Privacy Policy

1. Data controller

The controller of personal data processed through the service is Lasto Marcin Stola, NIP: 5213448945, Okrąg 3a/13, 00-415 Warszawa. Privacy questions can be sent to hello@joyophone.com.

Joyophone is designed for parents and guardians. An adult must create and manage the account.

2. Information we process

• account details and user ID provided by Clerk, including contact info in the account profile;
• song personalization inputs like the child's first name, age group, theme, mood, language, description, or your own lyrics;
• generated content such as titles, lyrics, recordings, artwork and captions;
• purchase and payment data including transaction ID, amount, currency and tokens; we never store full card details;
• technical, security and diagnostic info needed to run and protect the service.

3. Purposes and legal grounds

• contract performance—accounts, song creation and storage, tokens, purchases and support;
• legal obligations—accounting, tax records and consumer rights;
• legitimate interests—security, fraud prevention, diagnostics, legal claims and improving the service;
• consent—when needed for optional features, analytics, marketing or device-stored technologies.

4. Data sources and required information

We get account info from you and Clerk, personalization inputs from parents or guardians, transaction data from payment providers, and technical data from service use.

Required info is needed to create accounts, make purchases or deliver the chosen service. At least one first name is needed for guided song creation; descriptions are optional.

5. Children’s information

A child’s first name and general interests are used only with parent or guardian permission to create a personalized song. Please don’t share surnames, addresses, schools, health info, images or contacts.

By submitting a child’s details, you confirm you have the right to do so. We may delete unnecessary info or information subject to a valid removal request.

6. Service providers and international transfers

We use providers essential for running the service, including Clerk (login), Convex (backend/database), payment processors, ElevenLabs (music creation), OpenAI (lyrics and covers), Cloudflare R2 (media storage), Resend (email), analytics with user consent, and, if consented, Meta (ads measurement and personalization).

Some providers may process data outside the European Economic Area, including the US. Transfers rely on adequacy decisions, standard contractual clauses, or other legal safeguards where required.

For details on transfer safeguards, contact hello@joyophone.com.

7. Data retention

• account data is kept while active and afterwards only as required by law or legal claims;
• songs, lyrics, names and cover art are stored until you delete them or close your account, subject to backup retention;
• transaction records are kept as long as required by accounting and tax laws;
• security logs and diagnostics are kept only as long as needed, then deleted or anonymized.

8. Your rights

• access your data and get a copy;
• correct, erase or limit processing;
• receive portable data where processing is automated and based on consent or contract;
• object to processing based on legitimate interests;
• withdraw consent anytime without affecting prior lawful processing;
• lodge a complaint with the Polish data-protection authority or your local supervisory authority.

9. Cookies and similar technologies

The service uses cookies and local tech needed for login, security, sessions and requested features. Optional analytics and marketing tools require your consent.

With consent, we use Meta Pixel and Meta Conversions API. Meta may get visit and purchase events, browser IDs and hashed user IDs to measure ad performance, attribute conversions and personalize ads. We don’t send song personalization or child info to Meta.

You can change or withdraw analytics and ad consent anytime via the Cookie settings in the service. You can also manage ad choices directly on Meta platforms.

10. Security and policy updates

We use technical and organizational measures fitting the risks, including access controls, encrypted connections and limiting provider access. No system guarantees absolute security.

To exercise your rights, email hello@joyophone.com. We reply promptly and usually within one month as GDPR requires.

We may update this policy when laws, service features or providers change. The latest update date is at the top, and major changes will be communicated clearly.