Last Updated: October 26, 2026
BeatLab is operated by Berkay Cengiz ("BeatLab", "we", "us", or "our"). This Privacy Policy explains how we collect, use, share, and retain information when you use the BeatLab mobile app, beatlabai.app, shared song pages, and related services (the "Services"). It also explains your choices and how to contact us. This Policy is a notice about our practices, not a blanket request for consent or a waiver of your privacy rights.
This Privacy Policy is structured as follows:
Guest and linked accounts: When you open the app without an active session, BeatLab may automatically create a cloud-backed guest account with a unique account identifier. We associate your library, credits, subscription status, generation activity, and last-login information with your account. Guest mode does not mean that your activity is anonymous or stored only on your device. Losing an unlinked guest session after uninstalling the app, clearing app data, or changing devices may prevent us from restoring access.
Apple and Google sign-in: If you link or sign in with Apple or Google, we receive the identifiers, email address, profile name, and authentication information made available by that provider. Apple may supply a private relay email address. We also process session tokens; for Sign in with Apple, our backend stores an encrypted authorization refresh token to support revocation when you delete your account. We do not receive your Apple or Google account password.
Creative content: We process your prompts, custom lyrics, song titles, mood, genre and generation settings, generated audio, alternate versions, cover images, singer personas, persona descriptions and previews, music videos, and related generation identifiers and status. Images you select or capture may be uploaded for custom cover art or performer-based video generation. For lip-sync and performance features, the selected image and an audio clip are sent to the relevant AI service. Please do not include unnecessary personal or sensitive information, or another person's image or other content without the necessary permission.
Purchases and credits: We process store transaction or purchase-token information, product identifiers, subscription periods and status, purchase and renewal events, credit balances, credit usage, refunds, and entitlement information. Apple or Google handles payment details for in-app purchases; BeatLab does not receive your full payment card number from those purchases.
Device, analytics, and logs: Our Services and integrated SDKs process technical information such as IP addresses, device and app-instance identifiers, device model, operating system, app version, language, timestamps, and error or request information. Firebase Analytics receives app interactions, including paywall views and selections, purchase attempts and outcomes, and restore outcomes. Firebase Remote Config uses installation information to deliver operational settings, such as maintenance availability.
Device-based eligibility and referrals: On supported mobile platforms, the app sends an Android device identifier or Apple Identifier for Vendor to our server. The server converts it to a keyed one-way hash and stores that pseudonymous value rather than the raw identifier in account and referral records. We use the hash, invite codes, referral relationships, and reward records for eligibility checks, duplicate-reward prevention, and abuse detection. The hash is not used by us for cross-app advertising tracking; hashing does not make these records anonymous.
Notifications: If you allow push notifications, we process a push token linked to your account and notification delivery information. Notifications may contain a song or singer name, generation status, or a content identifier used to open the relevant screen.
Creator names and local preferences: The creator name you enter in Settings for certificates is saved locally on your device and sent to our server when you request a certificate. It is included in the resulting document. If you use a name to publish a song to Explore, that artist name is also saved with the song on our server and displayed publicly. Changing the local name does not automatically change names on previously published songs or exported certificates. The app also stores items such as your language, onboarding and referral-introduction state, session information, and notification-registration state locally.
Explore activity: We process song-publication status, public artist names, publication dates, likes linked to account and song identifiers, listening activity and last-counted playback timestamps, aggregate play and like counts, and creator-block relationships. Playback progress is used to determine when to submit a qualifying listen. Explore displays aggregate counts, not a public list of individual listeners or people who liked a song. Creator blocking uses account identifiers to filter the Explore content available between the affected accounts.
Content reports and support: When you report generated content, we store the reporting account identifier, content identifier and type, report reason, optional explanation, a snapshot of the reported content's metadata, and review information. Support requests may include your contact details, correspondence, and any attachments you choose to send.
Depending on the feature and operating system, the app may request:
You can decline or revoke these permissions in your device settings; the corresponding camera, media, or notification feature may then be unavailable. Push permission is not required to generate or play content. Background playback can continue audio you have started and display playback controls; it is not background microphone recording. Revoking a permission does not delete content you already uploaded. Operating-system permissions are separate from any additional privacy consent required for a particular use of your data.
We collect information when you use the app or website, create or link an account, submit generation requests, upload an image, request a certificate, make or restore a purchase, use an invite code, report content, or contact support. We also receive authentication information from Apple or Google and transaction information from app stores and RevenueCat. Account initialization and some operational SDK connections can occur when the app opens, before you finish onboarding.
We use your personal data to:
Where applicable data protection law requires a legal basis, processing necessary to deliver the features you request is based on performing our agreement with you. Security, fraud prevention, service operation, and improvement may rely on legitimate interests where permitted and subject to the required assessment of your rights. Legal obligations may require certain records or disclosures. Consent applies where required by law, including for certain analytics or device access; neither this Policy nor a service-related purpose replaces that requirement.
The mobile app uses local storage and caches for sessions, language and onboarding preferences, the creator name you enter, playback and interface state, and notification registration. These local records are separate from your cloud account. Browser cookie controls do not control native mobile SDKs.
Firebase Analytics measures app usage and purchase-flow events using app-instance and technical information. This is separate from Firebase Remote Config, which delivers operational configuration. The app does not currently include a dedicated analytics toggle. Contact us about privacy choices and requests; available operating-system controls vary. Browser cookie settings do not disable analytics collected by the mobile app.
The website and shared media pages generate ordinary hosting, security, and request logs. Hosting providers may use cookies or similar mechanisms for security and service delivery. If non-essential website cookies or additional tracking are introduced, any legally required notice and consent must be provided separately.
Storage: We use cloud infrastructure and service providers that may process or store information outside your country, where data protection laws may differ. Your rights and any safeguards required by applicable law continue to apply. Using the Services does not waive those rights or constitute unrestricted consent to international transfers.
Account and content: We keep your account and library records while needed to provide the Services, including access to generated content and credit balances, until you delete the relevant content or account, subject to the limited exceptions below. Retention depends on the type of information, its purpose, your account status, and applicable legal requirements.
Explore records: Removing a song from Explore changes its feed visibility; it does not delete the library song, stored artist name, publication date, or related interaction records. You can remove your like or unblock a creator using the app controls. Deleting a song removes its associated like and listening records; deleting an account also removes its associated likes, listening records, and block relationships, subject to the separate moderation and other retained records described below.
Account deletion: You can delete guest and linked accounts from Settings > Danger Zone > Delete Account. The deletion flow removes the current authentication account, active account record, library songs, videos, personas, and associated files controlled by BeatLab. Remaining credits are removed. Successful deletion cannot be undone, and the deleted cloud library cannot be restored. For access problems or assistance, use our account deletion instructions or contact support.
New guest session and local files: Continuing to use the app after deletion may create a separate guest account with a new identifier. It does not restore the deleted account's library or credits. Device-level preferences, such as onboarding completion or a locally saved creator name, and files you exported to your device may remain. You can change the creator name in Settings and remove local app data or downloaded files using the controls provided by your device. Uninstalling the app alone does not delete the cloud account or cancel a subscription.
Limited retained records: Transaction, security, referral-eligibility, fraud-prevention, moderation, support, or legal records may remain for as long as necessary for the relevant purpose and permitted or required by law. A content report includes a metadata snapshot that can remain after the source content or account is deleted; it is used for review rather than restoring your library. Pseudonymous eligibility records can prevent repeated promotional claims after account deletion. Backup copies may remain until removed through the relevant backup lifecycle. These records remain subject to applicable privacy rights and retention limits.
External copies and providers: Account deletion is not an instruction that instantly erases every app-store transaction, third-party AI processing record, provider log, CDN cache, or copy another person has downloaded. Those records and copies have separate retention arrangements and legal obligations. Contact us about deletion of personal data held through our providers; we will handle requests according to our responsibilities and applicable law. Your store subscription must be cancelled separately.
We do not sell your personal data. The providers involved depend on the feature you use. Current integrations include:
AI processing: Requests can pass through an API intermediary to the underlying model provider. Provider retention and possible model-improvement use depend on the service, plan, settings, and applicable agreement. We do not make a blanket promise that all AI providers operate with zero retention or exclude all model-improvement use. Provider links explain their practices but do not replace our responsibilities to you.
Explore publication: Publishing is optional and requires a linked account, an artist name, and confirmation of the publication terms. Other Explore users, including guest accounts, can discover and play published songs and see information such as the artist name, song title, artwork, lyrics, publication date, and aggregate play and like counts. Explore responses also include song and creator account identifiers to support playback and blocking; your sign-in email is not displayed as the public artist name. Use Remove from Explore in your song's menu to remove it from the feed. Blocking a creator filters Explore access between the affected accounts; it does not make a separate web or media link private.
Shared song and media links: Explore publication is separate from link-based access. A person who knows a completed song's BeatLab web link can access the shared page without signing in, including its title, audio, artwork, prompt, and lyrics, and an unlocked alternate version where available, subject to moderation restrictions. Removing a song from Explore does not disable that separate web page. Media URLs used for playback or sharing are not a private access-control mechanism. Do not treat these links as confidential; recipients may forward them or save copies. Deleting the song or account removes the active source, but does not recall third-party downloads or immediately clear every cache. A shared certificate also reveals the creator name and song details printed on it.
Other disclosures: We may disclose information when required by law or reasonably necessary to investigate abuse, respond to rights or safety complaints, or protect legal rights. If the Services are transferred as part of a merger, acquisition, or sale, relevant information may transfer subject to applicable law and any required notice. Sharing links or exporting files to another app is your choice; that recipient's practices also apply.
We use technical and organizational measures intended to protect information, including encrypted HTTPS connections, authenticated access to account features, access restrictions, and keyed hashing of device eligibility identifiers. Security depends in part on the services and devices involved; no storage or transmission system is completely secure. A playable or shareable public URL should not be treated as an encrypted private vault.
Depending on applicable law, you may request access to or a copy of your personal data, correction, deletion, portability, restriction, or objection to processing. Where processing relies on consent, you may withdraw that consent without changing the lawfulness of earlier processing. These rights can have legal conditions or exceptions, and required information may be necessary to continue providing a particular feature.
You can delete your account in Settings > Danger Zone > Delete Account, delete available library content through its menu, change local preferences in Settings, and control camera, photo, and notification permissions through your device. To make another privacy request or obtain help, email support@beatlabai.app. Include the account email or user ID if available, but do not send passwords or full payment card details. We may request proportionate information to verify ownership and will respond within the period required by applicable law.
For Explore, use the song menu to remove a publication or report content, the heart control to remove your like, and Block creator to filter an unwanted creator. Manage or remove your blocks through Explore's menu > Blocked creators. These controls do not recall copies or disable independently accessible shared links.
Deleting your account, signing out, disabling notifications, or uninstalling the app does not cancel an App Store or Google Play subscription. Use the relevant store's subscription-management controls separately.
The Services are not intended for children under 13. Where local law requires a higher minimum age or parental consent, that higher requirement applies. We do not knowingly collect personal data from children in violation of applicable law. If you believe we have inadvertently collected such data, please contact us immediately to have it removed.
We update this Policy as the Services and our practices change and show the revision date above. For material changes, we will provide additional notice where required, for example through the app or an available contact channel. Posting a revised Policy does not replace any consent or other legal requirement for a new use of personal data.
If you have any questions, complaints, or requests regarding this Privacy Policy, please contact us at:
Operator: Berkay Cengiz, operating BeatLab
Email: support@beatlabai.app
For business and corporate inquiries: berkay@beatlabai.app
The following information applies where the relevant law covers our processing of your information. It does not limit rights available under another applicable law.
Where the EU or UK GDPR applies, BeatLab's operator is the controller of personal data used to operate the Services. The purposes and corresponding legal bases are described in Section 4. Subject to the relevant conditions, your rights include:
To exercise these rights, please contact us at support@beatlabai.app.
Where Swiss data protection law applies, you may exercise the access, correction, deletion, and other rights available under that law and contact the Swiss Federal Data Protection and Information Commissioner. Swiss rights are governed by the applicable Swiss law rather than automatically by the EU GDPR.
Where the California Consumer Privacy Act, as amended, applies to our processing, California residents may exercise the following rights, subject to its conditions:
You or an authorized agent can submit a request to support@beatlabai.app. We may verify the request or the agent's authority and will respond within applicable statutory deadlines. Other US state privacy rights, including an appeal where required, can also be requested through this contact.