Privacy Policy at Song7
Last updated: 2 October 2026
This privacy policy describes how Song7 collects and processes your personal data when you use our services and websites.
Data controller
The data controller is Song7 ApS, company registration (CVR) no. 45431762, Denmark. If you have questions about this policy or wish to exercise your rights, contact us at service@song7.io.
What we collect and why
We collect and process the following types of information:
- Account data (name, email, profile photo) — to create and manage your account and provide the Services. Legal basis: performance of the contract.
- Your content (songs, lyrics, sets, notes, team information) — to store and deliver the features you use. Legal basis: performance of the contract.
- Payment data — handled by our payment provider (Stripe); we do not store your full card details. Legal basis: performance of the contract.
- Anonymous visitor statistics (such as which pages are visited, which site a visit came from, and approximate country) via PostHog, hosted in the EU. PostHog sets no cookies and stores nothing on your device; your IP address is used to count unique visitors and estimate country. Legal basis: our legitimate interest in understanding and improving our website.
- Technical and usage data (such as device type and which pages you visit) via Google/Firebase Analytics. Legal basis: your consent.
- Marketing / newsletter — only if you opt in. Legal basis: your consent.
We show no advertising in Song7 and do not sell your information.
Cookies
We use a cookie to remember your consent choice, a cookie to remember your language, a strictly necessary cookie recording that you have signed in on this browser (so we can take you straight to the app instead of the homepage), and — if you consent — analytics cookies (Google/Firebase Analytics) to understand how the Services are used. Our visitor statistics via PostHog use no cookies. You can delete or block cookies at any time in your browser settings; some features may not work optimally without them.
Subprocessors and third parties
We use the following trusted third parties, which process information on our behalf to provide the Services:
| Service | Purpose |
|---|---|
| Google Firebase | Authentication, database, file storage, and analytics |
| Netlify | Website and app hosting |
| PostHog (EU) | Anonymous, cookieless visitor statistics |
| Stripe | Payment and subscription handling |
| Resend | Transactional and newsletter emails |
| Google Gemini | Optional AI features (find song online, photo-to-song, song cleanup) |
| Pexels | Background images and videos |
These parties process information only on our behalf and may not use it for their own purposes.
AI features
If you use our optional AI features, the relevant content is sent to Google Gemini to process your request: the song's title, artist, album, and year when you pick a song with "Find song online"; the photo you choose when importing from a photo; and the song you are editing when you use Cleanup. Images may contain personal data. The content is processed to provide the feature to you. For more on how we use AI, see How Song7 uses AI.
Data storage and international transfers
Your primary data (account and content) is stored in the EU/EEA via Google Firebase. Some subprocessors (such as Netlify, Stripe, Resend, and Google Gemini) may process certain data outside the EU/EEA, including in the United States. Where this happens, the transfer is based on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCC) or the EU-US Data Privacy Framework.
Retention period
We keep your account data and content for as long as your account is active. When you delete your account, your data is deleted as described below; backups are rotated and deleted over time. Certain information may be retained longer where required by law (for example, accounting records).
Account deletion
You can delete your account at any time in your account settings. When you do, we cancel any Stripe subscription, remove you from our marketing list (if you were subscribed), delete your stored files, delete the spaces you own (including their content), and remove your membership from other spaces. Deletion is permanent.
Your rights
You have the right to: access the information we hold about you; receive it in a common format (data portability); have inaccurate information corrected; have information erased; restrict processing; object to processing, including to direct marketing; and withdraw consent. To do so, contact service@song7.io. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet).
Security
We have implemented technical and organizational measures to protect your information against accidental or unlawful loss, misuse, and unauthorized access. If a personal-data breach occurs that poses a risk to you, we will notify the relevant authorities and, where required, you, in accordance with the GDPR.
Children
The Services are not directed to children under 13, and creating an account requires you to be at least 13 years old. If you are under 18, you need a parent's or guardian's permission.
Publisher
The Services are provided by: Song7 ApS, CVR no. 45431762 Email: service@song7.io