NEXTB LTD (company number 15920637), trading as SongSprig is the controller of personal data processed through SongSprig. This policy explains our practices and the choices available to you.
1. Who we are
NEXTB LTD (company number 15920637), trading as SongSprig operates the SongSprig website and AI music workspace. Our registered office is 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.
Questions and privacy requests can be sent to support@songsprig.ai.
2. Personal data we collect
- Account and contact data, including your email address, authentication records, profile details, and account preferences.
- If you choose Google Sign-In, Google provides your email address, name, profile image, and Google account identifier. We do not receive or store your Google password.
- Creative content you provide, including prompts, lyrics, audio, images, project settings, uploaded files, voice recordings, and related metadata.
- Generated content and workspace records, including songs, task status, projects, library entries, downloads, and feedback.
- Billing and entitlement data, including Stripe customer, subscription, invoice, payment-status, refund, dispute, credit, and ledger records. We do not receive your full card number.
- When Google measurement is active under the regional rules in section 8, Google Analytics 4 and linked Google services may receive the complete browser URL for eligible static pages, including query parameters and fragments, a normalized page path, referral information, general device or browser information, approximate region, first-party analytics or advertising identifiers such as _ga or _gcl_* where applicable, and fixed low-cardinality events for account creation, core generation, Checkout entry, and confirmed purchase.
- Technical and security data, including IP address, device and browser information, timestamps, cookies, request logs, error logs, abuse signals, and rate-limit events.
- For duplicate-account protection, SongSprig derives a browser device identifier and uses the edge-provided IP address during the first signed-in account verification. The resulting account decision is then fixed; later device or network changes do not reclassify the account. The account-association database stores keyed one-way digests of those initial values, rather than the raw device identifier or IP address.
- Support, copyright, refund, and data-rights correspondence, including information needed to verify and answer a request.
3. How and why we use personal data
- To create and secure your account, provide requested features, store your workspace, deliver generated results, and manage downloads under our contract with you.
- To use Google Sign-In to authenticate you, create or link your SongSprig account, and display basic profile information. We do not use Google user data for advertising.
- To process subscriptions, credit packs, refunds, disputes, tax and accounting records, and prevent duplicate or fraudulent transactions under our contract and legal obligations.
- To route creative requests to AI providers, reconcile callbacks, restore credits after eligible failures, and maintain service reliability under our contract and legitimate interests.
- To prevent abuse, enforce our Terms, protect users and infrastructure, investigate incidents, and defend legal claims under our legitimate interests and legal obligations.
- To answer support, copyright, privacy, and consumer-rights requests under our contract and legal obligations.
- Under the regional consent rules in section 8, to create aggregate reports about redacted page visits, navigation paths, and a limited account-to-purchase product funnel through Google Analytics 4, measure advertising performance, and support advertising personalisation in linked Google services when the applicable consent signal is granted.
- To send service and authentication messages. We use consent where the law requires it for optional marketing, and you may withdraw that consent at any time.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects. AI systems do generate creative material and may automatically apply safety, fraud, or rate-limit controls.
4. AI and content processing
When you request an AI feature, the content and settings needed for that request may be sent to the applicable provider. Do not upload confidential, unlawful, or third-party material unless you have authority to use and process it.
AI outputs may be inaccurate, similar to other outputs, or unsuitable for your intended use. We do not use uploaded voice recordings to identify you, but voice and audio content may still be personal data and must only be provided with the necessary rights and consent.
5. Service providers and recipients
Each provider processes data under its own contractual and legal obligations. We share only what is reasonably needed for the relevant service. We do not sell personal data.
When you choose Google Sign-In, Google and Supabase exchange the sign-in data needed to authenticate you. Supabase stores your linked identity and basic profile data for your SongSprig account. We do not sell Google user data or use it for advertising.
- Supabase Cloud for authentication and the production database.
- Google for Google Sign-In when you choose that option.
- Google Analytics 4 and linked Google advertising services for website-usage reporting, advertising measurement, and consented personalisation under the regional rules in section 8.
- Cloudflare for application hosting, content delivery, security, object storage through R2, and image delivery or optimisation.
- Stripe for Checkout, subscriptions, credit-pack payments, billing management, refunds, disputes, and fraud controls.
- Kie.ai for supported music, lyrics, voice, image, and media generation tasks.
- Replicate for supported audio, separation, voice-training, or model-processing tasks.
- Authentication-email, operational-support, and monitoring providers that we configure for production delivery.
- Professional advisers, regulators, courts, law enforcement, or a buyer of the business where disclosure is lawful and necessary.
6. International transfers
Our providers may process data in the United Kingdom, United States, European Economic Area, or other countries. Where required, we rely on an adequacy decision or appropriate contractual safeguards offered by the provider and apply reasonable technical and organisational controls. Contact us to request more information about relevant safeguards.
7. Retention
We review retention by reference to account status, the purpose of processing, legal requirements, security needs, and whether the data can be safely deleted or anonymised.
- Account, project, library, and generated-content records are kept while your account is active and for as long as reasonably needed to provide or restore the service.
- Billing, tax, fraud-prevention, dispute, and legal records may be retained for the period required by law or needed to establish, exercise, or defend legal claims.
- Security, request, and error logs are kept according to operational need and provider settings, then deleted or aggregated when no longer required.
- Support and rights-request records are kept long enough to resolve the matter and demonstrate compliance.
- Deleted data may remain temporarily in restricted backups or processor systems until their normal deletion cycles complete.
9. Your rights
See our User Rights page for request steps. You can contact support@songsprig.ai; we may need to verify your identity before acting.
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Request deletion or restriction where the law allows.
- Object to processing based on legitimate interests or to direct marketing.
- Receive portable data where the right applies.
- Withdraw consent without affecting earlier lawful processing.
- Complain to the UK Information Commissioner's Office or another competent regulator.
You have the right to object to direct marketing at any time. Where processing relies on legitimate interests, you may also object based on your particular situation.
10. Age, changes, and contact
SongSprig is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us so we can investigate.
We may update this policy when our products, providers, or legal obligations change. Material changes will be posted here and, where appropriate, communicated through the service.
Contact: support@songsprig.ai. Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.
Related pages
Questions? Email support@songsprig.ai.