Privacy Policy

Last updated 2026-09-26

This policy explains what Tellody collects when you use tellody.ai and app.tellody.ai (the "Service"), why, who sees it, how long we keep it and what your rights are. It is written to meet the EU and UK GDPR and applies to everyone who uses the Service, wherever they live.

1. Who is responsible

The data controller is Tellody, a brand operated by an individual entrepreneur registered in the Republic of Armenia ("Tellody", "we", "us"). Operator: Christian Manukyan IE, Yerevan, Armenia. Contact for anything in this policy: [email protected]. Our full postal address is available on request.

2. What we collect

Account: your email address, your name, the language you want songs in, and, if you tell us, a voice preference (male, female or no preference) so the songwriter picks a singing voice. Stored until you delete your account.
Sign in with Google: if you choose "Continue with Google", Google sends us your email address (and confirms it is verified), your name and your Google account id, a number that identifies your Google account to us. We use them to find or create your Tellody account and keep the Google account id linked to it, until you delete your account. We never receive your Google password or anything else in your Google account.
Consent record: which version of the Terms you accepted, when, and whether you opted in to product emails.
Your story: the text you type or the voice recording you make, and any names, facts and details it contains about you or other people. Recordings are transcribed by an AI speech model and the audio is not kept by us after transcription.
What we make: the lyrics, style description, audio file and cover image of every song, and whether you shared it.
Feedback: likes and dislikes, the reasons you pick when you dislike a song, and any note you add.
Purchases: your credit balance and ledger, the packs you bought, the payment status and order reference we receive from our payment provider, and the referral or promo codes you use. We never receive your card number.
Technical: a salted hash of your IP address and of your browser's user-agent string (we cannot turn either back into the original), the anonymous id and session cookies below, timestamps, and error logs.
Usage analytics and session replay: which screens and buttons you use, how long a song takes, and a replay of the screen when something breaks. Text you type is masked in replays; stories and lyrics are never sent to analytics. Once you sign in, PostHog receives your account email and name to identify your account in product analytics.
Abuse prevention: a Google reCAPTCHA score when you sign in, and rate-limit counters keyed by hashed IP.

Cookies and browser storage. We set two first-party cookies: tl_uid, an anonymous id that remembers your device before you sign in (12 months), and tl_session, a signed, HTTP-only cookie that keeps you signed in (30 days). Analytics keeps its own random id in your browser's localStorage, not a cookie, and does not follow you to other sites. We use no advertising cookies, pixels or third-party trackers. On tellody.ai, analytics runs only after you accept the banner. We ask once per language, on your first visit in that language, and remember your answer in your browser's localStorage. You can change it at any time via "Cookie settings" in the footer, or block the PostHog domain.

3. Why we use it and on what legal basis

To run the Service you asked for: creating your account, signing you in, turning your story into a song, storing your library, playing shared songs, charging credits and delivering purchases. Legal basis: performance of a contract (GDPR art. 6(1)(b)).
To keep the Service secure and fair: rate limits, abuse and fraud detection, referral and promo-code checks, audit trails, backups. Legal basis: our legitimate interest in a service that works and is not abused (art. 6(1)(f)).
To understand how the Service is used and fix what breaks, through analytics and session replay. Legal basis: our legitimate interest in improving the product, or your consent where the law of your country requires it; you can opt out at any time as described above.
To send you account emails (sign-in links, receipts, expiry warnings for free songs). Legal basis: performance of a contract.
To send you occasional product emails. Legal basis: your consent, given by the optional box at sign-up, which you can withdraw at any time from the link in each email or by writing to us.
To meet legal obligations such as tax and accounting records and responding to lawful requests. Legal basis: legal obligation (art. 6(1)(c)).

We do not sell your data, do not show ads and do not use your stories to train AI models; we ask our providers not to either. We do not make automated decisions with legal or similarly significant effects about you.

4. Who receives your data (processors)

OpenAI, L.L.C.: Story text, dictation audio, cover prompt, lyrics language — Lyrics, transcription, cover art (United States)
Third-party AI music generation services: Lyrics and style description, never your name or email — Rendering the audio (United States or European Union)
PostHog, Inc.: Usage events, masked session replays, a random analytics id, hashed ids, your likes and dislikes with their reasons and note, your account id, email address and name once you sign in — Analytics and debugging (United States)
Resend, Inc.: Email address, name, the sign-in link, song expiry notices — Sending our emails (United States)
Dodo Payments: Email, name, billing country, what you bought; card details entered on their page, never seen by us — Payments, taxes, invoices, refunds, as merchant of record (International, including outside the EEA (see dodopayments.com/legal/privacy-policy))
Cloudflare, Inc.: IP address, request metadata — DNS, DDoS protection, CDN (Global network)
Hosting provider: Everything above, encrypted at rest — Running the servers and database (European Union or United States)
Google LLC (reCAPTCHA): IP address, browser signals — Telling humans from bots at sign-in (United States)
Google LLC (Sign in with Google): IP address and browser signals when the Google button loads; that you are signing in to Tellody, if you use it — Letting you sign in with your Google account (United States)

Each processor acts on our written instructions under a data processing agreement. We may also disclose data when the law requires it, to protect our rights or safety, or to a successor if the Service changes hands, in which case we will tell you.

Public sharing. When you share a song, the share page shows the song, its lyrics, the cover and your first name to anyone with the link, and search engines may index it. Your story is never shown. You can stop sharing from the song page.

5. International transfers

We are based in Armenia and several processors are in the United States, so your data leaves the European Economic Area and the United Kingdom. Where a processor is outside a country with an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), or the EU-US Data Privacy Framework where the processor is certified, together with encryption in transit and at rest. You can ask us at [email protected] for a copy of the safeguards in place.

6. How long we keep it

Account data: until you delete your account, then removed within 30 days.
Stories, lyrics, songs and covers: until you delete them or your account. Songs made with free credits are deleted 30 days after creation; you are emailed before that happens.
Dictation audio: not stored; discarded once transcribed.
Feedback and votes: with the song they belong to.
Purchase and credit records: 7 years after the transaction, as tax and accounting law requires, then deleted.
Hashed IP and device hashes, sign-in tokens and rate-limit counters: 90 days.
Server and error logs: 14 days.
Audit trail (sign-ins, admin actions, bonuses, promo attempts): 12 months.
Analytics events and session replays: per PostHog's retention, currently 30 days for replays.
Backups: rolling, overwritten within 30 days.

7. Your rights

Under the GDPR and similar laws you can ask us to: access the personal data we hold about you and receive a copy in a portable format; correct anything inaccurate; delete your data; restrict or object to processing based on our legitimate interests; and withdraw consent you have given at any time, without affecting what was done before. You can also complain to your data protection authority; in the EU that is the authority of the country where you live or work.

You can do the most common of these yourself, on the Account page of the app: change your name, language and voice preference; download a copy of your data (a zip with your profile, consent record, stories, lyrics, votes, purchase and credit history, and every song with its cover); and delete your account. Deleting your account erases your account, stories, lyrics, songs and covers, votes and feedback, sign-in sessions and any API keys straight away, and asks our analytics provider to delete your profile there. We keep only the purchase and credit records that tax and accounting law requires (section 6), with your name, email and account identifier removed. Deletion cannot be undone.

For anything else, or if you prefer, email [email protected] from the address on your account (for deletion, with the subject "Delete my account"). We answer within 30 days and may ask you to confirm your identity first.

8. Children

The Service is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a child under 16 has an account, tell us at [email protected] and we will delete it. Stories about children (a birthday song for your daughter) are fine; accounts held by children are not.

9. Security

All traffic is encrypted with TLS. Session cookies are signed and HTTP-only, IP addresses are stored only as salted hashes, sign-in links are single-use and expire in minutes, and access to production systems is limited to the operator with key-based authentication. No system is perfectly secure, so keep control of the mailbox that receives your sign-in links.

10. If something goes wrong

If a data breach is likely to put your rights or freedoms at risk, we will notify the competent supervisory authority within 72 hours of becoming aware of it and tell you directly without undue delay, explaining what happened, what data was affected and what you can do.

11. Changes to this policy

We may update this policy as the Service or the law changes. Each version carries a version date at the top. For material changes we will email you or show a notice in the app at least 14 days before the change takes effect.

12. Contact

Tellody (Christian Manukyan IE), Yerevan, Armenia · [email protected]