Privacy Notice

Who is responsible

Moonsong is an iPhone and Android app and website published under the Sansavision brand. Sansa Group AB (Swedish organisation number 559111-9507) is the company behind Sansavision and the controller of the personal data described in this notice.

For anything about your personal data, email support@sansavision.com. Please put "Moonsong privacy" in the subject line so we can route it quickly.

This notice covers the Moonsong iOS app, the Moonsong service behind it and the website at moonsong.my. It is written for the service as it actually works today. When that changes, we update this notice and its version number.

The short version

Moonsong does not ask for access to your contacts, photos or location. It asks for the microphone only when you first choose Listen or Hum in "Song like…", and uses it only while that recording is active, never in the background. Humming is analysed on your iPhone and we never receive your audio. See Song like… and the microphone.

What we collect and why

The table lists every category of personal data the Moonsong service stores. "Contract" means the processing is necessary to provide the service you asked for (GDPR Article 6(1)(b)). "Legitimate interests" means Article 6(1)(f); you can object to it (see Your rights). "Legal obligation" means Article 6(1)(c).

Your creative writing is yours to choose. It can contain personal or sensitive details about you or other people, so please include only what you are comfortable sending to the AI providers listed below. We don't analyse your writing to profile you and we don't infer sensitive characteristics from it.

Website analytics (only if you allow it)

Optional analytics, only if you allow it. When you first visit, a bar asks whether we may count how the website is used. If you choose Allow, the website uses Apphelm, product analytics made and run by Sansavision (Sansa Group AB, the company behind Moonsong) on Cloudflare, to record which pages you open, the page title, the link that brought you here (the referring address and any utm campaign tags), roughly where on the page you click and which buttons you press (for example a play button or Get it on Google Play), how fast pages load, and errors in the website's own code. To recognise a returning visitor it keeps one random identifier in your browser's local storage (apphelm.distinctId). It never records what you type, never records your screen, sets no cookies and is not used for advertising or to follow you to other sites. Apphelm does not store your IP address. If you choose No thanks, or your browser sends a Global Privacy Control signal, nothing is loaded or sent. Either way we remember your answer in local storage (moonsong.analytics) so we don't ask again. You can change your mind any time with Analytics settings at the bottom of every page of the website; saying no deletes the identifier.

Legal basis: your consent (GDPR Article 6(1)(a)). Retention: page views, clicks and other events are deleted after 12 months; the record of which link or campaign brought you to the site is kept for up to 400 days (about 13 months) so a later visit can be credited to the right source, and is then deleted. See Cookies.

Which ad or link brought you (Android app)

When you install Moonsong from a link on moonsong.my, the website passes that link's campaign tags (utm values, and for our own ads which ad it was and whether it was shown on Facebook, Instagram, Messenger or Audience Network) to Google Play. The first time the app opens, it reads them once from Google Play's install referrer and sends them with your first sign-in. We keep them with your account and use them only to learn which of our ads bring people to Moonsong: our ad manager Yieldline (run by Sansa Group AB, the company behind Moonsong) receives your sign-up and purchases as events with the ad they came from and a one-way hash of your account id. Never your email, name, songs or device identifiers. No advertising ids, no ad SDKs, nothing is shared with ad networks, and you are not followed across other apps or websites. Legal basis: our legitimate interest in measuring our own advertising (GDPR Article 6(1)(f)). It is deleted with your account.

AI processing

Moonsong's AI features only run after you give explicit permission in the app. That permission is recorded with the version of the AI processing notice you saw (currently ai-processing-2026-09-27). You can withdraw it at any time in the app under Profile → Privacy & data. Withdrawing stops all AI features from then on; manual writing, templates, playback and export keep working.

When you start an AI action, we send the content needed for that action to the provider that runs the model: songs go directly to Google (through Google's paid AI service); everything else goes through OpenRouter. If Google's direct service is briefly unavailable, a song may instead be made with an earlier Google music model through OpenRouter, with the same content and the same protections:

Your content is never used to train AI models: not by us, and not by our AI providers. We don't send your email address to AI providers. Music: we use Google's paid AI service; under Google's terms for paid services, Google doesn't use your prompts, lyrics, photos or songs to improve its products, and logs them for a limited period only to detect and prevent abuse. Everything that goes through OpenRouter (lyrics, song ideas, covers, style analysis, safety checks, and the music backup): we ask OpenRouter to use only provider routes that do not collect data for training (data_collection: deny). These providers are still independent companies with their own retention and safety-logging practices, and they may process content outside the EU/EEA, including in the United States. See Subprocessors and AI & music rights.

We don't write raw lyrics or prompts to our operational logs, and we (Sansa Group AB) don't use your content to train AI models.

Song from a photo. When you make a song from a photo, the photo you pick (or the AI cover you made) is stored with that song on our servers so it can be sent with the song request, and is deleted with the song or your account. Only choose photos you have the right to use. Photos of other people should only be used with their permission.

Watermark. Audio made by Google's music AI carries Google's SynthID watermark, an inaudible marker that identifies it as AI-generated.

Song like… and the microphone

"Song like…" on the Create screen lets you point Moonsong at music you like, so it can suggest a similar style for an original song. You can paste or share a link, type a song name, or use Listen or Hum. Each works differently:

Microphone. Moonsong asks for microphone permission the first time you choose Listen or Hum, not before. It uses the microphone only while you use Listen or Hum and the recording is active, and never in the background. Your audio is never uploaded to or stored on our servers. You can turn microphone access off at any time in the iPhone's Settings; links and song names keep working without it.

Looking up links and song names. Our server looks up public track details with the Spotify Web API or Spotify's oEmbed service (Spotify), YouTube's oEmbed service or, for playlists, the YouTube Data API (Google), SoundCloud's oEmbed service (SoundCloud), and Apple's public iTunes Search and Lookup API (Apple). The Spotify Web API and the YouTube Data API are used only where we have set them up; otherwise we use the oEmbed service, which usually gives only a title. These services receive only the link or the search text, never your email address, account ID or any other identifier. We keep only the title, artist, genres and year of each track, up to 50 tracks, and discard everything else in their answers.

Style analysis. When you tap Analyze style (1 credit), we send the references you confirmed (titles, artists, genres and years) and any hum measurements through OpenRouter to OpenAI, with the same no-training routing we use for lyric help (data_collection: deny). Like every AI action, it needs your AI permission. The model returns a Style Profile: genre, mood, tempo, key, era, instruments, production and a generic vocal character. We filter it on our server so it contains no artist names, song titles, lyrics or "sounds like" phrasing, and Typesafe's classifier checks its text. You can edit the Style Profile before you use it.

What the music and cover models receive. Only the generic descriptors from your Style Profile, as they appear in your Song Blueprint. Reference titles and artist names are never sent to the music or cover AI.

Your "Inspired by" note. The references are saved only on your project, as a private "Inspired by" note next to the Style Profile. Only you can see it. You can remove references one by one, and they are deleted with the project or your account. They are included when you take a copy of your data, are never public and are not used to train AI models.

Apple runs ShazamKit, MusicKit and the iTunes Search and Lookup API under its own terms and privacy policy. ShazamKit and MusicKit work on your iPhone as part of your own relationship with Apple.

Sharing

Songs and playlists are private by default. If you choose to share one by link, anyone with the link (and, for a passcode link, the 6-digit code) can see its title, cover, audio and lyrics on a page at moonsong.my, labelled as AI-generated. For a playlist, that is the playlist's name and each song in it. Shared pages are not listed, searchable or indexed by search engines.

• Your email address and account never appear on a shared page, and neither does a photo you used for Song from a photo.
• We count views only: a number you can see in the app. We don't record who viewed the page. To count a visit once, we use a one-way hash of the visitor's IP address in a short-lived record that expires automatically.
• If a visitor enters the right passcode, we set one strictly necessary cookie for that page so they don't have to enter it again; it lasts 7 days and contains no personal data.
• Anyone can report a shared page. A report stores the reason, any details the reporter writes and a salted one-way hash of the reporter's IP address (so we can count distinct reports), and is kept for 90 days. Our support team receives the report by email to review it.
• You can change the passcode, replace the link or make it private at any time; the old link then stops working. Deleting the song, the playlist or your account turns its links off. We can't recall copies that people who had the link may have saved.

Automated safety checks

Before an AI action runs, and again before you make a song or playlist public, the text (title, lyrics and idea; for a playlist, its name and song titles) is checked automatically against our content rules. If the check blocks a request, you see a message in the app, no credits are spent for the blocked action, and nothing is generated. A blocked request has no legal or similarly significant effect on you, but you can always ask a person to review it: email us with the project name and roughly when it happened. See Appeals.

Sign-in and security

Moonsong uses passwordless sign-in. You enter your email address and receive either a 6-digit code or a sign-in link. These emails are sent from auth@moonsong.my through Cloudflare's email service. There are no passwords and no social log-ins.

A signed-in session lasts about 30 days. We store it with your device and app details so you can see where you are signed in. We do not store your IP address or any IP-based location in your session, and Moonsong never uses your iPhone's location.

To stop abuse, sign-in and other requests are rate limited. The limiter uses your IP address in the moment and keeps only a one-way hash of it in short-lived records that expire automatically.

We will never ask you for your sign-in code or link by email or phone.

Purchases and credits

Subscriptions and credit packs are sold by Apple through the App Store on iPhone and by Google through Google Play on Android. The store handles payment and your payment details; we never see your card. We receive transaction information from the store you bought from (such as product, transaction or order identifiers, a purchase token on Google Play, dates and renewal status) to grant your credits and keep your wallet accurate. So that a purchase reaches the right wallet, the app gives the store your Moonsong account identifier (not your email) when you buy. We keep a ledger of credit grants, reservations, spending, restorations and refunds.

Apple or Google (whichever store you bought from) processes your purchase as an independent controller under its own privacy policy.

Who receives your data

We don't sell personal data and we don't share it for advertising. We use these service providers:

• Cloudflare hosts the service, database and private file storage, protects the network and delivers sign-in emails.
• OpenRouter routes AI requests to the model providers.
• Google, OpenAI, Typesafe and Black Forest Labs run the AI models for the actions you request.
• Spotify, Google (YouTube), SoundCloud and Apple (iTunes Search and Lookup) receive the link or song name you enter in "Song like…", from our server and without anything that identifies you, and return public track details.
• Yieldline, Sansa Group AB's own ad manager, receives sign-up and purchase events with the ad they came from and a one-way hash of your account id, to judge our ads (see Which ad or link brought you).
• Google sells and manages Google Play purchases and subscriptions in the Android app, as an independent controller under its own privacy policy.
• Apple sells and manages App Store purchases and subscriptions. When you use Listen or an Apple Music link, Apple's ShazamKit and MusicKit also work on your iPhone under your own relationship with Apple.

When you share a song or playlist by link, anyone who opens the link sees what that page shows (see Sharing). Nothing else about you is shared with them.

The full list, with purposes and locations, is on the Subprocessors page. We may also disclose data where the law requires it, to protect people's safety or our legal rights, or as part of a business transfer, in which case this notice would continue to protect it.

International transfers

Sansa Group AB is based in Sweden. Some providers above are based in, or process data in, countries outside the EU/EEA, including the United States. Where personal data is transferred outside the EU/EEA, we rely on an adequacy decision (such as the EU–US Data Privacy Framework for certified recipients) or the European Commission's Standard Contractual Clauses, together with any additional safeguards needed. You can ask us for more information about the safeguards for a specific provider.

Retention

• Generated songs, clips and covers are stored for 24 months from creation, unless you delete them sooner. Before routine deletion we remind you in the app 90, 30 and 7 days ahead so you can export. Files you have exported to your device are yours and are not affected.
• Lyrics, briefs, notes and projects are kept until you delete the project or your account. A deleted project's files are removed within 7 days.
• "Song like…" references and Style Profiles (your private "Inspired by" notes) are kept until you remove them or delete the project or your account. Hum recordings are never stored; only the measurements are kept, with the Style Profile.
• Account deletion removes your data from our active systems within 7 days and from backups within 30 days.
• Finance and fraud records: a minimal ledger of purchases, credit grants and refunds is kept separately for as long as accounting and tax law requires (in Sweden, generally seven years), and is not used for anything else.
• Free-introduction records (a one-way hash of your email address) are kept for 24 months from the claim, including after account deletion, and are then deleted automatically.
• Sharing: link settings and view counts are kept while the link is on, and removed from use when you make it private, replace the link or delete the song, playlist or account. Reports on shared pages are deleted after 90 days.
• Sessions expire after about 30 days. Rate-limit records are short-lived and expire automatically.
• Logs: operational logs about 30 days, security logs about 90 days.
• Which ad or link brought you is kept with your account and deleted with it. Yieldline keeps the events it received (hashed account id, no contact details) for up to 24 months.
• Website analytics (only if you allowed it): events 12 months; the source of your visits up to 400 days (about 13 months).

AI providers keep data according to their own policies, which we cannot shorten for you. Your credits are not affected when an old song reaches its retention date.

Your rights

You have the right to access your data, correct it, delete it, restrict its use, receive a portable copy, and object to processing based on our legitimate interests. Where we rely on your permission, you can withdraw it at any time; this doesn't affect what happened before.

• Delete your account: in the app under Profile → Privacy & data. See Delete your account.
• Withdraw AI permission: in the app under Profile → Privacy & data.
• Turn off microphone or Apple Music access: in the iPhone's Settings. The Android app doesn't use the microphone or Apple Music.
• Everything else: email support@sansavision.com from the address you use with Moonsong.

We answer within one month. If a request is complex we may extend that by up to two further months, and we will tell you why within the first month. Requests are free unless they are clearly unfounded or excessive. We may need to confirm that a request comes from the account owner; we will never ask for your sign-in code or link.

You can complain to a data protection authority, in particular where you live or work. In Sweden this is:

Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection
Box 8114, 104 20 Stockholm, Sweden
www.imy.se

More detail: Your GDPR rights · California privacy.

Children

Moonsong is only for adults aged 18 and over. We ask you to confirm your age when you start. If we learn that an account belongs to someone under 18, we will close it and delete its data. If you believe a child has used Moonsong, email us.

Security

Data is sent over encrypted connections (HTTPS). Your projects and files are stored in private storage that is not publicly accessible; media is delivered only through short-lived signed links after we check that you own it. Your session is kept in the iPhone's secure storage. Access to production data is limited to people who need it to run the service. No system is perfectly secure, so please keep your email account secure, because it is how you sign in.

Cookies

This website uses no analytics or advertising cookies. The only cookie it can set is a strictly necessary one when you unlock a passcode-protected shared page (7 days). Optional website analytics, if you allow it, uses local storage instead of cookies (see Website analytics). The app uses one essential session cookie to keep you signed in. See Cookies.

Changes to this notice

We update this notice when the service or the law changes. Each version has an identifier and date at the top of this page. If a change materially affects how we use data you have already given us, we will tell you in the app before it takes effect and, where required, ask for your permission again.

Contact

Email support@sansavision.com or write to: