Cookie policy. When the period expires, the data is deleted or anonymized, except for backup copies, which are removed according to the technical rotation cycle.

9. Your rights

Under the GDPR, you can request access, rectification, erasure, restriction, portability and objection. You can change your first name, last name and town/city in the account Settings. You can withdraw your consent for Analytics at any time, without affecting the processing carried out before the withdrawal.

You can ask for your account to be deleted from your account (“Șterge contul” / Delete account) or by following the steps on the account deletion page, which also explains what is deleted and what is kept.

Requests are sent to contact@aimuzica.ro and usually receive a reply within one month at most, subject to identity checks and legal exceptions. The right to erasure does not apply to data we are legally required to keep. You can file a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).

10. Security and automated processes

We use reasonable technical and organizational measures to protect the data, including authentication, access control, secure payment services and technical monitoring. No method of online transmission is completely free of risk.

Content generation and certain security checks are automated. We do not use these processes for solely automated decisions that produce legal effects or similarly significantly affect the user.