Privacy Policy

We, Mirelo AI GmbH (“Mirelo” or “we” “us”), would like to thank you for visiting our website and for your interest in our services.

We offer a platform that enables users to generate and edit audio, such as sound effects and music, through a web-based application powered by AI technology (our “AI Model/s”), making it easier to create powerful audio content (“Platform” and/or our “Service/s”).

When you visit and use our website and our Platform and when you enter into or are interested in a contractual relationship with us, your personal data may be processed. The protection of your personal data is important to us, and we would like to inform you with this privacy policy in accordance with Art. 13 of the EU General Data Protection Regulation (“GDPR”) about how we handle your personal data (hereinafter also referred to only as “data”).

Last updated: 9 October 2026

A. General information

I. Definitions

Our privacy policy should be easy to read and understand for our website visitors, our Platform users and customers, business partners and interested parties. To ensure this, we would like to explain the most important terms:

• “personal data” means any information relating to an identified or identifiable natural person (hereinafter “Data Subject”), e.g. name, address, email addresses, user behaviour;
• “Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
• “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
• “Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
• “Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person.

II. Controller

The Controller within the meaning of Art. 4 (7) GDPR is Mirelo AI GmbH, Eisenbahnstraße 1, 72072 Tübingen, legal@mirelo.ai

B. Processing activities

I. Customers, business partners and interested parties

If you are already a customer, business partner or prospective customer of our Services and a contractual, quasi-contractual or pre-contractual business relationship exists with us, we process the following data where necessary:

• Inventory data (e.g. first and last name, address, company, location)
• Contact details (e.g. e-mail address, telephone number)
• Payment data (e.g. bank details, billing information, payment history)

We process this data in particular to communicate with you, to respond to your enquiries, to fulfil our contractual obligations and to safeguard our rights.

The legal basis for this processing results from Art. 6 para. 1 sentence 1 lit. b GDPR (contract fulfilment and pre-contractual measures), Art. 6 para. 1 sentence 1 lit. c GDPR (legal obligation) and Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest).

II. Visiting our website

1. Log files

When using the website for information purposes, we process the following personal data that your browser transmits to our server:

• IP address
• Date and time of the enquiry
• Country/City/Region
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (page visited)
• Access status/HTTP status code
• Amount of data transferred in each case
• Previously visited page
• Browser type
• Operating system used
• Language and version of the browser software
• Host name of the accessing computer

This data is technically necessary for us to display our website to you and to ensure stability and security. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR.

III. Use of our Online Offer and Platform

1. Contacting us

If you contact us (e.g. via an online contact form, email or social media), your data will be processed insofar as this is necessary to answer your contact enquiry.

The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR and Art. 6 para. 1 sentence 1 lit. b GDPR.

2. Creating an Account, Registration and Login

To create an account and sign in to the Platform, use one of the sign-in methods displayed on the registration page. Depending on the methods available, these may include your email address or an account with an external authentication provider.

We process the following data in connection with registration, login, and your user account:

• Inventory data (e.g. name, address)
• Contact data (e.g. email address, telephone number if applicable)
• Content data (e.g. entries in the online form)
• Device data (device name, country code if applicable, language, name of operating system and version)
• Connection data (IP address, mail provider)
• Date and time of registration and confirmation

Legal basis: Art. 6 para. 1 sentence 1 lit. b GDPR and Art. 6 para. 1 sentence 1 lit. f GDPR.

We also store acquisition information supplied with registration, such as the referring page or campaign, to understand how people find the Services. This account record is separate from optional browser analytics. We rely on Art. 6 para. 1 sentence 1 lit. f GDPR for this purpose.

3. User Questionnaires

We process answers you voluntarily provide in questionnaires to understand your needs and improve the Services. We may also use recent generation activity to select users to invite to a research conversation, or follow up on feedback you send us. We process your account name, email address, responses and relevant usage information for this purpose. You may decline an invitation or object to further research contact by replying or emailing legal@mirelo.ai. We rely on Art. 6 para. 1 sentence 1 lit. f GDPR (our legitimate interest in understanding and improving the Services).

4. Use of our Platform

Our Service is designed to process user-provided input, which may include code, videos, images, text, software, music, sound, other audio, photographs, graphics, messages, and various other materials (collectively referred to as “Input”). Based on this Input, the Service generates and delivers audio, transcriptions, MIDI, MusicXML and score files (“Output”), depending on the feature you use.

The data processing is based on Art. 6 para. 1 sentence 1 lit. b GDPR.

5. Development and Improvement of our Services

We may use your Input and Output to develop and improve our Services, including to train the AI Models that power them, under the Training License in section 7.4 of our Terms. We do this by copying content into a separate training data store hosted by Amazon Web Services in Mumbai, India. The store can contain uploaded or generated audio and video, prompts, generation metadata and feedback text. Direct account identifiers are replaced with a pseudonymous identifier; media and free-text content may still contain personal data.

We rely on legitimate interest (Art. 6 para. 1 sentence 1 lit. f GDPR).

On a paid plan, you can switch this off at any time in Studio under Settings, Profile, “AI training on your content”. From then on, we stop adding your content to the training data store. Content already added stays there until you delete your account, when we erase it, and training that has already used it is not undone. You can switch it back on at any time. On the free plan, the Training License is a condition of using the Services free of charge (section 7.4 of our Terms), so the setting is not available.

This personal-account setting does not control an organization’s API keys. If you use an organization API key, contact legal@mirelo.ai to confirm or change the training arrangement for that organization before submitting content. Organization API requests use the training configuration of their execution account.

You can also object to this processing under Art. 21 GDPR (see section E) by emailing legal@mirelo.ai. If we uphold your objection, we switch training off for your account, with the same effect as the setting.

6. Newsletter / E-mail Marketing

You have the option to subscribe to our newsletter. Our newsletter is sent based on your prior explicit consent (Art. 6 para. 1 sentence 1 lit. a GDPR). You can unsubscribe at any time.

7. Job Application

You can apply for open positions by e-mail. The legal basis is Art. 6 para. 1 sentence 1 lit. b and Art. 88 para. 1 GDPR in conjunction with Section 26 para. 1 sentence 1 Federal Data Protection Act (BDSG).

IV. Use of Third-Party Tools

As part of our business operations and to offer certain services, we work with service providers who act as Processors. We have entered into Data Processing Agreements (DPAs) with these service providers.

1. Stripe (Payment Processing)

We use the payment service provider Stripe to process payments on our Platform. Stripe is offered by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Legal basis: Art. 6 para. 1 sentence 1 lit. b GDPR and Art. 6 para. 1 sentence 1 lit. f GDPR.

2. Authentication Providers

We use Clerk (Clerk, Inc., USA) to manage registration, sign-in and user accounts. Clerk processes names, email addresses, authentication data, session information and organization membership where applicable. If you choose an external sign-in method offered on the registration page, the selected provider also processes the authentication request under its own privacy notice. Legal basis: Art. 6 para. 1 sentence 1 lit. b GDPR and Art. 6 para. 1 sentence 1 lit. f GDPR.

3. PostHog (Analytics, Diagnostics and Session Replay)

We use PostHog provided by PostHog Inc., USA. With your browser analytics consent, we collect usage events and optional session replay. Replay can include the piano-roll display of audio-to-MIDI results. Legal basis for optional browser analytics and replay: Art. 6 para. 1 sentence 1 lit. a GDPR and Section 25 para. 1 TDDDG. You can withdraw that consent through Cookie Preferences.

Separately, our servers send account lifecycle, billing, credit usage, generation, API request and diagnostic events to PostHog to operate, secure and troubleshoot the Services. Our Premiere Pro and DaVinci Resolve plugins also send usage and diagnostic events, including plugin version and device or account identifiers. These events do not depend on your website cookie choice. We use account identifiers rather than names and email addresses where possible. The legal bases are Art. 6 para. 1 sentence 1 lit. b GDPR for providing the Services and lit. f GDPR for service reliability, security and product improvement. You may object to processing based on legitimate interests as described in section E.

4. Google Analytics (Website Analytics)

We use Google Analytics provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (and Google LLC, USA) to understand how visitors use our website. Google Analytics is delivered through Google Tag Manager and loaded only after you consent to analytics cookies. Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR and Section 25 para. 1 TDDDG.

5. Providers that process your Input and Output

To provide the Services, we send Input, Output and related text (such as prompts) to the following Processors. Each receives only what the feature you use needs. Legal basis: Art. 6 para. 1 sentence 1 lit. b GDPR and Art. 6 para. 1 sentence 1 lit. f GDPR, except optional PostHog session replay, which uses the consent basis described above.

• Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg): hosting, file storage, media processing and storage of training data, including in Mumbai, India.
• Convex (Convex, Inc., San Francisco, CA, USA): our application database and backups.
• PostHog (PostHog Inc., USA): optional session replay, which can capture generated or transcribed piano-roll output when you consent to browser analytics.
• Modal (Modal Labs, Inc., New York, NY, USA): running our own AI Models on your Input.
• Google Cloud (Vertex AI, Gemini) (Google Cloud EMEA Limited, Dublin, Ireland): analysing uploaded video and audio, and prompts, to plan generations and describe sounds.
• ElevenLabs (Eleven Labs Inc., New York, NY, USA): generating sound effects and music from prompts or video, isolating voices, and dubbing.
• fal (Features & Labels, Inc., San Francisco, CA, USA): processing audio excerpts and related prompts when you use Separate Sounds.
• AudioShake (AudioShake, Inc., San Francisco, CA, USA): separating audio into stems and aligning lyrics.
• Apify (Apify Technologies s.r.o., Prague, Czech Republic): fetching a video from a link you paste, so it can be imported.

Amazon Web Services and Convex store content for us and follow the periods in section C. The other providers receive content for a single request, except PostHog, which processes the analytics and replay data described above. Provider-held copies follow the periods in their terms, our agreements and configured retention settings, which may differ from the periods for our own storage in section C.

Several of these providers are based in the USA, our AWS training store is in Mumbai, India, and Google runs its AI models on infrastructure worldwide, so content may be processed outside the EU/EEA. The EU-U.S. Data Privacy Framework does not cover storage in India. For these transfers we rely on the EU-U.S. Data Privacy Framework where the provider is certified under it (Art. 45 GDPR), and otherwise on the EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR).

6. Slack (Internal Communication)

We use Slack, provided by Slack Technologies Limited, Dublin, Ireland, for internal communication. Feedback you send us in Studio, product feedback questionnaire responses and the reason you give when you delete your account may be posted to our Slack workspace with your name, email address, relevant recent generation activity and an internal account link, so our team can read and act on them. Registration questionnaire answers are stored in our application database. These messages have no fixed deletion period and are not deleted when you delete your account. Legal basis: Art. 6 para. 1 sentence 1 lit. f GDPR.

7. Roblox (at your request)

If you use our Roblox integration to publish a sound to Roblox, we upload that sound, the name you give it and your Roblox creator ID to Roblox Corporation, San Mateo, CA, USA. Roblox then processes it as a separate controller under its own terms. Legal basis: Art. 6 para. 1 sentence 1 lit. b GDPR.

8. Resend (Email Delivery)

Resend delivers account and service emails, research invitations, newsletters you subscribe to, and messages from our contact forms. It processes recipient addresses, message contents and delivery or engagement events. The legal bases follow the purpose of the message: Art. 6 para. 1 sentence 1 lit. b GDPR for service messages, lit. a for subscribed marketing, and lit. f for answering enquiries, research and delivery diagnostics.

9. Vercel and Cloudflare (Hosting and Network Security)

Vercel hosts our website and processes requests, IP addresses and technical logs. Cloudflare provides network and security services, including DNS, TLS and request protection. We rely on Art. 6 para. 1 sentence 1 lit. b and lit. f GDPR to deliver and secure the Services. Vercel Analytics and Speed Insights collect website usage and performance measurements only after browser analytics consent (Art. 6 para. 1 sentence 1 lit. a GDPR and Section 25 para. 1 TDDDG).

10. Tally (Creator Programme Forms)

We use Tally forms for creator programme applications and invoice submissions. Tally processes the contact details, social profiles, application answers and invoice information you submit. Legal basis: Art. 6 para. 1 sentence 1 lit. b GDPR for application and contract administration and lit. f GDPR for evaluating collaboration enquiries.

11. YouTube (Embedded Videos)

Embedded YouTube players connect to Google only when you choose to load a video. Google then receives technical information such as your IP address and the page containing the player and processes it under its own privacy notice. Loading a video is optional and is separate from browser analytics consent. Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR and, where applicable, Section 25 para. 1 TDDDG.

V. Our Online Presence on Social Media

We operate pages on the following platforms:

• Instagram (Meta Platforms Ireland Limited)
• X / Twitter (Twitter International Unlimited Company)
• Discord (Discord Inc.)
• LinkedIn (LinkedIn Ireland Unlimited Company)
• TikTok (TikTok Technology Limited)

The legal basis for processing your data on social media is Art. 6 para. 1 sentence 1 lit. f GDPR.

C. Storage and deletion of data

The data processed by us will be deleted in accordance with the statutory provisions as soon as your consent to data processing is revoked or if the purpose for processing this data no longer applies or the data is no longer required for the purpose. For Input, Output and your account, the following periods apply:

• Content you keep in Studio (projects, generations, transcriptions and the files you upload for them): until you delete it or your account.
• Files uploaded through our API or plugins: usable for 24 hours after upload, then deleted automatically.
• API results: available through the API for 24 hours. Sound effects generated through the API or our plugins, including their entries in your account’s generation history, are deleted 7 days after they are made, and at the latest after 14 days. Other API results are deleted from our result storage within 7 days.
• Content you delete: removed from our live systems straight away. Older stored versions of the files are kept for 7 days and then deleted automatically.
• Backups: we keep daily backups of our database for 7 days.
• Training data (see B.III.5): kept until you delete your account.
• Account deletion: when you ask us to delete your account, we wait 7 days so you can change your mind. We then delete your account and content. Remaining copies, including older file versions, backups and training data, are gone within 30 days after that.
• Billing and credit records: kept after account deletion for as long as tax and commercial law require.
• Deletion and integration audit records: deletion requests retain your name, email address, account identifiers, request reason and processing history to record how we handled the request. Operational integration delivery records may also retain account identifiers. These records currently have no automatic expiry and are not removed by account deletion. We retain them for accountability and handling disputes or legal claims (Art. 6 para. 1 sentence 1 lit. f GDPR); you may request review of their continued retention.

Copies held by the providers that process a single request (B.IV.5) are kept for the periods those providers set. Messages in our Slack workspace (B.IV.6) have no fixed deletion period. Deleting your account does not automatically delete historical PostHog events or replay. Contact legal@mirelo.ai to request erasure of provider-held personal data; we assess the request and any applicable retention obligations.

D. Your Rights as a Data Subject

You have the right to:

• Access your personal data in accordance with Art. 15 GDPR
• Rectification of inaccurate personal data in accordance with Art. 16 GDPR
• Erasure of your personal data in accordance with Art. 17 GDPR
• Restriction of processing in accordance with Art. 18 GDPR
• Objection to the processing of your data in accordance with Art. 21
• Data portability in accordance with Art. 20 GDPR

You also have the right to lodge a complaint with a data protection supervisory authority in accordance with Art. 77 GDPR.

E. Right to Object

You have the right to object, at any time and for reasons arising from your particular situation, to the processing of your personal data based on Art. 6 para. 1 sentence 1 lit. e or f GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms.

F. Data processing when accessing linked content

Our website may contain external links or hyperlinks to websites of other providers. This external content does not originate from us, and we have no influence on the content of third-party websites.

G. Automated decision making / profiling

We do not use solely automated decisions that produce legal effects or similarly significantly affect you within the meaning of Art. 22 GDPR. We do analyse usage to improve the Services and select users for research invitations, as described in section B.

H. Changes to this privacy policy

Due to the further development of our website and our online offer or due to changed legal and official requirements, it may become necessary to amend this privacy policy from time to time.

If you have any questions regarding the processing of your data, you can contact us at any time.