Privacy Policy

Data controller

The controller responsible for your personal data is ZHENGJIANHUI, operating as MusicPromptAI, China (mainland). Privacy contact: shakezheng@126.com. No data protection officer is appointed; privacy requests go to the address above.

What we collect

Account data: your email address, a salted PBKDF2 hash of your password, and the date the account was created. We never store passwords in plain text.

Purchase data: the plan you bought, order status, amount, currency and the linked Waffo Pancake order reference. We do not receive or store card numbers — payment card data is handled solely by Waffo Pancake, our PCI-DSS compliant payment processor.

Technical data: session cookies and standard server logs (IP address, user agent, timestamps) generated by our hosting provider when you use the site.

Advertising: we use Google AdSense to display ads. Google and its advertising partners may set cookies and similar technologies, and may collect your IP address, device identifiers, approximate location and browsing data, to serve, personalise and measure ads.

We do not run our own analytics, we do not build advertising profiles ourselves, and we do not collect precise location data or payment card data.

How we use data and our legal basis

Providing the service, creating your account, delivering downloads and handling payments: performance of our contract with you.

Customer support, service notices (billing, security, policy updates), fraud prevention and keeping the service secure: our legitimate interests.

Tax, accounting and other legal obligations: compliance with the law.

We do not send marketing email and we do not sell personal data. Ads on the site are delivered by Google AdSense, which may use cookies for personalisation and measurement as described under Cookies.

Cookies

We set one strictly necessary first-party cookie, mpa_session, to keep you signed in. It is HttpOnly, SameSite=Lax, and expires after 30 days. It cannot be switched off without breaking sign-in.

Your language preference is stored in your browser's localStorage and is never sent to us.

Advertising cookies: Google AdSense and its partners may set cookies such as __gads, __gpi and IDE to measure and personalise ads. In the EEA, UK and Switzerland these cookies are only set after you consent through the Google-certified consent message shown on the site.

You can control or turn off personalised advertising at https://adssettings.google.com, and read how Google uses data from partner sites at https://policies.google.com/technologies/partner-sites. Blocking advertising cookies does not affect downloads.

Who we share with

Waffo Pancake processes payments as Merchant of Record and receives the email address and order details needed to complete the transaction and handle taxes. Card data is processed by Waffo Pancake and is not stored on our servers.

Our sound-generation pipeline uses the DeepSeek model (DeepSeek, 深度求索). Only design briefs and prompts are sent to the model — never your account, email or payment details.

Cloudflare hosts the site, API, database and audio files. Our email provider processes support and receipt messages. Each provider is bound by a data processing agreement and acts on our instructions.

Google AdSense serves the ads shown on the site and acts as an independent advertising partner; it receives cookie and device data as described in its own privacy policy (https://policies.google.com/privacy).

We may disclose data where required by law, court order or a competent authority, or as part of a merger or acquisition with prior notice and continued protection.

Security and breach notification

Data is encrypted in transit over TLS. Passwords are stored as salted PBKDF2 hashes. Access to production systems follows least privilege.

If a breach affects your rights, we will notify you and the competent authority without undue delay and within 72 hours of becoming aware where the law requires it.

Keep your credentials private; contact shakezheng@126.com if you suspect unauthorised access.

International transfers

Our providers operate globally, so your data may be processed outside your country. Transfers rely on Standard Contractual Clauses and, where available, adequacy decisions, and we only use recipients that apply comparable protection.

Retention

Account records are kept while the account is active and for 90 days after closure, then deleted or anonymised. Order and invoice records are kept for up to 10 years where tax and accounting law requires it, in a restricted archive.

Support emails are kept for 2 years. Server and security logs are kept for 90 days. Session records are deleted on sign-out or expiry.

Your rights

Depending on where you live, you may have the right to be informed, access, correct, delete, restrict, export, or object to the processing of your personal data, and to withdraw consent.

Write to shakezheng@126.com and we will respond within 30 days. You can also complain to your local data protection authority.

Third-party links

The site may link to third-party pages, such as the Waffo checkout. This policy covers only data we collect directly; review the third party's own policy before using their service.

Children

The service is not directed to children under 16 and we do not knowingly collect their data. Contact shakezheng@126.com if you believe a child has created an account and we will delete it.

Changes and contact

We may update this policy. Material changes will be announced on this page at least 15 days before they take effect, with a new date at the top.

Controller: ZHENGJIANHUI, operating as MusicPromptAI, China (mainland). All privacy and support requests: shakezheng@126.com.