Privacy Policy

Last updated: May 2025 · Effective immediately

Garasho Studio (“we”, “our”, “us”) respects your privacy. This policy explains what data we collect, why we collect it, and how we protect it when you use garasho.com and the Garasho Studio application.

1. Information We Collect

Account data — email address and name provided when you sign in via Google OAuth.
Usage data — the number of songs generated per billing period, stored only to enforce plan limits.
Session data — an encrypted session token stored in an HTTP-only cookie.
Payment data — processed entirely by Stripe. We never see or store card numbers.

2. How We Use Your Data

To authenticate you and maintain your session.
To enforce your plan's monthly song limit.
To send transactional emails (plan confirmations, limit alerts) if applicable.
To improve the service based on aggregate, anonymised usage patterns.

We do not sell your data, use it for advertising, or share it with third parties except as described below.

3. Third-Party Services

Google OAuth — used for sign-in only. We receive your email and display name; we do not access your Google Drive, Gmail, or other Google services.
Stripe — processes subscription payments. Governed by Stripe's Privacy Policy.
Anthropic / DeepSeek APIs — your song briefs are sent to these AI providers to generate lyrics. They are not stored by us beyond the current request.
Vercel — our hosting provider. Standard server access logs (IP, timestamp, path) are retained per Vercel's policy.

4. Data Retention

Account data is retained for as long as your account is active. You may request deletion at any time by emailing us (see contact below). Usage counters reset monthly. We do not persistently store your song briefs or generated lyrics on our servers.

5. Cookies and Local Storage

We use an HTTP-only session cookie (authjs.session-token) to keep you signed in. The application also uses browser local storage to save your work in progress — including song drafts, generation history, presets, and creative briefs — so you can pick up where you left off across sessions. This data stays on your device and is never sent to analytics or advertising services.

We do not use analytics cookies, advertising cookies, or third-party tracking.

6. Your Rights

Depending on your jurisdiction you may have the right to access, correct, or delete your personal data. To exercise any of these rights, contact us at the address below.

7. Security

All data is transmitted over HTTPS. Session tokens are encrypted. We follow industry- standard practices to protect your data, but no system is perfectly secure.

8. Changes to This Policy

We may update this policy from time to time. Material changes will be noted at the top of this page with a revised effective date.

9. Contact

Questions or requests: daadirarabay@gmail.com