Privacy Policy

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Oyodi UG (haftungsbeschränkt)
Marheinekeplatz 15
10961 Berlin
Germany

Email: info@oyodi.com
Web: https://oyodi.com

We process personal data when you visit our website, contact us, log in, create a personalized song, share content, or place an order. This includes in particular:

• contact and account data,
• technical usage and security data,
• order, contract, and payment data,
• information from the song wizard, and
• generated lyrics, audio files, and share links.

We process this data only for the purposes described in each case and on the basis of the GDPR.

When you visit our website, technically necessary access data is processed. This may include the IP address, time of access, page accessed, browser, operating system, and status and error codes; technical fault reports may contain further connection details. The processing serves to deliver the website and ensure its stability and security. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and uninterrupted operation of our offering.

For hosting and server infrastructure, we use Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany.

For login, sessions, security, payment processing, and expressly requested functions, technically necessary cookies or similar storage technologies may be used. Where they are strictly necessary, storage or access takes place on the basis of § 25(2) No. 2 TDDDG. The subsequent processing of personal data is based, depending on the function, on Art. 6(1)(b) or Art. 6(1)(f) GDPR. We do not use tracking cookies, advertising or marketing cookies, or any cross-site tracking. Our own data-minimal page statistics are described in the paragraphs below: the server-side counting of delivered pages sets no cookies, uses no identifiers and runs no script in your browser, while the additional reporting of page changes inside an already open page happens only with your consent.

Page statistics, part 1 — server-side counting of delivered pages: when our web server successfully delivers a public page, it counts that request. All that reaches the statistics is a fixed combination of page category, language and bot class; the only durable records are daily totals, formed from the calendar day (Europe/Berlin time zone), the page category, the language and the bot class. Not stored and not passed to the statistics: IP addresses, IP hashes, referrers, query strings or fragments of the address, private links, full user agents, and visitor, session or account identifiers. The user agent your browser sends is checked transiently against a fixed pattern list so that recognisable bots can be reported separately; accesses we do not recognise are not reported as humans. For this counting we store nothing on your device and read nothing back that is stored there; on our assessment of this specific implementation § 25 TDDDG is not engaged for the counting of delivered pages. For the classification of the automatically transmitted user agent we do not regard the legal position as settled — the fact that we set no cookies and trigger no additional request does not decide that question. The processing of the connection data that arises transiently during the request rests on our legitimate interest under Art. 6(1)(f) GDPR in understanding how our own content and languages are used. That assessment concerns exactly the collection described here; it is not a general statement that server-side analysis never needs consent.

You can object to this counting under Art. 21 GDPR — please use the contact address above; we will assess your individual case and tell you the outcome. Please note what we can technically do: because we store no identifier and no feature by which individual requests could be attributed to a person, once the daily totals are formed there is no longer any individual record that could be handed over, corrected or deleted. An objection therefore takes effect for the future: we can restrict or switch off the counting as a whole and confirm that to you. Your rights under Art. 15 to 22 GDPR are unaffected; we are simply being open about what they can attach to in this collection.

Page statistics, part 2 — voluntary reporting of page changes: additionally, and only with your express consent, your browser reports later page changes inside the page you already have open. The report contains exactly two things: the category of the page reached and its language. The legal basis is your consent under Art. 6(1)(a) GDPR. This optional function accesses your device; it therefore additionally rests on § 25(1) TDDDG and so on your consent, separately from the storing of your decision. The only thing PERSISTED on your device for it is your consent decision together with the version of this notice — no identifier and no count. While the consent is in force, the open page additionally holds in memory which page category and language are currently on screen; that is the comparison value by which a page change is recognised at all. It is always a single current value, never a history and never an identifier, and withdrawing discards it immediately. You can withdraw your consent at any time via the cookie settings; withdrawal takes effect for the future, daily totals already formed remain and contain nothing about you. If we change the collection described here we will ask again. Without consent your browser reports nothing, and nothing is transmitted afterwards either.

Both parts share these limits: only public pages are counted. Not counted are views in the signed-in area, private share or card links, API, file and status requests, and administrative access. The two sources are always reported separately and never combined into a visitor figure. We build no usage profiles, use no recognition features, publish no unique-visitor figures, run no advertising measurement, and link the counting to no song, account or purchase. Daily totals are deleted once a configured retention period expires; the default is 365 days, and the permitted range is at least 30 and at most 1095 days.

Access analysis (server access log): for operation, security and the analysis of requests we additionally keep an access log of our web server. Per request it holds: your IP address in its original form, the time, the requested path without its query part — including the paths of shared songs and greeting cards —, the status code, the size of the response, and the browser identifier (user agent) your browser sends. It does not contain query values, login or callback tokens, cookies, authorization headers, or the referrer address. We evaluate these logs internally in the protected admin area. To assign a country and a continent we use a local database on our own server; your IP address is neither passed to nor looked up with any third party for this, and the assignment is an estimate, not a location fix. The hourly log files kept for this analysis are deleted automatically after a preset period of 14 days; if the configured storage limit is reached, the oldest of those hourly files are dropped earlier. This analysis is separate from the data-minimal page statistics described above and is never combined with them; what is described there continues to apply unchanged. The legal basis stated above for access data applies.

If you contact us via the contact form or by email, we process your contact details, the content of your message, and the required metadata. The legal basis is Art. 6(1)(b) GDPR for contract-related inquiries and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in handling your inquiry.

For login by email link, we process your email address as well as authentication, session, and time data. For login links and other transactional emails, we use Resend, a service of Plus Five Five, Inc., USA. In particular, email addresses, message content, and sending, delivery, and error data are processed. The legal basis is Art. 6(1)(b) GDPR; security-related processing is additionally based on Art. 6(1)(f) GDPR.

While the automatic quota refill is switched on, we use the same service to send a notification to your email address once free music generation attempts have been credited to your account again. This processes your email address, the language stored for that notification, and sending, delivery and error data. You can unsubscribe from this notification at any time — via the link in the email or in your account settings. The crediting of the attempts itself, as well as login links and order confirmations, are unaffected.

Where a purchased song is available online for a limited period only, we use the same service to send you a reminder to your email address before that period ends. This processes your email address, the language stored for that reminder, the end date of the period, and sending, delivery and error data. You can unsubscribe from this reminder at any time — via the link in the email or in your account settings; the reminder and the automatic-refill notification can be unsubscribed from independently of each other. Unsubscribing changes no deadline and does not lead to earlier deletion. Login links and order confirmations are unaffected.

When you use Oyodi or order a song, we process the data required for the account, order, and provision of the service. This includes in particular:

• email address and account data,
• order, contract, and billing data,
• occasion, style, and music preferences,
• names, relationships, memories, and other personalization details, and
• the generated lyrics, audio files, and other content.

Where this data concerns you personally, it is processed for the performance of pre-contractual measures and for contract performance pursuant to Art. 6(1)(b) GDPR.

Your information may relate to recipients of gifts or other third parties. We receive such data from the ordering person. Its processing may be based on Art. 6(1)(f) GDPR; our legitimate interest lies in creating the requested personalized content. Please do not enter health data or other particularly sensitive information unless such input is expressly provided for.

We use the OpenAI API to create song lyrics. For music creation, we use AI technologies from third-party providers.

Information from the song wizard, work instructions derived from it, and the generated song lyrics may be transmitted to OpenAI. In particular, song lyrics, titles, style and music specifications, technical task identifiers, and generated audio and metadata may be transmitted to downstream providers of AI technology.

The processing serves to create the song you requested. Where it concerns your own data and is necessary for this purpose, it is carried out on the basis of Art. 6(1)(b) GDPR. For information about recipients of gifts or other third parties, Art. 6(1)(f) GDPR may apply.

The providers may use further technical service providers and process data outside the European Union or the European Economic Area. The information under “Recipients and Third-Country Transfers” applies.

No automated decision-making within the meaning of Art. 22 GDPR takes place. The AI services are used exclusively for the creative generation of the ordered song and do not make any decision with legal or similarly significant effects.

We use Stripe for payments. For companies in the European Economic Area, Stripe Payments Europe, Limited, Dublin, Ireland, is generally the contractual partner; certain payment services are provided by further Stripe companies.

The data required for payment is transmitted to Stripe. This may include name, email address, billing address, order number, amount, currency, payment method, payment data, and device and transaction data. Depending on the payment method, banks, card organizations, and other payment service providers may be involved.

Stripe processes data partly on our behalf and partly under its own responsibility, in particular for payment processing, fraud prevention, and legal obligations. The legal bases are Art. 6(1)(b) GDPR and, where statutory retention obligations apply, Art. 6(1)(c) GDPR. Further information is available in Stripe’s Privacy Policy.

If you share content via a share link, we process the content, a link identifier, and the required access and security data. Any person who receives the link may be able to access the content depending on the selected sharing option. Therefore, share the link only with the intended persons.

The legal basis for the sharing function is Art. 6(1)(b) GDPR. Security-related processing may be based on Art. 6(1)(f) GDPR.

In addition, we count views of shared song links: when the public page of a song link is delivered successfully, a total counter per song and song version is increased. Only that number is stored — no IP addresses, no IP hashes, no visitor, session or account identifiers, no referrers, no full user agents, no times of individual views, and not the link itself. For this count we store nothing on your device and read nothing stored there. The user agent sent with the request is checked only temporarily against a fixed pattern list so that recognisable bots and preview requests are not counted. The number is shown only to us internally and is neither a visitor count nor a play count: opening the link again counts, undetected bots may be counted, and technical errors may lose counts. Counting starts with the introduction of this feature; earlier views cannot be reconstructed. This counting is separate from the website statistics in section 3; private share and card links are still not included there. If the song record is permanently removed from our database, the counter goes with it; merely marking a song as deleted leaves the number in place.

We disclose personal data only where this is necessary for the described purposes, where there is a legal obligation, where you have given consent, or where another legal basis applies. Recipients may include in particular our providers for hosting, email delivery, AI processing, and payment processing as well as their subprocessors.

Where a service provider processes data on our behalf, we enter into a contract pursuant to Art. 28 GDPR. Where data is processed outside the European Union or the European Economic Area, we comply with Art. 44 et seq. GDPR. Transfers may in particular be based on an adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses.

We store personal data only for as long as it is required for the respective purpose. After that, it is deleted or anonymized unless statutory retention obligations, overriding legitimate grounds, or ongoing legal proceedings prevent this. The following default periods apply:

• server access and error logs: 14 days;
• login links: 15 minutes or until first use; session, authentication, and email delivery data: 30 days;
• general contact inquiries: 6 months after final handling;
• unsent song wizard drafts: 7 days after the last activity;
• song inputs, prompts, and intermediate results: 30 days after final provision or the last revision;
• working data at external AI services: generally no more than 60 days;
• share links: 90 days; associated access logs: 14 days;
• audio files of purchased songs with a limited online availability: for the duration of the period shown during the ordering process and repeated in the order confirmation, plus an internal transition period during which the files are no longer accessible; after that they are deleted. Purchases made without such a limit keep the terms that applied at the time. Lyrics, order and contract data are not covered by this;
• account and final content: for the duration of active use, followed by deletion within 30 days. After 36 months without activity, the account may be deleted after at least 30 days’ prior notice;
• backups: rolling retention of no more than 30 days after deletion in the production system.

Contract-related data may be stored until the end of the third calendar year after full completion where this is necessary to assert or defend possible claims. Where statutory retention obligations exist, we store commercial and business letters for 6 years, booking records for 8 years, and certain books and financial statements for 10 years. These periods apply only to the respectively required documents, not generally to song inputs or audio files.

In the event of a specific security incident, legal dispute, or official order, affected data may be stored for longer to the extent required. Data held by our service providers is also subject to the retention periods applicable there.

Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing, data portability, and objection. You may withdraw consent you have given at any time with effect for the future.

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation. To exercise your rights, contact info@oyodi.com or use the postal address stated above.

You may also lodge a complaint with a data protection supervisory authority. For companies based in Berlin, the following authority is responsible in particular:

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin
Web: https://www.datenschutz-berlin.de

For contact inquiries, login, contract conclusion, and payment processing, you must provide the data marked as required in each case. Without this information, we cannot offer the relevant function or service. Voluntary information is marked accordingly.

We do not make any solely automated decisions within the meaning of Art. 22 GDPR that produce legal effects concerning you or similarly significantly affect you.

We update this Privacy Policy if our data processing activities or legal requirements change. We make the current version available on our website.

Last updated: September 2026