Privacy Policy
How MusicFlow StudioAi (Insert.si.on) collects, uses and protects your personal data — GDPR compliant · Last updated June 2026
1. Who we are
The data controller is Insert.si.on, 14 allée des Mûriers, 91940 Les Ulis, France (SIRET 982 692 345 00019), operator of MusicFlow StudioAi (musicflowstudioai.com). Contact: no-reply@musicflowstudioai.com.
2. Data we collect
- Account data: e-mail address, display name, password (stored as a bcrypt hash — we never see it), profile picture and identifier when you sign in with Google or TikTok.
- Usage data: your prompts, generation settings, generated media, projects, credits and plan, API keys you create, likes and Showcase submissions, and technical logs (IP address, browser, timestamps) needed for security and rate limiting.
- Payment data: handled by Stripe. We only store your Stripe customer identifier, plan and invoice status — never your card number.
- Marketing attribution: an anonymous A/B variant, an anonymous visitor identifier for likes, and the acquisition source (for example “tiktok”) stored in your browser and attached to your account at sign-up.
- TikTok connection (optional): your TikTok open_id, display name and avatar, and the access/refresh tokens required to publish the videos you explicitly choose to publish. Tokens are stored encrypted server-side and never exposed to the browser.
3. Why we process it (legal bases)
- To provide the Service you signed up for: account, generation, downloads, licenses, Showcase, TikTok publishing (performance of a contract).
- To bill you and prevent fraud (contract and legal obligation).
- To secure the Service, block abuse and measure what works (legitimate interest, using minimal and mostly anonymous data).
- To send transactional e-mails (welcome, low credits, password reset, team invitations) and, only if you opt in, product news (consent, withdrawable at any time).
4. Sharing with third parties
We share data only with processors necessary to operate the Service: AI generation providers (fal.ai, ElevenLabs, OpenAI, Anthropic) receive your prompts and audio to generate results; Stripe processes payments; Resend sends e-mails; Google and TikTok provide sign-in and, for TikTok, publishing; our hosting provider stores the data. We never sell personal data. Public Showcase tracks display your display name, title and description to anyone.
5. Retention
- Account and usage data: for as long as your account exists, then deleted or anonymised within 30 days of deletion.
- Generated media: until you delete them or your account.
- Password-reset tokens: 30 minutes. Security logs: 12 months. Invoices: 10 years (legal obligation).
- TikTok tokens: until you disconnect TikTok or delete your account, or when TikTok revokes them.
6. Your rights (GDPR)
You can access, rectify, export (portability) and delete your data, object to or restrict processing, and withdraw consent at any time — from your account settings or by e-mailing no-reply@musicflowstudioai.com. We answer within 30 days. You may also lodge a complaint with your supervisory authority (in France, the CNIL).
7. Cookies and local storage
We use a strictly necessary authentication cookie (httpOnly) and local storage for your preferences, language, anonymous A/B variant, visitor identifier and acquisition source. We do not use advertising cookies or third-party trackers.
8. Security
Data is transmitted over HTTPS, passwords are hashed with bcrypt, secrets and tokens are stored server-side only, access is role-based and login attempts are rate limited. No system is perfectly secure; we will notify you and the authorities of any breach as required by law.
9. International transfers
Some providers are located outside the European Union (notably in the United States). Transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.
10. Children
The Service is not directed to children under 16. If you believe a child provided us personal data, contact us and we will delete it.
11. Changes
We may update this policy; the date at the top changes and material changes are announced in the app or by e-mail. See also our Terms of Service.