Privacy Policy

This Privacy Policy explains how personal data of users ("User") of the Hifly service at hifly.app is processed. The data controller is Bulut Studio (operating the Hifly service). Payment collection is handled by Lemon Squeezy, Inc. as Merchant of Record.

This policy is prepared in accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK) and, for users residing in the European Union, the General Data Protection Regulation (GDPR).

1. Summary

Hifly processes limited personal data to identify you, manage your account, store your generations, and improve the service. Your password and payment card details are not stored on Hifly servers. Your data is not shared with third parties for marketing; it is shared only with infrastructure providers necessary to operate the service.

You may exercise your data subject rights at any time via support@hifly.app.

2. Personal Data Collected

2.1. Identity and Contact

• Email address (at registration)
• Display name or username (if provided)

2.2. Account and Authentication

• Cryptographic hash (bcrypt) of your password - the password itself is never stored
• Session token (JWT)
• Account creation date, last login date

2.3. Service Usage

• Your generation prompts (Talk conversations, selected genre, mood, lyric guidance)
• Metadata of generated songs (id, date, duration, genre)
• CDN link to the song file (output)
• Like/Lyrics/Revise/Extend actions (usage analytics)

2.4. Plan and Payment

• Current plan (Free / Pro)
• Subscription status and period
• Customer identifier issued by the payment provider (Lemon Squeezy)
• Invoice identifier

Important: Card number, expiry, CVC code are never received by Hifly servers; this information is collected and processed directly by Lemon Squeezy on its PCI-DSS-compliant infrastructure. Lemon Squeezy acts as the Merchant of Record for these transactions; Hifly is operated by Bulut Studio.

2.5. Technical Data

• IP address (at login and during requests, for security)
• Browser type/version, operating system
• Screen resolution and viewport (mobile/desktop)
• Error logs (technical diagnostics on app crashes)

2.6. Cookies

See Section 5.

3. Methods of Collection

3.1. Directly: through the registration form, account management, and use of the service.

3.2. Automatically: technical data from browser requests (IP, user agent, screen dimensions), session cookies, error tracking logs.

3.3. Via third parties: data provided by the User to Lemon Squeezy during the payment flow (name, country, billing address) is transmitted to Hifly via Lemon Squeezy.

4. Processing Purposes and Legal Bases

5. Cookies

5.1. Strictly Necessary

• hifly_access and hifly_refresh (session cookies): to remember that you are logged in and to renew your session securely.
• Your cookie choice: your answer about analytics cookies is kept in your browser's local storage (hifly_cookie_consent) so that it is not asked again on every visit.

5.2. Preferences

• UI settings such as theme and language.

5.3. Analytics

Analytics cookies are used only with your explicit consent. If you choose "Accept" in the strip shown on your first visit, Google Analytics 4 is loaded. If you choose "Decline" or make no choice, it is not loaded and no request is sent to Google.

• What is measured: pages visited, on-page interactions (such as scrolling and link clicks), sign-up and purchase steps, browser and device type, approximate location (country and city level). Your name, email address, songs and conversation texts are not sent. No measurement runs on password reset, email verification and song sharing pages.
• Cookies: _ga and _ga_JQ2LGEDS23, kept for at most 13 months.
• Disabled features: ad personalization and Google signals are off. The data is not used for advertising.
• Retention: analytics data is kept in Google Analytics for 14 months.
• Our own visit counter: with consent, a random visitor identifier (hifly_visitor_id) and the source of your first visit (hifly_first_touch: landing page, referring domain, campaign parameters if any) are kept in your browser. Without consent these are not stored; the visit is still counted without writing anything to your browser.
• Withdrawing consent: you can choose "Decline" at any time from the "Cookie preferences" link at the bottom of the site or at the end of this page. Measurement then stops; the analytics cookies and the local records above are removed from your browser.

6. Third-Party Recipients

The following infrastructure providers receive data only as necessary to operate the service. They process data on behalf of Hifly:

Hifly shares with these providers only the data needed to provide the Service and relies on the data processing terms they offer. Hifly does not allow these providers to use user data for marketing.

7. International Data Transfers

Most providers in Section 6 process data in US or EU data centers, which constitutes transfer outside the Republic of Turkey.

7.1. International transfers are made under KVKK Art. 9. Regular transfers rely on the standard contracts set by the Board, and signed contracts are notified to the Board. Occasional transfers may rely on the cases in Art. 9(6), including your explicit consent.

7.2. For EU and UK residents, adequate protection is provided under GDPR Art. 46. Hifly works with the providers this applies to under the EU Commission Standard Contractual Clauses (SCCs) or equivalent safeguards.

7.3. If you consent to analytics cookies, the related data is processed on Google's servers in the EU and the US. This transfer is based on the explicit consent given in the cookie strip and stops when consent is withdrawn.

8. Retention Periods

9. Data Subject Rights

Under KVKK Art. 11 and GDPR Art. 15-22, you have the right to: access, rectification, erasure (right to be forgotten), restriction of processing, data portability, objection, and to object to automated decision-making.

You may also withdraw consent at any time.

Submit requests to support@hifly.app. Requests are resolved within 30 days.

10. Children's Data

10.1. Hifly does not knowingly collect personal data from individuals under 13 years old.

10.2. Users aged 13-18 require parental or legal guardian consent to purchase a paid plan.

10.3. For EU residents under 16, parental consent is required under GDPR Art. 8.

11. Data Security

• TLS 1.2+ in transit
• At-rest encryption (managed by our database infrastructure provider)
• Passwords stored as bcrypt hashes
• Row Level Security (RLS): each User can access only their own data
• Brute-force protection: login attempts are rate-limited
• Leaked password check (HaveIBeenPwned integration)
• Regular security reviews

12. Updates

This Policy may be updated periodically. Material changes are notified by email at least 30 days in advance.

13. Contact and Complaints

13.1. Submit inquiries to support@hifly.app.

13.2. Turkish residents may complain to the Personal Data Protection Authority (https://kvkk.gov.tr).

13.3. EU residents may complain to their national data protection supervisory authority under GDPR.

Data Controller

• Email: support@hifly.app
• Operator: Bulut Studio (Hifly), hifly.app · Lemon Squeezy, Inc. (Merchant of Record)
• Brand: Bulut Studio