Privacy Policy

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Oyodi UG (haftungsbeschränkt) i. G.
Marheinekeplatz 15
10961 Berlin
Germany

Email: info@oyodi.com
Web: https://oyodi.com

We process personal data when you visit our website, contact us, log in, create a personalized song, share content, or place an order. This includes in particular:

• contact and account data,
• technical usage and security data,
• order, contract, and payment data,
• information from the song wizard, and
• generated lyrics, audio files, and share links.

We process this data only for the purposes described in each case and on the basis of the GDPR.

When you visit our website, technically necessary access data is processed. This may include the IP address, time of access, page accessed, referrer address, browser, operating system, and status and error codes. The processing serves to deliver the website and ensure its stability and security. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and uninterrupted operation of our offering.

For hosting and server infrastructure, we use Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany.

For login, sessions, security, payment processing, and expressly requested functions, technically necessary cookies or similar storage technologies may be used. Where they are strictly necessary, storage or access takes place on the basis of § 25(2) No. 2 TDDDG. The subsequent processing of personal data is based, depending on the function, on Art. 6(1)(b) or Art. 6(1)(f) GDPR. We do not currently plan to use our own analytics, tracking, or marketing cookies.

If you contact us via the contact form or by email, we process your contact details, the content of your message, and the required metadata. The legal basis is Art. 6(1)(b) GDPR for contract-related inquiries and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in handling your inquiry.

For login by email link, we process your email address as well as authentication, session, and time data. For login links and other transactional emails, we use Resend, a service of Plus Five Five, Inc., USA. In particular, email addresses, message content, and sending, delivery, and error data are processed. The legal basis is Art. 6(1)(b) GDPR; security-related processing is additionally based on Art. 6(1)(f) GDPR.

When you use Oyodi or order a song, we process the data required for the account, order, and provision of the service. This includes in particular:

• email address and account data,
• order, contract, and billing data,
• occasion, style, and music preferences,
• names, relationships, memories, and other personalization details, and
• the generated lyrics, audio files, and other content.

Where this data concerns you personally, it is processed for the performance of pre-contractual measures and for contract performance pursuant to Art. 6(1)(b) GDPR.

Your information may relate to recipients of gifts or other third parties. We receive such data from the ordering person. Its processing may be based on Art. 6(1)(f) GDPR; our legitimate interest lies in creating the requested personalized content. Please do not enter health data or other particularly sensitive information unless such input is expressly provided for.

We use the OpenAI API to create song lyrics. For music creation, we use AI technologies from third-party providers.

Information from the song wizard, work instructions derived from it, and the generated song lyrics may be transmitted to OpenAI. In particular, song lyrics, titles, style and music specifications, technical task identifiers, and generated audio and metadata may be transmitted to downstream providers of AI technology.

The processing serves to create the song you requested. Where it concerns your own data and is necessary for this purpose, it is carried out on the basis of Art. 6(1)(b) GDPR. For information about recipients of gifts or other third parties, Art. 6(1)(f) GDPR may apply.

The providers may use further technical service providers and process data outside the European Union or the European Economic Area. The information under “Recipients and Third-Country Transfers” applies.

No automated decision-making within the meaning of Art. 22 GDPR takes place. The AI services are used exclusively for the creative generation of the ordered song and do not make any decision with legal or similarly significant effects.

We use Stripe for payments. For companies in the European Economic Area, Stripe Payments Europe, Limited, Dublin, Ireland, is generally the contractual partner; certain payment services are provided by further Stripe companies.

The data required for payment is transmitted to Stripe. This may include name, email address, billing address, order number, amount, currency, payment method, payment data, and device and transaction data. Depending on the payment method, banks, card organizations, and other payment service providers may be involved.

Stripe processes data partly on our behalf and partly under its own responsibility, in particular for payment processing, fraud prevention, and legal obligations. The legal bases are Art. 6(1)(b) GDPR and, where statutory retention obligations apply, Art. 6(1)(c) GDPR. Further information is available in Stripe’s Privacy Policy.

If you share content via a share link, we process the content, a link identifier, and the required access and security data. Any person who receives the link may be able to access the content depending on the selected sharing option. Therefore, share the link only with the intended persons.

The legal basis for the sharing function is Art. 6(1)(b) GDPR. Security-related processing may be based on Art. 6(1)(f) GDPR.

We disclose personal data only where this is necessary for the described purposes, where there is a legal obligation, where you have given consent, or where another legal basis applies. Recipients may include in particular our providers for hosting, email delivery, AI processing, and payment processing as well as their subprocessors.

Where a service provider processes data on our behalf, we enter into a contract pursuant to Art. 28 GDPR. Where data is processed outside the European Union or the European Economic Area, we comply with Art. 44 et seq. GDPR. Transfers may in particular be based on an adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses.

We store personal data only for as long as it is required for the respective purpose. After that, it is deleted or anonymized unless statutory retention obligations, overriding legitimate grounds, or ongoing legal proceedings prevent this. The following default periods apply:

• server access and error logs: 14 days;
• login links: 15 minutes or until first use; session, authentication, and email delivery data: 30 days;
• general contact inquiries: 6 months after final handling;
• unsent song wizard drafts: 7 days after the last activity;
• song inputs, prompts, and intermediate results: 30 days after final provision or the last revision;
• working data at external AI services: generally no more than 60 days;
• share links: 90 days; associated access logs: 14 days;
• account and final content: for the duration of active use, followed by deletion within 30 days. After 36 months without activity, the account may be deleted after at least 30 days’ prior notice;
• backups: rolling retention of no more than 30 days after deletion in the production system.

Contract-related data may be stored until the end of the third calendar year after full completion where this is necessary to assert or defend possible claims. Where statutory retention obligations exist, we store commercial and business letters for 6 years, booking records for 8 years, and certain books and financial statements for 10 years. These periods apply only to the respectively required documents, not generally to song inputs or audio files.

In the event of a specific security incident, legal dispute, or official order, affected data may be stored for longer to the extent required. Data held by our service providers is also subject to the retention periods applicable there.

Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing, data portability, and objection. You may withdraw consent you have given at any time with effect for the future.

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation. To exercise your rights, contact info@oyodi.com or use the postal address stated above.

You may also lodge a complaint with a data protection supervisory authority. For companies based in Berlin, the following authority is responsible in particular:

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin
Web: https://www.datenschutz-berlin.de

For contact inquiries, login, contract conclusion, and payment processing, you must provide the data marked as required in each case. Without this information, we cannot offer the relevant function or service. Voluntary information is marked accordingly.

We do not make any solely automated decisions within the meaning of Art. 22 GDPR that produce legal effects concerning you or similarly significantly affect you.

We update this Privacy Policy if our data processing activities or legal requirements change. We make the current version available on our website.

Last updated: September 2026