Privacy Policy

1. Personal data processed and purposes of use

• Account: email, Supabase user identifier, time and version of sign-up and terms consent — identity confirmation, sign-in, granting the free analysis credit, and customer support
• Analysis: voice audio the user records or uploads, the original file name, the selected vocal-range reference, analysis results — providing vocal analysis and responding to errors
• Domestic payment: mobile phone number, order number, product, amount, payment status, transaction identifier — PayApp payment processing, refunds, dispute handling, and statutory record retention
• Overseas payment: email, the payment and billing information entered in the Lemon Squeezy checkout, order number, product, amount, payment status, transaction identifier — overseas card payment processing, refunds, tax handling, dispute handling, and statutory record retention
• Academy service: academy affiliation and role (director/coach/student), assigned-coach relationship, display name, comments left by coaches — providing academy features (viewing of student records by the assigned coach and the director, display of comments) and settling academy analysis credits
• Service improvement: account identifier, the selected purpose of use (trainer / academy operator / personal practice / skip), the dates and feature types of simulation and material use, voluntarily submitted feedback on classroom use — checking repeat usage and improving features. This aggregation does not collect recordings or student information. Providing a purpose of use and classroom feedback is optional.
• Security: a one-way hash of the access IP, request time, error logs — preventing abnormal use and responding to failures
• Passwords are handled by Supabase Auth as encrypted authentication data and are not stored in plain text on SONGLAB servers or in operating logs.

2. Retention and use period

• Service-improvement records of usage dates and features, and classroom feedback: kept for the most recent 90 days, Korean time, then deleted automatically. The purpose of use and the date of first use are kept until membership withdrawal. When the account is deleted, this information is deleted with it. Deletion or suspension of processing can be requested through the contact below.
• Account, analysis results, analysis credit balance: until membership withdrawal. Upon withdrawal they are deleted without delay, except for items subject to statutory retention and the record of the deletion itself.
• Academy affiliation, assigned-coach relationships, coach comments: until the affiliation ends or membership is withdrawn. When a student withdraws, the comments attached to that student's analyses are deleted as well.
• Voice audio consented to account storage: kept privately until you delete the voice and analysis record yourself or withdraw membership. For video analysis, only the audio is kept separately and the original video is deleted after analysis. Voice audio analyzed under the previous 30-day storage consent keeps the existing period unless you separately choose continued storage. Failed or cancelled uploads are deleted, and incomplete uploads are cleaned up after 3 hours.
• Result sharing: only the analysis result summary for which the user created a share link can be seen by people who receive the link. A link can be passed on by a recipient to other people. If sharing is turned off, or the related analysis record or account is deleted, the results can no longer be viewed through the link. Voice audio, original file names, and account information are not shared.
• Copies of analysis voice audio on the operator's PC: kept for up to 30 days for analysis quality checks and error reproduction, then deleted automatically; upon membership withdrawal they are deleted first through a deletion request queue.
• Records of contracts and withdrawal of offers, payment, and supply of goods: 5 years / records of consumer complaints and dispute handling: 3 years / records of display and advertising: 6 months (Korean e-commerce legislation).
• Where another law imposes a retention obligation, the relevant material is separated and kept only for the prescribed period.

3. Outsourcing of processing and overseas processing

• Supabase Inc.: member authentication, database, private voice storage, and Edge Function operation. Data is transmitted over an encrypted network at sign-up and analysis, and is processed while the account is maintained or for the retention periods above.
• Vercel Inc.: website delivery, deployment, and security log processing. Data is transmitted over an encrypted network when the site is accessed, and is processed according to the provider's security and logging policies.
• PayApp and domestic payment-related businesses: providing the domestic payment window and processing payment approvals, cancellations, and refunds. The order, mobile phone, and payment information required is transmitted when a payment is requested.
• Recipient: Sold through Link, LLC f/k/a Lemon Squeezy LLC (Lemon Squeezy). Destination country: the United States and the countries where that company's and its partners' facilities are located. Purpose of transfer: overseas card payment, refunds, tax, and fraud prevention. Items transferred: order, product, and account reference values; name, email, billing address, and payment-method-related information; device and access information. Time and method of transfer: transmitted over an encrypted network when an overseas payment is requested. Retention and use period: the period needed to provide the payment service and to meet legal, accounting, and dispute-resolution obligations; deleted or anonymized when no longer needed. If you refuse this transfer, overseas payment cannot be used, but domestic PayApp payment can be used.
• The infrastructure of the businesses above may include regions outside the Republic of Korea. If a provider or the processing changes, we announce it through this policy.

4. Destruction method

• Electronic files are deleted by methods that make recovery difficult, database relations are cleaned up, and then the authentication account is deleted.
• Material subject to statutory retention is separated from general member data and is not used for any other purpose.

5. User rights

• Users may demand access to, correction of, deletion of, and suspension of processing of their personal data, and may withdraw consent.
• Membership withdrawal can be requested directly in account management after signing in. If a payment or refund is in progress, it is handled after safe settlement.
• Sign-ups by children under 14 are not accepted. If we learn that a sign-up was made in error, we verify and then delete the account and the personal data.

6. Safeguards

• Voice storage is not public, and access is restricted through account ownership checks and short-lived signed URLs. Result share links do not include voice audio or a voice playback address. The feature that shares a recording with the assigned coach is provided only where separate consent has been given.
• Only publishable keys are provided to the browser; Supabase secret keys and GPU worker tokens are kept only in server and local environments.
• Passwords, authentication tokens, and payment-integration secrets are not written to application logs.

7. Breach response

• If we become aware of a personal data breach or similar incident, we notify the affected users without delay of the items involved, the time and circumstances, ways to minimize harm, our response, and a contact point, and we report it in accordance with applicable law.

8. Use of voice and acoustic features for AI improvement — separate opt-in planned

• When the analysis feature opens, we plan to ask for separate opt-in consent per upload on whether the uploaded voice and derived acoustic features may be used for vocal analysis and AI quality improvement. The items used, the purposes, the retention period, and the withdrawal method will be explained first, and not consenting causes no disadvantage in basic analysis use. This sign-in consent change does not permit or start voice training. Before the analysis feature resumes, a separate upload consent and processing procedure will be put in place.
• Existing recordings are not used retroactively. Anyone who uploads a third party's recording, such as a student's, must obtain that person's lawful consent; the account owner's marketing consent does not permit use of a student's voice.

9. Optional marketing use and receiving email advertising

• With optional consent, the account email is used for announcements of new features, the opening of analysis, teaching materials, and events and benefits. Consent to marketing use of personal data and consent to receiving advertising email are obtained separately, and both start as not consented. Receiving email can be selected only when marketing-use consent exists.
• Not consenting makes no difference to the use of the free simulation and teaching materials. You can change or withdraw it at any time in account management, and marketing use stops upon withdrawal or membership withdrawal. Existing members are not treated as automatically consenting.
• So that the consented and withdrawn items, the notice version, and the processing time can be checked, this history is kept until membership withdrawal. It is separate from voice-use consent; this choice alone does not put recordings or student material into AI improvement.

9. Privacy responsibility and contact

Responsible: SONGLAB privacy officer
Email: hello@songlab.kr

10. Effective date and changes

Effective date: 2026-07-16 · Revised: 2026-10-13 (separation of domestic and overseas payment processing and addition of the Lemon Squeezy overseas processing details). Material changes are announced on the service screens before they take effect.