MeluMimi
Back to app返回网站返回網站アプリに戻る앱으로 돌아가기

LEGAL · POLICY

Privacy Policy

This policy explains how MeluMimi handles account details, uploaded files, job records, and payment-related information.

Operator
MeluMimi
Effective date
2026-09-08

English is the source version of this document. Mandatory rights under applicable law remain unaffected.

1. Information we collect

We process an account email, hashes of short-lived sign-in tokens, session and security logs, uploaded audio or video, audio extracted from video, resulting MIDI, job status, usage, order identifiers, and membership status. If you choose Google sign-in, we receive a stable Google account identifier and verified email; we do not store Google access or refresh tokens. For guest access, we use an essential signed identifier and transform coarse device and network properties into a keyed, non-reversible monthly digest to enforce the free quota. We do not retain the raw device fingerprint or raw network address for this guest identifier. We may also record the signup and most recent access country or region inferred from the network address, plus state or city where our provider supplies it. We do not collect device GPS for this purpose, and VPNs or proxies may affect the result. Full payment credentials such as card numbers are handled by Paddle and are not stored by us.

1A. Traffic analytics

For successful public HTML page loads, we retain daily page-view totals for up to 180 days. Unless the browser signals Do Not Track or Global Privacy Control, we also retain a fixed-size probabilistic bitmap for up to 180 days to estimate unique visitors and create a separate per-page detail record for no more than 30 days. A network address and coarse browser category are transformed transiently with a keyed one-way function. The detail record contains server time, country code inferred at the network edge, page path without query or fragment, referring hostname only, coarse device class, approximate foreground-visible seconds, and a coarse traffic assessment such as likely human, declared crawler, suspected automation, or historical unclassified. The assessment may also retain a broad crawler family, confidence level, and non-identifying classification basis; it is probabilistic and not proof that a request was made by a person or a particular bot. JavaScript, when available, updates the visible-time estimate and may store rounded Core Web Vitals (LCP, INP, and CLS), TTFB, and the rounded same-origin application response duration exposed through Server-Timing for that page view. Performance records do not include element names, resource URLs, or typed or clicked content. For the site owner only, an optional signed, HttpOnly first-party cookie can classify new records as owner or other; the detail database stores only that result, or historical unknown, and never stores the cookie or a device identifier. Its random per-page identifier is not reused across pages or sessions and is not linked to an account. When a MeluMimi promotion link contains allowlisted UTM labels, we may retain only normalized source, medium, campaign, and content labels; all other query values are discarded. We may also retain a small allowlist of product-funnel and evidence-video event names, such as upload started, job submitted, conversion succeeded, MIDI downloaded, signup completed, checkout started, and whether an accuracy-evidence video was started, reached halfway, or completed. Each event is deduplicated per page view and stores no file, upload, job, account, email, order, video position, or video-content identifier. We do not store the raw network address, full user agent, full referrer URL, account, session, email, or order identifier in these traffic records. The separate detail database is excluded from our routine long-term application database backups. Cloudflare may also provide cookie-free aggregate Web Analytics. We do not use this data for advertising.

1B. Contact messages

When you use the Contact us form, we store its subject and message, whether it came from a guest or account, and the account email when available. These records are available only in the private owner dashboard and are automatically deleted after no more than 365 days. The contact record does not store a raw network address, device fingerprint, full user agent, or security-verification token. The message and available account email are also sent to our email provider for notification.

2. Purposes and legal bases

We use information to create accounts, perform transcriptions, deliver files, calculate quotas, process orders, understand account operating regions, secure the service, prevent abuse, troubleshoot, meet legal obligations, and improve reliability. Depending on applicable law, we rely on performance of our agreement, legitimate interests in operating and protecting the service, consent where requested, and legal obligations. Approximate location is restricted to the owner dashboard and is not exposed through ordinary user APIs. We do not sell personal information or use it for targeted advertising. Uploaded media and resulting MIDI are used only to provide, troubleshoot, secure, and retain the requested transcription as described in this policy.

3. File retention

For piano-to-MIDI, uploaded audio or video is deleted after processing; only the MIDI result is retained for no more than 24 hours for guests or 90 days for registered users. Audio-format conversion sources are deleted after processing. Signed-in users can download results for 24 hours and view task history for 30 days; guest outputs are deleted after delivery. For stem separation, original video is deleted after its audio track is extracted; guest previews, results, and temporary audio are retained for 24 hours, while registered-user previews, results, and temporary audio are retained for 7 days. Once a full extraction is safely queued, the preview source is deleted; full separated results are retained for 90 days, and the full-task source is deleted when processing ends. Files are then automatically deleted, so download results before expiry. Security, order, tax, or dispute records may be kept longer where legally or reasonably required.

4. Cookies

We use essential signed cookies and security tokens required for guest quota enforcement, login, and account protection. Google may use its own cookies when you choose Google sign-in, under Google's privacy notice. We do not use advertising cookies.

5. Service providers

We may share the minimum necessary information with cloud hosting, email, security, and identity providers, including Google, and with Paddle. Google processes the sign-in interaction under its privacy notice. Paddle independently processes buyer data for checkout and payment under its own privacy notice.

6. International processing

Because the service is offered globally, information may be processed outside your region. We use reasonable contractual, access-control, and security measures and follow applicable transfer rules.

7. Security

We use measures such as access controls, one-time-token hashing, signature validation, attempt limits, upload limits, and audit logs. No internet system can guarantee absolute security.

8. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, or export of personal information, or object to certain processing. We may verify identity and retain records required by law.

9. Children

The service is not directed to children below the age at which they can independently consent in their location. Minors should use it only with guardian consent and supervision.

10. Contact and updates

Send privacy requests to the contact email. Material updates will be announced on the website with a revised effective date.

General MIDI transcription

Piano and general audio/video transcription share the MIDI balance. Each selected model reserves one source duration, rounded up to seconds. A failed model releases its portion; listening and downloading do not charge again. General MIDI source media is removed after all selected models finish. MIDI, note data and synthesized listening audio follow the same retention: up to 24 hours for guests and 90 days for registered users.