This policy explains what personal data Osyren Studio collects, why, and what rights you have. The data controller is KDN Estate SRL, established in Romania ("we").
We built Osyren Studio to collect as little as possible: no advertising trackers, no sale of your data, and payment card details never touch our servers.
The English version of this policy is the governing version; the Romanian version is a courtesy translation.
1. Data we collect
•
Account data: email address, display name, profile photo (if you set one), authentication identifiers (via Firebase; if you sign in with Google or Apple, we receive your name, email and photo from them).
•
Profile data you choose to add: artist name, bio, external links.
•
Content: the prompts, lyrics, photos and audio you upload, and the songs/videos generated for you.
•
Community activity: what you publish, likes, views, follows.
•
Purchase data: credit balance, purchase history, Stripe transaction identifiers. Your full card number never reaches us — it is handled entirely by Stripe.
•
Technical data: IP address, device/browser type, language, timezone, and server logs needed for security and debugging.
2. Why we process it (legal bases)
•
To provide the Service — accounts, generation, storage, community, payments (performance of contract, art. 6(1)(b) GDPR).
•
To keep the Service safe — abuse prevention, rate limiting, moderation, fraud prevention (legitimate interest, art. 6(1)(f)).
•
To comply with legal obligations — accounting, tax, responding to lawful requests (art. 6(1)(c)).
•
With your consent, where we ask for it explicitly (art. 6(1)(a)) — you can withdraw it at any time.
3. AI processing of your content
To generate music and video, your prompts, lyrics, photos and audio are sent to third-party AI providers (OpenAI, Replicate, fal.ai and ElevenLabs) strictly to produce your requested output.
We use these providers under their business terms, which do not permit them to use your content to train their models.
4. Who processes data for us
•
Google Firebase (Google Ireland/Google LLC) — authentication, database, file storage, push notifications.
•
OpenAI — text processing (lyrics, concepts, translations).
•
Replicate — music, image and video generation.
•
fal.ai — image and video generation (viral clips and ads).
•
ElevenLabs — voice synthesis and speech timing (narration, dialogue).
•
Stripe — payment processing (Stripe is an independent controller for card data).
•
Railway — backend hosting.
•
Vercel — hosting of the Osyren Studio website and anonymous visit statistics (Vercel Web Analytics: no cookies; "Reject" in the cookie dialog stops it — see the Cookie Policy).
These providers may process data in the United States. Transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
5. What is public
If you publish a creation to the Community, that creation, its title, and your public profile (name, photo, bio, links, follower/like/view counts) are visible to all users of the Service. Unpublishing removes the creation from the feed.
Your private creations are not visible to other users.
7. Your rights
You have the right to access, correct, delete and export your data, to restrict or object to processing, and to withdraw consent — free of charge.
To exercise them, write to hello@osyren.app. We reply within one month.
You can complain to a supervisory authority — in Romania: ANSPDCP (dataprotection.ro); or the authority in your own country. Non-EU users benefit from equivalent rights under this policy regardless of local law.