MusivaPrivacy Policy
Effective date: 5 November 2026 · Last updated: 5 November 2026
This Privacy Policy explains how personal data is processed when you use the Musiva mobile app (the “App”) and the website musiva.studio (together, the “Service”). It is written to meet the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the EU General Data Protection Regulation (“GDPR”), and it also serves as the information notice under Article 10 of KVKK.
1. Data controller
The data controller is Alper Kayabaşı, an individual developer based in Istanbul, Türkiye (“we”, “us”). You can reach us at support@musiva.studio.
2. Personal data we process
We collect data electronically through the App, the website and email.
What you enter
The song description, lyrics, style, song name and vocal preference you enter when creating a song.
What we create for you
The audio files of the songs generated for you, and their title and duration.
Account identifiers
Each installation signs in automatically with an anonymous account. We use pseudonymous account identifiers for it. The App also shows you a reference number called your Musiva ID, for support. We do not ask for your name, email address, phone number or a password.
Purchases, subscriptions and credits
Records of your subscriptions and purchases, received through Apple and Adapty, and the movements of your credits (credits added, used and expired). Payments are made through Apple; we do not receive your payment card details.
Technical connection data
The technical logs of our infrastructure providers may contain connection data such as your IP address.
Support emails
If you email us for support, we receive your email address and the content of your message. When you write from the App, the App adds your Musiva ID to the email draft.
Website
The website stores your language choice persistently in your browser’s localStorage, so it is remembered on later visits until you clear your browser data. It uses no cookies. Our website hosting provider’s technical logs may contain connection data such as your IP address.
Advertising measurement (iPhone)
On iPhone, technical data about your device and your use of the App, and your purchase events, are used to measure our own advertising through Adjust, as described in section 5.
What we do not do
The Service shows no advertising and has no crash reporting. Apart from measuring our own advertising with Adjust on iPhone (section 5), we do not analyse your data for advertising or tracking purposes. Before Adjust may receive your device’s advertising identifier (IDFA), the App asks for your permission through Apple’s App Tracking Transparency prompt.
3. Purposes and legal grounds
| Purpose | Data | Legal ground (KVKK Art. 5/2 · GDPR Art. 6(1)) |
|---|---|---|
| Creating your songs and providing your library: generating, storing, playing, showing lyrics, sharing, renaming and deleting songs | What you enter, the songs we create, account identifiers | Necessary for the performance of our contract with you (KVKK 5/2(c) · GDPR 6(1)(b)) |
| Running your anonymous account and showing your Musiva ID | Account identifiers | Performance of the contract (KVKK 5/2(c) · GDPR 6(1)(b)) |
| Selling subscriptions and credit packs, adding and using credits, and processing renewals and refunds reported by Apple | Purchase and subscription records, credit movements, account identifiers | Performance of the contract (KVKK 5/2(c) · GDPR 6(1)(b)); compliance with legal obligations for records the law requires us to keep (KVKK 5/2(ç) · GDPR 6(1)(c)) |
| Preventing the same purchase from adding credits twice | A purchase-effect record that is not linked to your account | Our legitimate interest (KVKK 5/2(f) · GDPR 6(1)(f)) |
| Operating the Service securely and preventing abuse | Technical connection data | Our legitimate interest (KVKK 5/2(f) · GDPR 6(1)(f)) |
| Answering support requests | Your email address, message content, Musiva ID | Performance of the contract (KVKK 5/2(c) · GDPR 6(1)(b)); our legitimate interest (KVKK 5/2(f) · GDPR 6(1)(f)) |
| Measuring and improving our own advertising (iPhone) | The device and usage data, app events and purchase events described in section 5; the IDFA only if you allow tracking | For the IDFA, your consent given in Apple’s App Tracking Transparency prompt (KVKK 5/1 · GDPR 6(1)(a)); for the other data, our legitimate interest (KVKK 5/2(f) · GDPR 6(1)(f)) |
| Operating the website | Language preference, technical connection data | Our legitimate interest (KVKK 5/2(f) · GDPR 6(1)(f)) |
4. Service providers and other recipients
We share data with the following service providers and other recipients to run the Service. Most of them process data on our behalf; Apple may process payment data under its own responsibility.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | App data described above | AWS eu-central-1 (Frankfurt, Germany) |
| Render (Render Services, Inc.) | Backend hosting | Data passing through our server, technical request logs | Render’s Frankfurt region (Germany, EU); Render states that its primary processing operations take place in the United States, and its subprocessors (Amazon Web Services, Google Cloud Platform, Cloudflare, ClickHouse) are United States entities |
| Adapty | Subscription and purchase management | Pseudonymous user identifier, purchase data | United States (Adapty Tech Inc.) |
| Adjust | Attribution and advertising measurement (iPhone) | Device identifiers (Adjust device identifier, IDFV, IDFA only if you allow tracking), IP address and coarse location, device model and operating system version, install and session times, app events, purchase events from Adapty | Germany (Adjust GmbH, Berlin); data may also be processed outside the EEA, including the United States (Adjust Inc.) |
| Apple | Payments | Purchase and subscription data | Generally stored by Apple Inc. in the United States; for the EEA and the UK, Apple Distribution International Limited (Ireland) controls the data |
| EvoLink | Music generation | Description, lyrics, style, song name, vocal preference | Hong Kong and other jurisdictions where EvoLink’s service and model providers operate; data may be processed outside the EEA, including the United States |
| Mureka (backup) | Music generation | Description, lyrics, style, song name, vocal preference | United States (Mureka’s servers; operated by SKYWORK AI PTE. LTD., Singapore) |
| Vercel | Website hosting | Technical connection data of website visits | United States (Vercel Inc.) and Vercel’s global edge network |
| Squarespace | Forwarding email sent to support@musiva.studio | Support emails | United States and other countries (Squarespace Ireland Limited for customers outside the US) |
| Google (Gmail) | The mailbox that receives the forwarded support email | Support emails | Google’s servers around the world, including outside the EEA |
We do not ask for your name or email address when you sign up, and we do not send them to music generation providers as separate profile fields. The description, lyrics, style, song name and vocal preference you enter for a creation are sent to the music generation provider, so any personal information you write in these texts is sent as well. We may also disclose data to public authorities when the law requires it.
5. Attribution and advertising measurement (Adjust)
On iPhone, Musiva uses Adjust, a mobile measurement service provided by Adjust GmbH, to learn which of our advertisements and links bring people to the App. When you install and open Musiva, the Adjust SDK sends Adjust technical data about your device and your use of the App: a device identifier created by Adjust, the identifier for vendors (IDFV), your IP address and the coarse location derived from it, the device model and operating system version, the time of installation and of App sessions, and these App events: onboarding completed, a subscription screen viewed, and your first song completed. If you allow tracking in Apple’s App Tracking Transparency prompt, Adjust also receives your device’s advertising identifier (IDFA). Our subscription provider, Adapty, sends Adjust your subscription and credit-pack purchase events with their price, currency and a pseudonymous customer identifier that Musiva assigns to your account for billing, so that we can measure the revenue each campaign brings.
We use this data only to measure and improve our own advertising. We do not send Adjust your songs, prompts, lyrics, titles or your Musiva ID.
Your choices. iOS asks whether Musiva may track you. If you choose “Ask App Not to Track”, Adjust does not receive your IDFA, and we measure only through Apple’s privacy-preserving SKAdNetwork and AdServices attribution. You can change your choice at any time in iOS Settings → Privacy & Security → Tracking. Musiva works the same either way.
Deletion and retention. When you delete your data in Musiva (Settings → Delete My Data), the App asks Adjust to forget your device: Adjust deletes its historical data about your device and receives no further data from it through the App. Otherwise Adjust keeps this data only as long as needed to provide the measurement service to us, and deletes it when we or you ask (see Settings → Delete My Data). Adjust states that it keeps such data only for as long as its customer uses its services for the app, and deletes or anonymises it at the latest when the customer removes the app or asks for deletion. We keep campaign reports only in aggregated form.
Recipient. Adjust GmbH, Saarbrücker Str. 37a, 10405 Berlin, Germany, processes this data for us. Adjust’s privacy policy: https://www.adjust.com/terms/privacy-policy.
6. Transfers abroad
Our servers are not in Türkiye, so using the Service involves transferring personal data abroad. Supabase stores App data in Frankfurt, Germany, and our backend server runs in Render’s Frankfurt region in Germany. Adapty, Adjust, Apple, EvoLink, Mureka, Render, Vercel, Squarespace and Google may process data outside the European Economic Area, including in the United States; the locations each of them states are listed in section 4.
Where a provider offers them, these transfers are made under the European Commission’s Standard Contractual Clauses: Supabase, Adapty, Adjust, Apple, EvoLink, Vercel, Squarespace and Google state that they use them. Render makes transfers to the United States under the EU-U.S. Data Privacy Framework and, if the Framework does not apply, under the Standard Contractual Clauses. Mureka does not state a transfer mechanism; transfers to Mureka are made because they are necessary to perform our contract with you (Article 49(1)(b) of the GDPR). All transfers are made in line with Article 9 of KVKK and Chapter V of the GDPR.
7. How long we keep data
In our systems
- Songs and what you entered: until you delete the song or delete your data.
- Account identifiers, purchase records and credit movements: until you delete your data.
After you delete your data, three kinds of records remain that are not linked to your account:
- Duplicate-credit protection: to prevent the same purchase from adding credits twice, a record with a one-way hash (fingerprint) of the purchase identifier and the product and store information, kept for 365 days.
- Subscription chain and period records: kept until 365 days after the end of the last subscription period.
- Store notifications that could not be matched to an account: after 30 days we remove the account identifiers from these records and replace the purchase identifiers with a one-way hash (fingerprint); the remaining record is deleted after 365 days.
Outside our systems
- Music generation providers (EvoLink, Mureka): the temporary audio links at the provider expire within a few days. EvoLink states that it keeps prompts and parameters for up to 45 days and generated results for 24–72 hours, and that it does not use customer data to train models. Any copies these providers keep are subject to their own policies.
- Apple and Adapty keep their own purchase records under their own policies.
- Adjust: as described in section 5.
- Technical logs of infrastructure providers: for the period set by our infrastructure providers’ retention settings; our backend host, Render, keeps request logs for 7 days.
- Support emails: up to 2 years after our last correspondence or, if there is a dispute, until it is resolved.
Deleting the App from your phone does not delete your data from our servers, and you can no longer reach that account afterwards. If you want your data deleted, use Settings → Delete My Data before you remove the App.
8. Your rights and how to apply
Under Article 11 of KVKK you have the right to: learn whether your personal data is processed; request information about it; learn the purpose of processing and whether it is used for that purpose; know the third parties in Türkiye or abroad to whom it is transferred; request correction of incomplete or inaccurate data; request its deletion or destruction; request that third parties to whom it was transferred be notified of correction or deletion; object to a result against you that arises solely from automated analysis; and claim compensation for damage caused by unlawful processing.
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests.
Delete your data in the App
Settings → Delete My Data deletes the data in our own systems: your files, database records and account, and your Adapty profile, and on iPhone the App asks Adjust to forget your device (section 5). It does not cover the records described in section 7 that are kept without being linked to your account, copies kept by music generation providers under their own policies, support emails or infrastructure logs. To have your support emails deleted, ask us by email. Deleting your data does not cancel an App Store subscription; cancel it in your App Store account settings.
Other requests
Email support@musiva.studio, or use Settings → Contact Us in the App, which adds your Musiva ID for you. Because there is no email or login, we may need your Musiva ID to find your account data, and we will ask for verification appropriate to the type of request. We answer requests under KVKK within 30 days and requests under the GDPR within one month; the GDPR’s conditions for extending this period remain reserved.
Complaints
If you are in Türkiye, you may complain to the Personal Data Protection Board (KVKK Kurulu) after applying to us. If you are in the European Economic Area, you may complain to the data protection authority of the country where you live or work.
9. Children
Musiva is for people aged 13 and over and is not directed to children. If you believe a child under 13 has used the Service, contact us with the Musiva ID so the data can be deleted.
10. Changes to this policy
We may update this policy. We will publish the new version on this page with a new effective date and, where the law requires it, inform you by other appropriate means.
11. Contact
Email: support@musiva.studio