This notice explains what personal data SingAlong collects, why, and your rights. Version 2026-10-21.1. Controller: Delight Design Ltd, 71–75 Shelton Street, London, WC2H 9JQ, United Kingdom. Data-protection contact: info@delightdsgn.com (alternatively info@delightdsgn.com).
1. Data we collect
- Account data: name, email address, hashed password (handled by our authentication provider), your plan/tier, your blocked flag, and your recorded legal acceptances (which Terms/Privacy versions you accepted and the server timestamp of each).
- Audio you give us: songs you upload, voice recordings you make in the app, and everything we generate from them — separated stems (vocal/drums/bass/other), processed mixes, pitch/transcription results, key-analysis results, and practice progress in the Academy.
- Billing data: when billing launches, Stripe holds your card details (we never see them); we keep your Stripe customer ID and subscription status.
- Technical records: processing-job ledger rows (job type, status, timings, stable error codes) and server logs needed to operate and debug the Service.
We do not use advertising or marketing trackers. Device storage we use is strictly necessary (see the Cookies page).
2. Why we use it, and our lawful basis
- Running your account and the Service (login, storage, processing your audio, returning results) — performance of our contract with you.
- Recording your legal acceptances — legal obligation and proof of contract.
- Billing (when live) — performance of contract and legal obligation (tax records).
- Security, abuse prevention and debugging — our legitimate interests, kept minimal.
- Product-news emails — only with your separate, optional, opt-in consent, which you can withdraw at any time from My account.
3. AI training
We do not train AI models on your voice recordings, songs, or practice data. If we ever want to, we will ask for a separate, explicit opt-in — off by default, freely withdrawable — and nothing will change silently.
4. Who we share data with (processors)
- Supabase — database, authentication, and private audio storage (project hosting).
- Vercel — hosts the web app you load in your browser.
- Render — hosts our processing API and Redis queue.
- Redis (managed via Render) — the job queue that hands your audio to the worker.
- Hugging Face — hosts the AI audio model (stem separation / analysis) that performs the processing.
- Stripe — payment processing when billing launches.
Each processor acts on our instructions under a data-processing agreement. We do not sell personal data. We may disclose it where legally required.
5. International transfers
Our providers operate globally; some data may leave the UK. Where it does, we rely on UK-approved safeguards (the EU/UK adequacy regulations for providers certified under the UK–US Data Bridge, or UK International Data Transfer Addenda). The exact per-vendor location map is a pending business/vendor decision and will be finalised with the processor DPAs before launch.
6. How long we keep data
- Account and consent records: while you hold an account; consent audit rows are permanent-by-design only while the account exists and are deleted with it.
- Temporary source uploads expire after 7 days; generated stems after 30 days; saved recordings and mixes after 365 days, subject to the applicable retention deadline. Abandoned temporary uploads are removed after 24 hours. You can request earlier deletion from your account.
- Billing records: as required by tax law (usually 6–7 years) once billing exists.
- Queued audio-bearing jobs expire after one hour waiting; failed job data after one hour, and successful job results after 500 seconds. A running analysis may continue until its processing timeout. Diagnostic logs are minimized and do not intentionally include audio bytes or signed playback links; hosting log retention is being confirmed before paid launch.
7. Your rights
You can request access to your data (and instant self-serve export from My account), rectification, erasure (account deletion is self-serve), restriction of processing, objection, and data portability. To exercise anything not available in the app, contact info@delightdsgn.com. You also have the right to complain to the Information Commissioner’s Office (ICO), Wycliffe House, Cheltenham, GL50 3TZ — though we hope you will contact us first.
8. Younger users
A parent or guardian should contact info@delightdsgn.com about a child’s personal data or use of the Service. We use private-by-default audio storage and do not use advertising trackers. We assess any additional safeguards required for younger users before making the Service publicly available.
9. Changes
Material changes will be announced in the app; significant privacy changes will re-present this notice for acknowledgement via the acceptance gate, and the new version is recorded on our servers.