Privacy Policy

1. Data controller

The controller of personal information processed through the service is Lasto Marcin Stola, NIP: 5213448945, Okrąg 3a/13, 00-415 Warszawa. Privacy questions may be sent to hello@joyophone.com.

Joyophone is intended for parents and guardians. An adult should create and manage the account.

2. Information we process

• account information and the user identifier provided by Clerk, including contact information available in the account profile;
• song personalization inputs such as a child's first name, age range, theme, mood, language, description or user-provided lyrics;
• generated materials including titles, lyrics, recordings, cover art and captions;
• purchase and payment records such as the transaction identifier, amount, currency and tokens; we do not store complete card details;
• technical, security and diagnostic information needed to operate and protect the service.

3. Purposes and legal bases

• performance of a contract—accounts, song generation and storage, tokens, purchases and support;
• legal obligations—accounting, tax records and consumer rights;
• legitimate interests—security, fraud prevention, diagnostics, legal claims and service improvement;
• consent—where required for optional features, analytics, marketing or device-storage technologies.

4. Sources and required information

We receive account information from you and Clerk, personalization inputs from a parent or guardian, transaction records from payment providers, and technical data through use of the service.

Information marked as required is necessary to create an account, make a purchase or perform the selected service. At least one first name is required for guided song generation; additional description is optional.

5. Children's information

A child's first name and general interests are processed at a parent or guardian's direction solely to create a personalized song. Please do not provide a surname, address, school, health information, image or contact details.

By submitting child information, you confirm that you are authorized to do so. We may remove information that is unnecessary or subject to a valid deletion request.

6. Service providers and international transfers

We use providers needed to run the service, including Clerk (authentication), Convex (backend and database), payment providers, ElevenLabs (music generation), OpenAI (lyrics and cover creation), Cloudflare R2 (media storage), Resend (email), analytics services enabled with the user's choice and, after the required consent, Meta and TikTok (advertising measurement and personalization).

Some providers may process information outside the European Economic Area, including in the United States. Where required, transfers rely on an adequacy decision, standard contractual clauses or another lawful safeguard.

For information about transfer safeguards, contact hello@joyophone.com.

7. Retention

• account information is kept while the account is active and afterwards only as required by law or for legal claims;
• songs, lyrics, names and cover art are kept until deleted by the user or the account is closed, subject to backup retention;
• transaction records are retained for the period required by accounting and tax law;
• security logs and diagnostic data are kept only as long as needed and are then deleted or anonymized.

8. Your rights

• access your information and receive a copy;
• correct, erase or restrict processing;
• receive portable data where processing is automated and based on consent or contract;
• object to processing based on legitimate interests;
• withdraw consent at any time without affecting earlier lawful processing;
• lodge a complaint with the Polish data-protection authority or your local supervisory authority.

9. Cookies and similar technologies

The service uses cookies and local technologies required for authentication, security, sessions and requested functionality. Optional analytics or marketing technologies are enabled only in line with the user's consent choice.

After consent, we use Meta Pixel and Meta Conversions API. Meta may receive visit and purchase events, browser identifiers, and cryptographically hashed user identifiers to measure advertising performance, attribute conversions, and personalize ads. We do not send song-personalization content or children's information to Meta.

After consent, we also use TikTok Pixel and TikTok Events API. TikTok may receive visit and purchase events, browser or device identifiers, and cryptographically hashed user identifiers to measure advertising performance and attribute conversions. We do not send song-personalization content or children's information to TikTok.

You can change or withdraw analytics and advertising consent at any time through the Cookie settings button available in the service. You can also manage advertising choices directly in Meta and TikTok products.

10. Security and policy changes

We apply technical and organizational safeguards appropriate to the risk, including access controls, encrypted connections and limiting provider access. No system can guarantee absolute security.

To exercise your rights, email hello@joyophone.com. We respond without undue delay and normally within one month as required by the GDPR.

We may update this policy when law, service functionality or providers change. The latest update date appears at the top, and material changes will be communicated appropriately.