Who we are
MUZAI is operated by VİSORYA YAZILIM VE TEKNOLOJİ ANONİM ŞİRKETİ, Akademi Mah. Gürbulut Sk. Teknokent Teknokent No: 67 Selçuklu/Konya, Türkiye. We are the data controller for everything described here — under Turkish Law No. 6698 (KVKK) and, where it applies to you, the GDPR. Written for the website and for the iOS and Android apps alike; the differences between them are called out where they matter.
1. What we collect
Your account. On the web an account is required. In the apps you can start from a device identifier alone, without ever giving us an email address. If you do register, we hold your email, your password as a hash, an auto-generated username you can change, an optional profile image, your language, a support reference, an invite code and a notification token if you turn notifications on. Signing in with Google or Apple gives us the identifier and whatever name and email you let them share.
What you create with. The prompts, lyrics, style, mood and voice choices you enter, images you upload for artwork or for a song from a photo, a photo of your face if you make a music video, and the songs, covers and videos that come back — plus whether you marked each one public. Please keep personal details about yourself or other people out of prompts and photos: they are sent to the AI providers in section 3.
Your voice, if you choose. The voice-tone feature records you, or takes a recording you upload, so a voice can be built from it. It asks you to read a short phrase aloud, and our AI provider compares that reading with your recording to check that the voice is yours. It only runs if you start it and allow the microphone. We treat these recordings as sensitive, and we use them only for the voice-tone feature and that check, not to identify you anywhere else. They are sent to the AI provider named in section 3, kept as described in section 5, and stored under random file names that are not behind a sign-in.
Payments and usage. Purchases, credit balance and a ledger of what each generation spent. Device model and OS, app version, IP address, an approximate country from that IP, access logs and error logs. When you sign up we also record the device identifier and the IP address you signed up from, so the sign-up bonus cannot be claimed over and over; that record stays after you delete the account. We do not collect GPS location and the apps never ask for it.
2. How we use data
To generate your music and keep your library, to run your account and answer support, to take payment, to send the notifications you enabled, to keep the service secure and stop abuse, and to meet our legal obligations. The legal grounds are performance of our contract with you for everything the product does, our legitimate interest in security and in measuring our own marketing and product, your consent — which you give when you choose to record or upload your voice or a photo and allow microphone or photo access, and, on iOS, when you answer the tracking prompt — and, on the website, your consent for Google cookies and ad measurement wherever the law requires consent (the UK, the EEA, Switzerland and Canada), and legal obligation for financial records.
Analytics and app tracking. The mobile apps use Firebase Analytics to see which features are used and where generations fail: it records events such as sign-up and login, plays and favourites, generations started, finished or failed (with the source, mood and genre chosen), paywall steps with the plan shown, and the text you type into Discover search, together with your MUZAI user ID. They also use AppsFlyer to work out which advertising campaign led to an install, and RevenueCat to manage subscriptions; both receive your MUZAI user ID, and the table in section 3 lists what else each one gets. AppsFlyer and Firebase start when the app opens and RevenueCat when you first open the paywall, which on iOS is before the App Tracking Transparency prompt appears (the prompt comes after sign-up and the first paywall), and they keep working if you say no: the prompt decides only whether your iOS advertising identifier is used, so attribution runs without it. On Android there is no such prompt; the tools use the advertising ID your device settings allow, which you can reset or delete in Android Settings under Privacy and Ads. So that we can tell whether the ads we run actually work, AppsFlyer reports that events such as an app open, a registration or a purchase happened to the platform that showed the ad — from the apps, today that is Meta only; a purchase report can include the amount, and your name, email address and phone number are not part of any report. Purchases made on the website are measured separately, with Google, as described below. We do not keep an advertising profile about you: we hold no user profile built for ad targeting, we do not sell your personal information, and we run no ad network inside MUZAI. Meta, which receives the event reports described above, does use them to decide who to show our ads to and to train its own advertising systems; what happens there is governed by Meta's own terms and is outside our control. We do not use your prompts or your music to train our own models.
Website analytics and ad measurement. On muzaimusic.com we use Google Analytics to see which pages are used, and Google Ads to see which ad led to a sign-up or a purchase. They set the cookies _ga, _ga_* (Analytics) and _gcl_* (Google Ads). In the UK, the EEA, Switzerland and Canada, and wherever we cannot tell where you are, these two tags are not loaded until you accept in the cookie banner, so before that they send Google no measurement data and set no cookies (if you are in one of those regions but our check did not notice, Google itself sees where you are and the tag then runs in Google’s consent-denied mode: no cookies, only basic cookie-free signals). Elsewhere, including the United States, they are on by default and you can switch them off at any time with “Your privacy choices” in the footer. In every region you can change or withdraw your choice there whenever you like; withdrawing deletes the Google cookies we can reach and stops the tags from sending anything more.
Purchases. When you buy credits, Google Analytics and Google Ads are told that a purchase happened: by your browser (wherever measurement is on for you, as described above), and again by our server once the payment is confirmed (both reports carry the same order reference, so it counts once). The server report contains the order reference, the amount and currency and, only where advertising measurement is on for you, the Google click ID and the Google Analytics client ID; it does not contain your name or email address. Where advertising measurement is on for you, your browser also sends Google a SHA-256 hash of your account’s email address with the purchase, with the start of checkout and with a sign-up, so Google can match them to an ad. Where it is off (you declined or withdrew it, or your browser sends Global Privacy Control), none of that is sent. The same attribution values (the click ID and the campaign tags of the link you came through) are also stored with your order at our payment provider, Creem.
3. Who we share it with
We name our processors rather than describing them vaguely, because your creative input genuinely leaves our servers to be turned into music. The table below lists every outside service the apps and the website use and what each one receives.
Generation. kie.ai (which runs the Suno model and our voice and face-swap tools) receives your prompt, lyrics and style choices to compose and sing; the audio of a song when you make a cover of it; your voice recordings and the phrase you read for the voice-tone feature; and your face photo when you make a music video. fal.ai receives the face-swapped video and the song clip to sync the lips. Google Gemini receives your prompt and lyrics to write lyrics and text and, if you use song-from-a-photo, your photo. Files reach these providers as links to copies on our Cloudflare storage; the links are random but are not behind a sign-in.
Running the service. Cloudflare R2 stores and delivers finished media and everything you upload. Mailgun sends account email. Firebase (Google) handles push, analytics and bot protection. AppsFlyer handles install attribution. Meta receives install and in-app event signals through AppsFlyer so we can measure and improve the ads we run. Google (Google Analytics and Google Ads) receives website analytics and purchase measurement as described in sections 2 and 7. RevenueCat verifies mobile subscriptions. Laravel Nightwatch monitors errors on our servers. Hetzner holds encrypted backups. Creem (Armitage Labs OÜ, Estonia) is our merchant of record and takes card payments on the website — your card number is entered on Creem’s systems and we never see or store it. Apple and Google handle sign-in and app-store purchases. While the apps are open they also fetch a tiny page from Google, Cloudflare and Apple about every 20 seconds to tell whether you are online; those three see your IP address and nothing from your account.
Each is used only for the job above and is bound by its own terms and privacy policy. How long the AI providers keep what we send them, and whether they use it to improve their own models, is set by those terms, not by us. Beyond these, we share data only when the law requires it. We do not use Crashlytics or Sentry, and we run no advertising network.
| Service | What it receives | Why | Privacy policy |
|---|---|---|---|
| AppsFlyer | Install and session times, device model, OS, app version, language and IP address; device identifiers (iOS IDFV, and the iOS advertising identifier only if you allow it; the Android advertising ID); your MUZAI user ID; and app events such as sign-up, login, paywall views, the plan you chose and purchase results. | Finding out which advertising campaign led to an install, and reporting install, registration and purchase events to Meta. | Read |
| Meta (through AppsFlyer; the apps contain no Meta SDK) | Install and in-app event signals passed on by AppsFlyer (an app open, a registration, a purchase — which can include the amount). Never your name, email address or phone number. | Measuring and improving the ads we run. Meta also uses these signals to decide who to show our ads to and to train its own advertising systems. | Read |
| Firebase Analytics (Google) | A Firebase app-instance ID, device model, OS, app version, language, an approximate location from a masked IP address, advertising identifiers (the Android advertising ID; the iOS advertising identifier only if you allow it; IDFV), your MUZAI user ID, and events: sign-up and login, plays and favourites, generations started, finished or failed with the source, mood and genre, paywall steps with the plan shown, and the text you type into Discover search. | Seeing which features are used and where generations fail. | Read |
| Firebase Cloud Messaging (Google) | Notification token, Firebase installation ID, device model, OS, language and time zone. | Delivering the push notifications you turned on. | Read |
| Firebase App Check (Google) | A signed token showing that a request comes from the genuine MUZAI app on a real device (Apple App Attest or DeviceCheck, Google Play Integrity). | Stopping bots and abuse of our servers. | Read |
| RevenueCat | Purchase and subscription history, store receipts, your MUZAI user ID, country and currency, the AppsFlyer ID, and the device identifiers it collects (iOS IDFV and IP address, plus the advertising identifier if you allow it; the Android advertising ID and IP address). | Verifying and managing subscriptions on iOS and Android, and passing subscription events to AppsFlyer. | Read |
| kie.ai | Your prompt, lyrics and style choices; the audio of a song when you make a cover; your voice recordings and the phrase you read for the voice-tone feature; and your face photo for a music-video face swap. | Composing and singing songs (Suno model), covers, voice tones and music-video face swaps, and checking that a voice recording is yours. | Read |
| fal.ai | The face-swapped video and the song clip. | Syncing the lips in a music video. | Read |
| Google Gemini | Your prompt and lyrics, and your photo if you use song-from-a-photo. | Writing lyrics and text from what you enter. | Read |
| Cloudflare (R2, CDN) | Everything you upload or generate: voice recordings, photos, covers, songs and videos, stored under random file names at cdn.muzaimusic.com. They are not behind a sign-in, so anyone who has the exact link can open the file. | Storing and delivering finished media, and handing files to the AI providers. | Read |
| Mailgun | Your email address and the text of the emails we send you. | Account email and, if you opted in, product and marketing email. | Read |
| Hetzner | Encrypted copies of our database and files (section 5), held in Germany. | Backups, so we can recover from a failure. | Read |
| Laravel Nightwatch | Records of server errors and some requests, tagged with your user ID and username (not your email address). | Finding and fixing faults on our servers. | Read |
| Sign in with Google / Apple | The identifier, and the name and email address you let them share. | Letting you sign in without a password of your own. | Google · Apple |
| Creem | Your billing details for website card payments, and the order and ad-click values described in section 2. | Merchant of record: taking payment for website purchases. | Read |
| Google Analytics and Google Ads (website) | Which pages are used, the ad click ID and campaign tags, and purchase reports, as described in sections 2 and 7. | Website analytics and ad measurement. | Read |
| Connection check (Google, Cloudflare, Apple) | While an app is open it fetches a tiny page from each about every 20 seconds, so they see your IP address. No account data is sent. | Telling whether you are online. | — |
4. Where it is processed
Your account, your generation records and our database live on our own servers in Türkiye. That is where the primary processing happens. Encrypted backups of the database and files are kept at Hetzner in Germany.
The providers in section 3 are outside Türkiye, so using MUZAI necessarily involves an international transfer: your prompt, along with the voice recordings and photos you choose to use, goes abroad to be turned into music, and finished media is distributed worldwide over Cloudflare’s network so it plays quickly wherever you are. There is no version of the product where this does not happen — if you would rather your input did not leave Türkiye, MUZAI cannot generate music for you, and that is the honest trade. Starting a generation is you asking us to send it, and you consent to that transfer when you do.
5. How long we keep it
Account data and your creations: for as long as the account exists. When you delete your account, your sign-in details are erased straight away — email, password hash, device identifier, notification token, profile image and linked Google or Apple sign-in — and your username is replaced with a placeholder. Your songs, covers, playlists, videos and voice recordings are removed from your account and are no longer shown to you or to anyone else in the apps or on the website, but the stored files and database records behind them are not yet erased automatically at that moment, so someone who already has the exact link to a file can still open it. Until we add an automatic clean-up, we erase them within 30 days when you write to us (section 6).
Voice recordings: each one is given a 14-day expiry date in the app, but nothing deletes it on that date yet, so it stays until you delete it. Deleting a recording in the app removes it from your account straight away; the stored file and the short verification clip are erased by the clean-up described above or when you ask us. The voice model that kie.ai builds from a recording stays with kie.ai: we do not currently send it a deletion request when you delete a recording.
Copies held by AI providers: what we send to kie.ai, fal.ai and Google (section 3) is kept under their own retention rules. We do not currently send them deletion requests when you delete something or your account; to ask them directly, use the privacy contacts on the policies linked in section 3.
Support conversations: two years after the request is closed.
Payment and invoice records: ten years, because Article 82 of the Turkish Commercial Code requires it. This one we cannot shorten on request.
Analytics: up to 14 months. Server access logs: 12 months.
Backups: encrypted off-site copies of our database and files are kept as 14 daily, 8 weekly and 12 monthly copies, so something erased from our live systems can remain in a backup for up to about 12 months, until the oldest copy ages out.
6. Your rights
You can ask what we hold about you, have it corrected or erased, have a copy sent to you, object to processing we base on legitimate interest, and withdraw a consent you gave — including for voice recordings and photos, for the iOS advertising identifier (switch it off in your device settings at any time; on Android you can reset or delete your advertising ID there) and for cookies and ad measurement on the website (“Your privacy choices” in the footer).
You can see and correct your account details in Settings, and delete your account there at any time; deleting it erases your sign-in details and takes your creations out of view, as set out in section 5. To have the stored copies of your content erased as well, write to us as described below. Note that deleting your MUZAI account does not cancel a subscription billed by an app store — cancel that in the store that bills it.
For anything else write to support@muzaimusic.com from the address on your account, so we can tell it is you asking. We answer within 30 days. If you are not satisfied, you can complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), or in the EEA and UK to your local supervisory authority.
7. Cookies & local storage
What the site keeps in your browser’s local storage is what makes it work: a device id, your sign-in token, a cached copy of your profile, your language choice, your cookie choice and any generation still running — so you stay signed in and don’t lose work on a refresh. These are strictly necessary and always on. Clearing site data in your browser erases every one of them and signs you out. Choosing to sign in with Google or Apple hands you to that provider, which sets cookies of its own under its own policy. Pages that offer “Sign in with Google” also load Google’s own sign-in script from Google’s servers, whatever you chose in the cookie banner; that script is Google’s, under Google’s policy, and is separate from the two Google tags described below.
Google Analytics and Google Ads. In the UK, the EEA, Switzerland and Canada, and wherever we cannot tell where you are, the site sets Google cookies only with your permission (see section 2). Elsewhere, including the United States, they are on by default until you switch them off with “Your privacy choices” (or your browser sends Global Privacy Control, which turns off the advertising side). The cookies are _ga and _ga_* (Analytics, up to two years) and _gcl_* (Google Ads, about 90 days). Arriving through an ad also stores that ad’s click ID and campaign tags (utm_source, utm_campaign and similar) in your browser’s local storage for up to 90 days, so a later purchase can be tied to the ad. Where permission is required and you have not given it, or after you withdraw it, none of these is written.
Your privacy choices (US). We do not sell your personal information. Under some US state laws, such as California’s, sending data to Google for ad measurement can count as “sharing”. To opt out, use the “Do Not Sell or Share My Personal Information” button below or “Your privacy choices” in the footer: it turns advertising measurement off and deletes the cookies it set. We also treat a Global Privacy Control signal from your browser as that opt-out, for ad personalization and for sending your data to Google for advertising.
8. Children
MUZAI is not for children under 13, and we do not knowingly collect their data. In the EEA the age at which someone can consent on their own runs from 13 to 16 depending on the country; if you are under it, a parent or guardian has to agree on your behalf. If you believe a child has given us data, write to us and we will delete it.
9. Contact
The quickest route is Contact us in the More menu — it opens a support ticket and the reply comes back on that same screen. For privacy questions and data requests specifically, write to support@muzaimusic.com. VİSORYA YAZILIM VE TEKNOLOJİ ANONİM ŞİRKETİ, Akademi Mah. Gürbulut Sk. Teknokent Teknokent No: 67 Selçuklu/Konya, Türkiye. MERSİS 0925132165500001 · Meram V.D. 925 132 1655 · 0850 242 96 93.