Privacy Policy

Effective Date: April 30, 2026 Last Updated: April 30, 2026

1. Introduction

Mubert is an AI music platform for generating, transforming, extending, separating, and publishing creative audio and video assets. Our tools include the AI Music Generator, AI Music Video Generator, AI Cover, AI Music Remixer, Add Vocals to Music, AI Instrumental Generator, AI Music Extender, and Vocal Remover.

This Privacy Policy explains what information we collect when you use Mubert, why we collect it, how we store and share it, and what choices you have. It applies to all users of our website, applications, generation tools, billing flows, and support channels.

By using Mubert, you agree to the practices described in this policy. If you do not agree, please do not use the service.

At a Glance

• We use Google OAuth for sign-in, Stripe for payments, Supabase for our database, and Cloudflare R2 for file storage.
• We process prompts, lyrics, style settings, uploads, and generated files to provide the Mubert tool you requested.
• We do not sell personal information, and we do not use your uploads, prompts, lyrics, or generated content to train third-party foundation models.
• File retention depends on your plan. Free-plan files are kept for a limited period; paid-plan files may remain available while your account is active unless you delete them.
• You can delete projects, request account deletion, and ask for a copy of your data.

Summary Table

The table below summarizes the main categories of personal data we process.

2. Information We Collect

We collect the information needed to operate Mubert, protect the service, process payments, and provide the features you choose to use. The categories below describe what we collect, where it comes from, and why we collect it.

2.1 Account Information

When you sign in with Google OAuth, we receive:

• Your name
• Your email address
• Your Google profile picture (avatar)
• A unique account identifier

We do not receive or store your Google password. If you later revoke Mubert's access from your Google account, you can no longer sign in, but data already associated with your Mubert account is preserved until you request deletion.

We also maintain a small set of account-level records that we create ourselves, such as your current subscription tier, credit balance, and preferences.

2.2 Payment Information

Payments are processed by Stripe. When you subscribe or buy credits, Stripe collects and processes your card details directly. Mubert never sees or stores your full card number, CVV, or other sensitive payment credentials.

We do receive and retain limited billing data from Stripe to manage your subscription, such as:

• Subscription plan and status
• Billing country
• The last four digits of your card and card brand
• Transaction amount, currency, and date
• Invoice and receipt identifiers

2.3 Uploaded Audio

Several Mubert tools accept audio uploads, including AI Cover, AI Music Remixer, AI Music Extender, and Vocal Remover. When you upload an MP3 or WAV file, we store it so we can process it and return a result to you.

We process uploaded audio only to deliver the feature you requested. We do not use your uploads to train foundation models, and we do not share them for advertising purposes.

2.4 Prompts and Lyrics

When you use our generators, we collect the text you enter, including:

• Text prompts describing the music or video you want
• Style, genre, and mood selections
• Lyrics you write or paste in
• Project titles and related settings

We store this text so we can generate your content, display your history, troubleshoot failed jobs, and improve reliability.

2.5 Generated Content

Audio, video, image, stem, and vocal files created by Mubert on your behalf are stored on Cloudflare R2. Each file is linked to your account so that you can play back, download, manage, or delete it.

2.6 Usage Data

We collect basic analytics to understand how the service is used and to improve it. This includes:

• Pages you view
• Features and tools you use
• Approximate location derived from IP address (country or region level)
• Device type, operating system, and browser
• Referring URL
• Error reports and performance metrics

2.7 Communications and Support

If you contact us by email, through a support form, or via any feedback channel we provide, we keep your messages and any attachments so we can respond, troubleshoot issues, and improve our service. Please do not send sensitive personal information (such as government IDs) unless we specifically ask for it.

2.8 Marketing Preferences

If we send optional marketing emails, we keep a record of your subscription status and any opt-outs, so that we respect your preferences. You can unsubscribe at any time from the link at the bottom of any marketing email. Transactional messages (such as receipts and security notices) cannot be turned off while your account is active.

2.9 Cookies and Similar Technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, and measure usage. We generally use three categories of cookies:

• Essential cookies that are required to sign in, maintain your session, and protect against abuse.
• Preference cookies that remember settings such as language and UI choices.
• Analytics cookies that help us understand how features are used and how the service performs.

You can control cookies through your browser settings. Disabling essential cookies may prevent the service from working correctly.

3. Legal Bases for Processing (EEA and UK)

If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR and UK GDPR when we process your personal data:

• Contractual necessity for creating your account, delivering the tools you request, storing your projects, and processing payments.
• Legitimate interests for securing the service, preventing fraud and abuse, maintaining reliability, and improving our features, balanced against your rights and interests.
• Legal obligation for tax, accounting, and responding to lawful requests from authorities.
• Consent where required, for example for certain cookies and optional marketing messages. You may withdraw consent at any time without affecting processing that already took place.

4. How We Use Your Information

4.1 Primary Purposes

We use the information we collect to:

• Create and secure your account
• Deliver the AI music, instrumental, video, cover, remix, extend, vocal, and vocal-removal features you request
• Store and display your projects and generated outputs
• Process payments, manage subscriptions, and send billing receipts
• Provide customer support and respond to your questions
• Monitor the health of the service, detect abuse, and prevent fraud
• Analyze usage to improve existing features and plan new ones
• Send service-related announcements, such as security notices or material changes to this policy
• Comply with legal obligations and enforce our Terms of Service

We do not sell your personal information, and we do not use your uploads, prompts, lyrics, or generated content to train third-party foundation models.

4.2 Service Improvement and Aggregated Data

We may derive aggregated and de-identified statistics from usage data (for example, how often a feature is used or the average length of generated tracks). Aggregated data does not identify you and may be retained and used for any legitimate business purpose, including reporting, research, and product planning.

4.3 No Automated Decisions With Legal Effects

We do not use your personal data to make automated decisions that produce legal or similarly significant effects about you without human involvement. Content safety checks and anti-abuse systems may flag items for human review, but final enforcement actions involve human decision-making.

5. How We Share Your Information

We share personal information only with service providers that help us operate Mubert, and only to the extent they need it to perform their work. These providers are bound by contractual confidentiality and data-protection obligations.

5.1 Authentication and Database

• Supabase hosts our Postgres database and manages authentication. Your account record, project metadata, and references to your files are stored there.

5.2 Payments

• Stripe processes all payment transactions and stores cardholder data under its own PCI DSS Level 1 certification.

5.3 Storage

• Cloudflare R2 stores uploaded audio and generated audio, video, and image files.

5.4 Hosting

• Our hosting provider delivers the Mubert website and API infrastructure.

5.5 AI Generation Backends

Depending on the tool you use, your text prompts, lyrics, or uploaded audio may be sent to one or more of the following processors to produce the output you requested:

• OpenAI for certain text and audio generation tasks
• Google Gemini for image-prompt generation
• KIE.ai for image generation

These providers process your input only to return a result and are not permitted to use your content for their own purposes beyond what their terms allow.

The specific data flow for each Mubert tool is:

• AI Music Generator, AI Instrumental Generator, Add Vocals to Music, AI Music Extender: your prompts, style selections, and (where relevant) lyrics or seed audio are sent to our generation backend; the generated audio is returned to Mubert and stored on Cloudflare R2 under your account.
• AI Music Video Generator: your prompts are sent to image- and video-generation providers; resulting media is stored on Cloudflare R2.
• AI Cover and AI Music Remixer: your uploaded audio is sent to our generation backend together with your style or voice selection; results are returned to Mubert and stored on Cloudflare R2.
• Vocal Remover: your uploaded audio is processed by our separation backend and the resulting stems are stored on Cloudflare R2.

In all cases, content is processed solely to deliver the feature you requested.

5.6 Analytics and Monitoring

• Analytics and error-monitoring providers help us measure usage, diagnose issues, and keep the service reliable.

5.7 Legal and Safety

We may disclose information when we believe in good faith that it is necessary to:

• Comply with a law, regulation, subpoena, or court order
• Protect the rights, property, or safety of Mubert, our users, or the public
• Investigate or prevent fraud, abuse, or security incidents

5.8 No Sale of Personal Information

We do not sell personal information in exchange for money, and we do not share personal information for cross-context behavioral advertising. If this practice ever changes, we will update this policy and provide an opt-out mechanism as required by applicable law.

5.9 Data Shared With Each Processor

For clarity, the table below shows the main categories of data shared with each processor:

5.10 Business Transfers

If Mubert is involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal data.

6. Data Retention

We keep personal data only for as long as we need it to provide the service, meet legal obligations, resolve disputes, and enforce our agreements.

6.1 Generated Content

Retention of generated audio, video, and image files depends on your plan:

• Free plan: generated files are retained for 7 days, then automatically deleted.
• Pro plan: generated files are retained for the life of your account, unless you delete them.

You can delete any generated file at any time from your dashboard.

6.2 Uploaded Audio

Uploaded audio used as input for a tool is kept only as long as needed to complete the job and give you a reasonable window to regenerate or re-run the task. You can delete your uploads from your account at any time.

6.3 Account Data

If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain it to comply with legal, tax, or accounting obligations, or to resolve disputes.

6.4 Payment and Transaction Records

We retain billing records and invoices for the period required by applicable tax and accounting laws, which in most jurisdictions is between five and ten years. These records may persist after you close your account.

6.5 Logs and Analytics

Server logs, security events, and analytics data are retained for a limited period needed to diagnose issues, maintain security, and measure usage trends, and are deleted or aggregated after that.

6.6 Backups

Our systems and those of our processors may retain backups for a short period for disaster-recovery purposes. Data deleted from the live service may persist in backups until the backup rotation completes, after which it is overwritten.

6.7 Deleted Accounts

When you delete your account, we queue your personal data for deletion or anonymization. Generated and uploaded files stored on Cloudflare R2 are removed. Records we must keep for legal or accounting reasons (such as invoices) are retained in a restricted form.

7. Your Rights

Depending on where you live, you may have the following rights over your personal data. We honor these rights regardless of location, to the extent reasonably practical.

7.1 Access and Portability

You can request a copy of the personal data we hold about you, in a commonly used, machine-readable format.

7.2 Correction

You can ask us to correct inaccurate or incomplete personal data. Most profile information can also be updated directly in your account.

7.3 Deletion

You can delete individual projects and files from your dashboard, or ask us to delete your entire account and associated personal data.

7.4 Objection and Restriction

You can object to or ask us to restrict certain processing of your personal data, such as analytics or marketing communications.

7.5 Opt-Out of Sale or Sharing (CCPA)

If you are a California resident, you have the right to opt out of the sale or sharing of your personal information. Mubert does not sell personal information and does not share it for cross-context behavioral advertising.

7.6 Non-Discrimination

We will not deny you service, charge you a different price, or provide a lower quality of service because you exercised your privacy rights.

7.7 Additional U.S. State Disclosures

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, or another U.S. state with a comprehensive privacy law, you may have the right to:

• Confirm whether we process personal information about you and obtain a copy
• Correct inaccurate personal information
• Delete personal information we hold about you
• Opt out of targeted advertising, sale of personal information, and certain profiling

As noted above, Mubert does not sell personal information or engage in targeted advertising based on cross-context tracking.

7.8 Authorized Agents and Appeals

California and some other U.S. state laws allow you to designate an authorized agent to submit a request on your behalf. We may require written proof of the agent's authority and may still need to verify your identity directly.

If we decline a request, you may appeal our decision by replying to our response. We will review appeals and respond within the timeframe required by applicable law.

7.9 How to Exercise Your Rights

To exercise any of these rights, contact us using the details in the "Contact Us" section. We may need to verify your identity before acting on your request. We aim to respond within 30 days; where the law allows, we may extend this period and will let you know if we do.

7.10 Do Not Track

Some browsers offer a "Do Not Track" signal. There is no industry-wide standard for responding to these signals, and Mubert does not currently change its behavior based on them. We honor the user-facing privacy choices described in this policy regardless of any browser signal.

8. Data Security

We use industry-standard technical and organizational measures to protect your data.

• In transit: traffic between your device and Mubert is encrypted using TLS.
• At rest: data stored in Supabase and Cloudflare R2 is encrypted at rest.
• Access control: Supabase Row Level Security (RLS) policies restrict database access so that users can only read and modify their own records.
• Payments: Stripe is certified PCI DSS Level 1 and handles all card data directly.
• Operational security: access to production systems is limited to authorized personnel and protected by multi-factor authentication.

No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately.

8.1 Account Hygiene

You play an important role in protecting your account. Keep the Google account used to sign in secure, enable two-factor authentication where available, and do not share your account or generated content links publicly if they contain information you consider private.

8.2 Incident Notification

If we become aware of a security incident that affects your personal data, we will notify you and the relevant authorities where required by law, and provide information about the nature of the incident and the steps you can take.

9. Children's Privacy

Mubert is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us and we will delete it.

Some jurisdictions require a higher minimum age. If local law sets a higher age of digital consent in your country, that age applies instead.

9.1 Minors Between the Age of Consent and 18

If you are older than the minimum age required by your jurisdiction but under 18, please use Mubert only with the involvement of a parent or legal guardian and do not submit audio, lyrics, or prompts that reveal sensitive personal information about yourself or others.

9.2 California Minors

California residents under 18 who are registered users may request the removal of content they have publicly posted through Mubert by contacting us. Please note that this does not guarantee complete or comprehensive removal, because copies may exist in backups or caches for a limited period.

10. International Data Transfers

Mubert is operated from and hosted in the United States. If you access the service from outside the United States, your information will be transferred to, stored in, and processed in the United States and in other countries where our service providers operate.

Where required by law, we rely on appropriate safeguards for international transfers, including the European Commission's Standard Contractual Clauses (SCCs) with our processors. By using Mubert, you acknowledge that your data may be transferred to countries whose data-protection laws may differ from those in your country of residence.

11. Data Protection Principles We Follow

We aim to handle personal data in line with the following principles:

• Lawfulness, fairness, and transparency: we explain our practices in this policy and rely on a valid legal basis for each type of processing.
• Purpose limitation: we collect data for specific, legitimate purposes and do not use it in ways that are incompatible with those purposes.
• Data minimization: we collect only what we need for the feature you use.
• Accuracy: we give you tools to correct information we hold about you.
• Storage limitation: we retain data only as long as we need it, according to the retention rules in this policy.
• Integrity and confidentiality: we protect data using technical and organizational measures.
• Accountability: we document our practices and review them as Mubert evolves.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, provide additional notice (for example, by email or an in-product message).

Your continued use of Mubert after an update becomes effective means you accept the revised policy. If you do not agree with the changes, you should stop using the service and may request deletion of your account.

13. Your Content and Ownership

This Privacy Policy addresses personal data. Ownership and licensing of the audio, video, and image content you upload or generate through Mubert are governed by our Terms of Service. In summary, you retain rights in the inputs you provide, and the rights in generated outputs are allocated according to your plan and the Terms. Deleting content from your account is a privacy operation; related licensing terms continue to apply as described in the Terms.

14. Third-Party Links and Embeds

Mubert may link to or embed third-party content (for example, help articles, documentation, or external platforms). This Privacy Policy applies only to Mubert. We are not responsible for the privacy practices of third-party sites. Please review their policies before providing any personal data.

15. Language

This Privacy Policy is provided in English and may be translated into other languages for your convenience. In case of any conflict or inconsistency between the English version and a translation, the English version prevails to the extent permitted by applicable law.

16. Accessibility

We aim to make this policy readable and accessible. If you have a disability and need this policy in an alternative format, please contact us using the details below and we will do our best to accommodate your request.

17. Contact Us

If you have questions, concerns, or requests about this Privacy Policy or your personal data, please contact us:

Email: [email protected]

Website: https://mubert.ai