This policy explains what personal data Melo.Video (melo.video) collects, why, who it is shared with, how long it is kept and what rights you have. It is written to be read, not skimmed: every paragraph describes something the Service actually does.
Controller: Andrei Gudima, an individual based in Moldova (postal address available on request). Contact for anything in this policy: [email protected].
This English version is the binding text; versions in other languages are provided for convenience.
1. What we collect
| Data | What it is | Where it comes from |
|---|---|---|
| Account data | Email address, a hashed password (never the password itself), interface language, the date you accepted the Terms, whether and when your email was confirmed, your role, when you last used the Service while signed in, and — if you arrived from one of our own ads — the campaign, ad group, keyword and Google or Microsoft click id in the link you clicked. A display name is derived from your email address. | You, at sign-up |
| Sign-in identities | If you sign in with Google or Facebook: the provider's identifier for you and the email address it hands over. We do not receive your password, contacts or posts. | Google or Facebook, when you choose that button |
| Your content | Audio tracks, images, video clips, text and editor settings you upload or create, including any description you type to have an auto montage built for you; subtitle text generated from your audio and your edits to it; the videos you export on our servers. | You |
| Stock media searches | The search terms you type into the stock photo and video picker. | You |
| Purchase data | When you pay for an export: the order reference, amount, currency, tax, status and the email address used at checkout. Card and bank details are handled by our payment provider and never reach us. | Paddle, our payment provider |
| Support tickets | The type, text and optional screenshot or short video you attach when you contact us, and our replies. | You |
| Usage events | What you do on the site and in the editor: the page you arrived on, the website that sent you there (its address only, never the full link) and the source tag on that link, if it had one, and whether the visit came from a browser or an automated program; if you came from one of our ads, the campaign, ad group and keyword; sign-up and sign-in; uploads; which template, settings, text blocks, aspect ratio and media you changed (which setting, not its value); the preview being played; the export menu, checkout and purchases; and when the app was opened and left. Never file names, text you typed, or the content of your uploads. | Your browser and our servers, automatically |
| Technical data | IP address, browser and device type, the pages and API endpoints you request, timestamps, and error details. | Your browser, automatically |
| Cookies and local storage | A session cookie, a sign-in (remember-me) cookie, a security (CSRF) cookie and small browser-stored preferences. Analytics cookies only with your consent. See the Cookie Policy. | Your browser |
We do not ask for and do not knowingly collect special categories of data (health, religion, politics and so on). Lyrics and speech in the audio you upload may contain whatever you put in them; we process them only to build your subtitles.
2. Why we use it, and on what legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Creating and running your account, signing you in, sending the verification and password-reset emails | Account data, sign-in identities | Performance of a contract (art. 6(1)(b)) |
| Storing your uploads, showing the live preview, rendering and delivering your videos | Your content | Contract |
| Generating subtitles from your audio | Your content (audio) | Contract |
| Searching stock photos and videos for you | Stock media searches | Contract |
| Selling and delivering exports, keeping the records tax law requires | Purchase data | Contract; legal obligation (art. 6(1)(c)) |
| Measuring which of our own ad campaigns bring sign-ups | Account data (the ad click) | Legitimate interest (art. 6(1)(f)) — the values are read from the link you arrived on and kept with your account; nothing is stored in your browser for this and nothing is sent to Google or Microsoft |
| Understanding how the editor is used, improving it and judging our own ad campaigns by what the accounts they bring go on to do | Usage events, account data (the ad click) | Legitimate interest (art. 6(1)(f)) — stored on our own servers, keyed to your session and your account, nothing is stored in your browser for this and nothing is sent to anyone; you can object (section 9) |
| Answering your support requests | Support tickets, account data | Contract; legitimate interest in keeping a record of what was reported and agreed (art. 6(1)(f)) |
| Keeping the Service secure: rate limiting, bot filtering, detecting and investigating abuse | Technical data | Legitimate interest (art. 6(1)(f)) |
| Finding and fixing errors | Technical data, error details | Legitimate interest (art. 6(1)(f)) |
| Understanding how the site is used (analytics) | Cookies, technical data | Consent (art. 6(1)(a)) — only after you accept analytics cookies; you can withdraw at any time on the Cookie Policy page |
| Telling you about material changes to the Terms or the Service | Account data | Legitimate interest; legal obligation |
We do not send marketing emails. The only emails we send are the ones your account or your support tickets require.
We do not make automated decisions with legal or similarly significant effects about you, and we do not profile you.
3. How your content is processed
Understanding where your files go is the part of this policy most worth reading.
- Storage. Uploads and rendered videos are stored in private object-storage buckets at Cloudflare R2. Nothing is reachable by a public link: every download goes through a check that the file belongs to the signed-in account, and then through a link that expires within two hours.
- Rendering and subtitles. When you generate a video or subtitles on our servers, a rendering worker on a GPU server rented from RunPod downloads your track and the media it needs over an expiring link, produces the video or the transcript, uploads the result to our storage and discards its working copy when the job ends. Subtitles are produced by running speech-recognition software (Whisper) on that worker; your audio is not sent to any third-party AI or transcription service.
- Lyrics proofreading. When lyrics are generated automatically for a track, the transcribed lines, the track's title and the detected language are sent to Anthropic, whose Claude model proofreads the text for transcription mistakes. No audio is sent to Anthropic. This does not happen when you had already supplied the lyrics for the track yourself before it was transcribed.
- Rendering in your browser. Where the Service offers it, a video can be rendered entirely in your own browser and saved to your disk. Nothing is uploaded and no copy exists on our side.
- Stock media. Searching stock photos and videos sends your search terms to Pexels. A photo or clip you pick is fetched by our server and stored in your account like any other upload; Pexels does not learn who you are.
- Auto montage. Creating an auto montage makes our server search Pexels and Pixabay for stock footage with the theme's search terms and fetch the clips it uses into our own storage; neither learns who you are. If you describe a montage in your own words, that description is sent to Anthropic, whose Claude model turns it into search terms and checks it against our content rules. Only the description is sent — not your name, email address or files — and it is stored with your montage. If it produces a montage, it is also kept in your list of recent descriptions — the last ten — until you remove it.
- Magic dice. When you use the magic dice, which designs three looks for a music video, the track's title, numbers describing the audio (tempo, key and loudness curve), the lyrics if there are any and the optional description you type are sent to Anthropic, whose Claude model designs the looks. A text description of a background picture, written by that model rather than by you, is sent to fal.ai (Features & Labels, Inc., United States), which generates the picture; the generated picture is then sent to Anthropic's Claude model to check that it suits the layout. A photo you uploaded yourself is not sent to either provider.
- Preview. The live preview runs in your browser from the files in your account.
- Nobody looks at your files. Content is processed by software only. A person accesses it only when you ask us to (for example in a support ticket), to investigate a report of abuse or a notice of infringement, or when the law requires it.
4. Who we share data with
We do not sell personal data and we do not share it with advertisers. The following providers process data on our behalf, under contracts that bind them to our instructions:
| Provider | What they do for us | Data they touch | Location |
|---|---|---|---|
| Cloudflare, Inc. | Delivers the site, protects it against attacks and bots (including the Turnstile captcha on the sign-up and support forms), stores uploads and rendered videos (R2) | All traffic; your content; IP address | Global network; storage in the European Union and the United States |
| RunPod, Inc. | Runs the rendering and transcription worker on GPU servers | Your content, temporarily, for the duration of a job | Data centres in the European Union and the United States |
| OVH SAS | Hosts the application server and database | All data listed in section 1 | European Union |
| Paddle.com Market Ltd (UK) / Paddle.com Inc. (US) | Sells exports as merchant of record: checkout, payment, invoices, tax | Purchase data, email address, IP address | United Kingdom, United States |
| Google LLC | Sign in with Google; delivery of our transactional emails through Gmail | Sign-in identity; the email address and content of mails we send you | United States, EU |
| Meta Platforms Ireland Ltd | Sign in with Facebook (where offered) | Sign-in identity | EU, United States |
| Pexels GmbH | Stock photo and video search | Search terms | Germany, United States |
| Pixabay GmbH | Stock video search | Search terms | Germany |
| Anthropic, PBC | Turns a montage description you type into search terms and checks it against our content rules; proofreads automatically generated lyrics; designs the looks of the magic dice and checks the generated background pictures | The description you type; the lines of automatically generated lyrics with the track's title and detected language; for the magic dice, the track's title, numbers describing the audio, the lyrics if there are any, your optional description and the generated background picture | United States |
| Features & Labels, Inc. (fal.ai) | Generates the background picture for a magic-dice look | A text description of the picture, written by our AI, not your own words; never your photos | United States |
| Functional Software, Inc. (Sentry) | Error monitoring for the site, the app and the rendering worker | Error details; we configure Sentry not to attach IP addresses or personal identifiers by default | European Union and United States |
| Google (Analytics and Ads measurement) | Usage statistics and measurement of our own ad campaigns, only if you accept analytics and advertising cookies | Cookies, technical data | United States, EU |
| Microsoft Corporation (Microsoft Advertising measurement) | Measurement of our own ad campaigns on Microsoft Advertising (Bing), only if you accept analytics and advertising cookies | Cookies, technical data | United States, EU |
We may also disclose data when the law requires it, to establish or defend legal claims, or to a successor if the Service changes hands (you would be told).
5. International transfers
We are established in Moldova, outside the European Economic Area, so for visitors in the EEA using the Service already involves a transfer of their data to us; that transfer takes place under the European Commission's Standard Contractual Clauses. Some of the providers above are also located outside the EEA, mainly in the United States. Where that is the case we rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework for providers certified under it, and otherwise on the Commission's Standard Contractual Clauses, together with the providers' own safeguards. You can ask us at [email protected] for details of the safeguards applying to a specific provider.
6. How long we keep data
| Data | Kept for |
|---|---|
| Account data, sign-in identities | Until you delete your account (see section 8) |
| Uploads (tracks, images, clips), editor settings, subtitles | Until you delete them, or your account |
| Videos rendered on our servers | 14 days after completion, then deleted automatically |
| Stock media search terms | Cached for up to 6 hours to avoid repeating identical requests; not linked to you |
| Support tickets and attachments | 12 months after the ticket is closed, then deleted automatically. Kept after account deletion, without your name or email address |
| Usage events of an account | 12 months, then deleted automatically; deleted with the account |
| Usage events of a visit that did not sign up | 30 days, then deleted automatically |
| Purchase records | As long as tax and accounting law requires (typically 5–10 years), held by Paddle and by us |
| Server logs | 14 days |
| Error reports (Sentry) | 90 days |
| Error log on our own server | Each occurrence 30 days; a summary of a recurring error for up to 90 days after it was marked resolved. Holds the request path, browser type and, if you were signed in, your account id — never your uploads, cookies or form contents |
| Preview performance reports on our own server | 90 days. Sent by the editor only when the live preview stutters on your device: which template, backdrop and effects were on the stage, the frame timings, your browser and graphics-chip type and, as you are signed in, your account id — never your uploads or the content of your project |
| Database backups | 30 days, then deleted automatically. Backups do not contain your uploaded files or rendered videos. |
| Cookies and local storage | See the Cookie Policy |
7. Security
All traffic to the Service is encrypted (HTTPS). Passwords are stored only as salted hashes. Uploads and rendered videos live in private buckets and are served only through expiring, account-checked links. Access to production systems is limited to the people who operate the Service. Sign-in is rate-limited per account and per IP address, and the sign-up and support forms use a captcha to keep bots out. No system is perfectly secure; if we learn of a breach affecting your data we will inform you and the competent authority as the law requires.
8. Deleting your account
You can delete your account at any time from the account page, after confirming your password (or your email address, for an account without a password).
Deletion is immediate and permanent. Your projects, tracks, uploads, editor settings, subtitles, rendered videos, sign-in identities, usage events and stored files are destroyed at once and cannot be recovered. What remains:
- an anonymised record — the account row is kept with your name and email address replaced by placeholders, so that the support conversations below still have an author and so that the same email address can be used to register again;
- support tickets you opened, including their attachments, kept for our records as described in section 6;
- purchase records, for as long as tax law requires;
- copies in our database backups, which are deleted within 30 days.
9. Your rights
Under the GDPR and comparable laws you can ask us to:
- access the personal data we hold about you and receive a copy;
- correct data that is inaccurate;
- delete your data — the account page does this for everything except what section 8 lists;
- restrict or object to processing based on our legitimate interests;
- receive the data you gave us in a portable format — your uploads can be downloaded from the Service at any time;
- withdraw consent to analytics cookies at any time on the Cookie Policy page, without affecting the lawfulness of processing before the withdrawal.
Write to [email protected] from the email address of your account, or open a support ticket in the app. We answer within one month. You also have the right to lodge a complaint with a data-protection supervisory authority, in particular in the EU member state where you live or work; the authority for our own country is the National Centre for Personal Data Protection of the Republic of Moldova (datepersonale.md).
10. Children
The Service is not intended for children under 18. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.
11. Changes to this policy
We will update this policy when the Service changes in a way that affects your data — for example when a new provider is added. Material changes are announced by email or by a notice in the Service before they take effect. The date at the top of this page tells you when it was last updated.
12. Contact
Andrei Gudima, Moldova — postal address available on request.
Email: [email protected]