Privacy Policy

1. Who is responsible

The data controller is YunLong Li, an individual operating under the laws of Australia. Contact for privacy questions and requests: support@tapemoon.com.

We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles, and with the privacy laws of the other places where we offer the Service.

Payments are handled by Waffo Pancake, our reseller and Merchant of Record. It is a separate, independent controller of the payment, account and fraud-prevention data it collects when you pay, and its own privacy statement applies to that data.

2. Data we collect

You give us

• Account data: email address, display name, and basic profile data from Google or another sign-in provider if you use one.
• Your content: audio files you upload, song share links you paste (and the audio and details we fetch from them), lyrics, prompts and any other material you submit, plus the audio analysis, storyboards, images, audio and videos generated for you.
• Communications: emails, support requests, reports and feedback you send us.

From Waffo Pancake

• Your name, email, country, the plan or pack purchased, amount, currency, order or transaction ID, and payment and refund status.
• We never receive or store your full card number, card security code or payment account password.

Collected automatically

• Technical data: IP address, browser, device type, operating system and time zone.
• Usage data: pages and features used, generation requests, credit usage, errors and performance logs.
• Safety data: results of automated content moderation on prompts and outputs, and records of reports and enforcement decisions.

3. How we use it

We do not use your content or Outputs to train our own or third-party AI models, and we do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

4. Cookies

We use strictly necessary cookies and similar storage, for example to keep you signed in and to protect forms against abuse. We count visits with two analytics tools that record pages viewed and a few actions (such as starting a video): Plausible, a cookie-free tool we host ourselves, and Google Analytics, which sets its own cookies to count visits and tell new visitors from returning ones. Google’s own privacy policy covers what it does with that data. We do not use advertising cookies. If we add marketing cookies, we will update this policy first and ask for your consent where the law requires it.

5. Who we share it with

We share personal data only with service providers that help us run the Service, under contracts that limit their use of it to providing their service to us:

• Cloudflare: hosting, content delivery, storage and security.
• AI model providers: your audio, lyrics, prompts and inputs are sent to the providers of the models listed in our Terms, only to generate your Outputs.
• Waffo Pancake, our reseller and Merchant of Record: processes purchases, subscriptions and refunds as a PCI-DSS certified processor, and receives your email address, payment details and billing country for tax, invoices and fraud prevention, as described in Section 1.
• Google: Google Analytics measures how the site is used, as described in Section 4.
• Email delivery providers: to send receipts, account and support emails.

We may also disclose data when required by law or a valid legal request, to report child sexual abuse material or other serious harm to the competent authorities, to protect the rights and safety of users and the public, or as part of a merger or acquisition (with notice to you). We do not sell or share your personal data for cross-context behavioral advertising, as those terms are defined under the CCPA.

6. How we protect it

• All traffic to the Service, including checkout, is encrypted with TLS (HTTPS).
• Payment details are entered directly on Waffo Pancake’s PCI-DSS compliant pages and are never stored on our servers.
• Access to production data is limited to people who need it to run the Service.

If a data breach is likely to affect your rights, we will notify you and the relevant authorities as required by law, generally within 72 hours of becoming aware of it.

7. How long we keep it

8. Your rights

Depending on where you live (including under the GDPR, UK GDPR and California law), you can ask us to:

• tell you what personal data we hold and give you a copy;
• correct inaccurate data;
• delete your data and your account;
• give you your data in a portable, machine-readable format;
• restrict or object to processing based on legitimate interests;
• stop marketing emails, or withdraw any consent you gave.

Email support@tapemoon.com from your account email. We respond within 30 days and will not treat you differently for exercising your rights. You can unsubscribe from marketing emails using the link in any of them. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or to your local data protection authority.

9. International transfers

We are based in Australia, and we and our providers process data in several countries, including the United States, through Cloudflare’s global network. Where we transfer personal data out of the EU, the UK or Switzerland, we rely on safeguards such as the European Commission’s Standard Contractual Clauses in our providers’ data processing agreements.

10. Children

The Service is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, contact us and we will delete it.

11. Changes

We will update the date at the top of this page when this policy changes, and email you at least 14 days before any material change takes effect.

12. Contact

Privacy requests and questions: support@tapemoon.com. Operator: YunLong Li, an individual operating under the laws of Australia.