Privacy Policy

Who operates creto

creto is the music service at www.songcreative.com, based in Hong Kong. For account, privacy or billing questions, contact support@songcreative.com.

This policy covers how creto handles your information. Google, payment services and other providers have separate privacy notices for their own services.

Information we process

• Account information. Google sign-in provides your account identifier, email address and available profile information, such as a display name or profile image. creto does not receive your Google password.
• Your creative work. Prompts, lyrics, reference audio, uploaded images, generated songs, cover art and related titles, settings and library organization.
• Usage and billing records. Generation and transcription requests, delivery and failure records, credit grants and consumption, subscription periods, payment references and refund or dispute evidence.
• Security and technical information. Sign-in sessions, request and error records, and network information handled by our hosting providers. When available from a trusted source, we keep the IP address used at registration and a summary of your latest successful sign-in: time, approximate country or region, browser and device type. To detect repeated signup gifts, we also keep a separate coded record derived from the IP address. These records are part of your account data.
• Communications. Information you choose to include when contacting support. Do not send passwords, API keys or full payment-card details.

Why we use it

We use this information to authenticate your account, process the creative actions you request, deliver and store music, organize your library, maintain credit and subscription records, handle support and refunds, and protect the service from misuse.

Where applicable law requires a legal basis, providing the service relies on performing our agreement with you; security and service reliability rely on legitimate interests; required financial records rely on legal obligations. Optional processing that requires consent must be offered separately. Accepting service terms is not blanket consent to unrelated marketing.

Service providers and payments

Google provides sign-in. We use service providers for account management, hosting, media storage and delivery. They process the information needed to operate these features.

To create music, artwork or transcripts, we send the text or media needed for your selected feature to the services carrying out that request. Disabled features do not send requests. These services have their own data and retention practices; an access deadline at creto does not determine how long they keep their copies.

Payments are handled by the provider shown at checkout under its own privacy notice. We receive payment references and the customer and subscription information needed to deliver your purchase. Our forms do not collect full card numbers or card security codes. Earlier purchases remain with their original payment provider.

Before music or artwork generation, we send the creative text needed for your request to Waffo for content safety screening. This includes titles, descriptions, styles and lyrics, but not uploaded audio or image files. Requests that do not pass screening cannot proceed. We keep limited screening records to handle misuse reports and appeals, without logging the prompt or credentials. Earlier artwork requests used Creem’s text-screening service.

Information may also be disclosed where required by law, to respond to valid legal requests or to protect people and the service. Providers may process information in countries other than yours; protections depend on the applicable law and provider arrangements.

Cookies, advertising and browser storage

Authentication cookies keep you signed in. Browser storage can preserve editor text and settings and support playback and navigation. Signing out or switching accounts clears private application state; clearing browser storage can remove unsaved drafts. Your browser lets you manage stored data, although blocking necessary cookies can prevent sign-in.

We work with trusted advertising and measurement partners, including Google (Google Ads and Google AdSense), to understand how visitors find creto, measure ad performance and campaign effectiveness, and display relevant information about our services. These partners may use cookies, device identifiers or similar technologies to collect information about your visits over time across different websites.

You can manage or opt out of personalized advertising by visiting Google Ads Settings, Google Advertising Privacy, or through industry opt-out tools such as the Digital Advertising Alliance, the Network Advertising Initiative and the European Interactive Digital Advertising Alliance.

Retention and deletion

Stored audio and artwork may have permanent file URLs. Anyone with one of these URLs can access the file. Marking a song private removes it from public discovery but does not restrict access to its file URL. Deleting a song removes it from Library and public lists; the stored file and its URL remain until an administrator removes the file.

Temporary reference uploads can be accessed for no more than one hour after upload and may expire sooner. This access limit does not mean stored copies are physically deleted at that time. They may remain until administrative cleanup.

Deleting a song does not erase credit, delivery, payment or refund records needed for accounting, fraud prevention, disputes or legal obligations. We retain these records for those purposes. Retention periods vary by record type; financial and security history is not necessarily deleted when you delete a song.

Your choices and privacy requests

You can edit song details and lyrics, download available music, delete songs and sign out. Depending on your location, you may also have rights to request access, correction, deletion, restriction or portability of personal information, object to certain processing, withdraw consent or complain to your local data-protection authority.

Contact support to make a privacy or account-deletion request. We may need to verify your identity and retain some information for legal or accounting reasons. Deleting an individual song does not delete your account. Self-service account deletion is not currently available.

creto is the music service at www.songcreative.com, based in Hong Kong. For account, privacy or billing questions, contact support@songcreative.com.

Changes to this notice

We will update this page when our practices change and change the date above. Material changes will be communicated through the service or another appropriate channel. Please also read our Terms of Service and Refund Policy.