Privacy policy

Effective 1 October 2026

AIEIO Music (aieio.au/music) is operated by WWW.DIRECTORY.COM.AU PTY LTD (ABN 68 090 816 461), Sydney, Australia ("we", "us"). We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy describes what the service actually does.

What we collect

• Account details: your name, email address and a one-way hash of your password (we never see or store the password itself).
• What you create: prompts, lyrics, song plans, sound-effect descriptions, the audio we generate for you, stems, and your settings such as sharing.
• Video uploads: clips you upload to score. The original upload is deleted as soon as scoring finishes, or after 24 hours if unused. The scored MP4 is kept for 14 days.
• Payments: card payments are processed by Stripe. We receive the payment status, amount, the email address you paid with and a receipt link - never your card number.
• Technical information: your IP address and basic request details, used for security, abuse prevention and rate limiting, kept in server logs. We count page views per day without cookies or personal identifiers.
• Messages: anything you send through the support or report forms.

Cookies

We use one session cookie to keep you signed in. We do not use advertising, analytics or tracking cookies.

How we use it

To provide the service (generate, store and play your tracks), keep your account secure, process purchases and send receipts, send the emails you need (email confirmation, password resets), answer support requests, prevent abuse and meet legal obligations. We do not sell personal information, and we do not use your prompts, lyrics or tracks to train AI models.

Who we share it with

• ElevenLabs (ElevenLabs Inc.) generates the music: your prompts, lyrics, plans, the audio you ask to split and the videos you upload are sent to its API to produce your results. ElevenLabs may process data outside Australia, including in the United States.
• Stripe processes card payments.
• Hosting and email: our servers are hosted by Amazon Web Services in Sydney; transactional email is sent through our own mail relay.
• Authorities, where the law requires it.

Some of these providers store or process data overseas. We choose providers with strong security practices and only share what each needs to do its job.

Shared tracks

If you turn on sharing for a track, anyone with its link can play it and see its title, genres, lyrics and the display name on your account. Turning sharing off disables the link. We feature a track in Explore only if you tick the box allowing it.

How long we keep it

Account information and tracks are kept until you delete them or your account. Deleted tracks and their files are removed straight away. Payment records are kept for the period Australian tax law requires, with the email address replaced by an anonymous code if you delete your account. We also keep a one-way fingerprint of your email address (it cannot be turned back into the address) with any starter-credit or promo-code record, so they cannot be claimed twice by deleting and re-creating an account. Server logs are rotated regularly.

Security

Connections are encrypted (HTTPS), passwords are hashed with bcrypt, files are stored outside the public web folder and are only served to their owner (or through your share link), and access to the operator console is restricted and rate limited.

Your choices and rights

You can see, download and delete your tracks at any time, change your name and password, and delete your whole account from the Account page. You can ask us for access to or correction of your personal information through the support form. If you are in the European Union or United Kingdom you also have the rights given by the GDPR, which you can exercise the same way.

Complaints

Contact us first through the support form and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Changes

We will update this page when our practices change, and tell signed-in users about significant changes.