Privacy Policy

1. Data controller and contact

刘佳宇 (Jiayu Liu), an individual operator based in China, operates Vocalore at https://vocalore.co and is responsible for the personal information described here. The service is available worldwide. For privacy requests, account deletion, security concerns, or customer support, email jiayu.liu.nankai@gmail.com. You do not need to sign in to contact us by email.

This policy explains our handling of information when you use the service. It does not replace any separate consent required for a particular processing activity.

2. Information we collect

• Account information: your name, email, account identifier, password hash, and sign-in records. If you choose an available Google or GitHub sign-in option, we receive the profile and authentication information authorized through that provider.
• Song content: recipient details, occasions, stories, musical preferences, lyrics, generated audio, generation status, and sharing settings. Only include information about others when you have an appropriate right or permission to do so; avoid unnecessary sensitive information.
• Transaction information: order identifiers, product, amount, currency, payment status, and payment-provider references. We do not store full payment card numbers or card security codes.
• Support information: messages, ticket history, and any attachments you choose to send.
• Technical and usage information: IP addresses and browser details associated with authentication or infrastructure logs, request times, errors, and first-party usage events. Usage events record actions such as registration, creation steps, playback, checkout, payment confirmation, download, and sharing, with a visit session identifier and relevant account, song, or order identifiers. These event records do not contain story text, lyrics, or payment credentials.

3. Purposes and legal bases

We use account and song information to authenticate you, create music, maintain your library, and provide the sharing you request; transaction information to fulfill purchases and reconcile payments; and support information to answer your requests. Where a contract basis applies, these activities are necessary to provide the service you request.

We use limited technical records and usage events to secure the service, prevent fraud and abuse, diagnose failures, and understand product use. The operator also uses reports and the relevant content or account records, limited to what is necessary, to investigate content-policy violations and appeals. Where applicable, these activities rely on legitimate interests balanced against your rights, or another basis required by local law. Required accounting, transaction, and regulatory records are processed to meet legal obligations. Processing that requires consent will rely on that consent, which you may withdraw for future processing.

4. Providers and disclosure

We do not sell personal information or share it for cross-context behavioral advertising. Information is disclosed as necessary to provide the service:

• Cloudflare: hosting, network security, database services through Workers and D1, and R2 audio or attachment storage when configured.
• KIE: stories, lyrics, musical preferences, and related generation requests are sent through this service to Suno's lyrics generation service and Suno V5 for music and synthetic vocals. Longer stories may first be condensed using Google Gemini 2.5 Flash through KIE. Do not include information that is unnecessary for generation. We do not use your content to train our own AI models; this statement does not make a separate promise about a provider's own data practices.
• Waffo Pancake: processes purchases through its checkout, including payment card information, billing details, and relevant transaction references. Payment card details are handled through the payment provider, not stored on our servers. Creem handles purchases made through its checkout on the same basis.
• Account and email providers: Google or GitHub receive the authentication requests you choose to make. The configured transactional email provider, such as Resend or Cloudflare Email, receives an email address and the content needed to deliver verification, password-reset, or other service messages.

Providers handle information under their own terms and privacy notices. We may also disclose information when required by law, to protect legal rights, or as part of a business transfer with appropriate notice and protections. Other uses requiring consent will be explained when that consent is requested.

5. Private drafts and shared gifts

Drafts and original stories are accessible through your authenticated account. Publishing is optional. An unlisted gift link displays the recipient, song title, lyrics, and audio to anyone with that link; it does not expose the original story or payment details. Anyone with access may save or forward the content.

You can revoke a link from your library. Revocation stops future access through our gift page, but cannot remove copies already downloaded. Gift pages are marked not to be indexed and omitted from our public sitemap; these measures are not password protection.

6. Cookies, browser storage, and analytics

Necessary cookies maintain sign-in sessions. Preference storage remembers language or display choices. An unfinished creation draft may be stored in your browser so it can be restored after sign-in, and session storage may hold a visit identifier for first-party usage events. You can clear browser storage or block cookies through browser settings; blocking sign-in cookies may prevent account features from working.

The service supports optional Google Analytics and Plausible integrations, which load only when configured by the operator. If enabled, they process usage and technical information according to the Google Privacy Policy or Plausible Data Policy. Google provides a browser opt-out tool. Where local law requires prior consent for optional tracking, it must be obtained before that tracking is activated. This policy is not itself consent to optional tracking.

We do not use the information described here for unsolicited marketing. Necessary messages about your account, order, security, or policy changes are service communications.

7. Retention

• Account and song records: retained while your account remains open to provide your library. After an identity-verified deletion request, deletion is handled within 30 days, subject to legally required retention.
• Transaction records: retained for 7 years from the transaction, or longer when applicable law requires it, for accounting, compliance, and disputes. Closing an account does not remove these records.
• Support records: retained for 2 years after the request is closed, unless they remain necessary for a legal dispute or obligation.
• Usage and security logs: retained for up to 12 months, unless a specific record must be preserved for an active investigation or legal obligation. Providers may separately retain their own infrastructure records under their policies.

At the end of the applicable period, records are deleted or de-identified, except where lawful preservation is required. Audio hosted by the generation provider may expire after 14 days, independently of our database retention. Save a local copy promptly; retaining a song record does not promise that its audio will remain hosted indefinitely.

8. Security and international processing

We use HTTPS, hashed passwords, account-based access controls, and restricted administrative access. No online service can promise absolute security. If a personal data breach occurs, we will assess it and notify affected people and regulators within the periods required by applicable law, including the 72-hour supervisory-authority notification requirement where applicable.

The operator is based in China, and our international hosting, payment, and AI providers may process information in other countries. Depending on the provider and service, this may include processing outside your country of residence. Where applicable law requires transfer safeguards, such as a valid transfer agreement, standard contractual clauses, or specific consent, we must establish the applicable mechanism before making the restricted transfer. Contact us for information about a transfer relevant to your data.

9. Your rights and children

Depending on applicable law, you may request information about processing, a copy of your data, correction, deletion, portability, restriction of processing, or an objection to processing, and withdraw consent where consent is the basis. Email jiayu.liu.nankai@gmail.com, preferably from your account email. We may verify your identity without asking for unnecessary information. We handle requests within 30 days; if a lawful extension or exception applies, we will explain it. You may complain to a competent data-protection authority and exercise applicable rights without unlawful discrimination.

The service is intended for account holders aged 18 or over. We do not knowingly offer accounts to children or collect their information directly. A song may mention a child only when the submitting adult has the necessary authority or permission; avoid sensitive details. If you believe information about a child was submitted improperly, contact us for review and deletion where appropriate.

10. Policy changes

We update the date above when this policy changes. Material changes will be notified through the service or your account email at least 15 days before taking effect, except where a legal or security requirement calls for earlier action. A change does not replace a separate consent required by law. Our Terms of Service govern purchases and use of the service.