Privacy policy

Who we are

Milamo (MilaMotion) is operated by Shai Barak (שי ברק) (Israel, business number 033654807), postal address מודיעין, ישראל (Modi'in, Israel); legal notices by email to [email protected] ("Milamo", "we"). We are the controller of the personal information processed in this service.

Privacy contact (access, correction, deletion, questions): [email protected].

What information we process

To produce a lyric video for your song we process the information you provide:

• Account data: your email address and, if you sign in with Google, the name and profile data Google shares. For a magic link we store your email and a hashed one-time token.
• Order content: the song file you upload, the lyrics you paste, any creative direction you write, and, in the style step, a photo if you choose to add one.
• Production data: separated vocal and instrumental tracks, timing (alignment) data, text prompts we write from your creative direction, AI-generated images and layers, preview and final clips, and your revision requests.
• Order and payment records: order number, package, amount, status, refund requests, and the identifier our payment partner gives us. We never receive or store your card details.
• Technical data: IP address, browser details and activity logs, used for security, abuse prevention and rate limiting.
• Consent records: what you agreed to (terms, rights confirmation, photo permission, automatic recognition, newsletter), the wording, its version and the time. A consent record shows who agreed, when and to which version. It never contains audio or lyrics.
• Newsletter data (only if you subscribe): email, language, place of sign-up, and the wording and version of your consent.
• Style pictures (the optional style step): the lyrics and a short note you may add are used to create pictures in styles made from your song. Before you pay we keep only a one-way fingerprint (hash) of your lyrics, the one lyric line shown in the pictures, your note, and the pictures themselves.
• Automatic recognition (only if you choose it): the song audio you send for it, the draft words it produces, and a technical record of the job.

Purposes and legal bases

• Producing and delivering your clip, previews and revisions, and handling your order: performance of the contract.
• Security, fraud and abuse prevention, checking content against our acceptable-content rules (partly with an automated moderation service), rate limiting and reliability: our legitimate interests.
• Keeping order and tax records and handling legal claims: legal obligation and legitimate interests.
• Email list (newsletter): we use your email to send you occasional emails with news, new features and offers. Legal basis: your consent (double opt-in), which you can withdraw at any time.
• Automatic lyric recognition: your consent, which you give when you choose automatic recognition, using the control shown next to the information about it. You can decline and paste your lyrics instead.
• Showing an excerpt of your clip as an example (see the Terms): a permission you give when you order, which you can withdraw at any time.
• Photos of people: only with your explicit confirmation that you have the right to use the photo and the permission of everyone shown.

Providing information is voluntary. Without the song, the lyrics or other information an operation needs, we cannot perform it.

How your files are handled

• When you create your order, before you pay, your files (the song and the lyrics) are uploaded to our servers, hosted on Cloudflare (storage in Cloudflare R2, records in Cloudflare D1), over an encrypted connection.
• Production, meaning separating the vocals from the music, aligning the lyrics to the audio, creating images and rendering the clip, runs in our own cloud account on Amazon Web Services in Stockholm, Sweden (region eu-north-1), and may also run on computers that we operate. Files are copied there only for the work and deleted from there within the retention periods below.
• Text prompts, and photos only if you gave explicit consent, are sent to OpenAI (United States) to generate images. Your lyrics and notes (and your photo, if you add one) are also sent to OpenAI's moderation service, which checks them before we make anything. We do not send your song audio to OpenAI.
• Automatic lyric recognition happens only when you choose it, and you can always paste your lyrics instead. In the browser flow, short pieces of the song audio (not your lyrics or images) may be sent to Cloudflare Workers AI (speech recognition). We do not store those pieces.
• When you choose automatic recognition in our cloud recognition service, the audio is sent to private storage on Cloudflare R2, where it is kept for about 24 hours, and to speech recognition that runs in our own account on Amazon Web Services in Stockholm. If you do not place an order, the song and the draft words are deleted automatically after about 24 hours. The draft words are shown only to you. If you place an order, the song stays with the order and follows the periods in the next section. No one at Milamo listens to the audio for recognition, we do not share it beyond the providers named here, and we do not use it to train models. Choosing automatic recognition with the control shown next to the information about it is your consent. If you decline, nothing is sent; paste your lyrics instead. To have an upload deleted sooner, email [email protected] or delete your account.
• We do not use your song, lyrics or photos to train our own models, we do not use photos to identify people, and we do not sell your information.
• Only we, and the providers below as needed, access your files. Our staff open them only to deliver the service, handle a support request or investigate abuse.
• Style step: the lyrics and your note are sent to our own processing service, which runs in our own cloud account, to design the pictures. That service uses Anthropic's AI model (see the providers below) to design the scenes, and does not keep the lyrics after the job. The text prompts it writes are sent to OpenAI as described above. Style pictures are private to your account: they are never public, you see them only through short-lived links, and the preview pictures shown before payment carry a watermark.

How long we keep information

• Source files you uploaded (song, lyrics, photos): deleted 60 days after final delivery; for an order you never complete, or that is cancelled or refunded, 30 days after your last activity; earlier if you ask.
• Intermediate production files (separated tracks, alignment data, generated layers): deleted 60 days after final delivery.
• Delivered clips: available to download for 90 days after delivery, then deleted. We email you a reminder 14 days and 3 days before. Please save your copy of the clip during that time.
• Lyrics text, creative direction and revision requests: kept with the project and deleted when the project is deleted. Order working records (job log, file list): deleted with the order, 30 days after a draft or preview is left idle or an order is cancelled, and 90 days after delivery.
• Order and payment records, and the consent records that go with them (who, when, which version; never audio or lyrics): up to 7 years (tax and accounting obligations and legal claims), then deleted.
• Technical logs: up to 30 days. Database backups: kept on the owner’s computer and in his private Google Drive account for up to 30 days, plus up to 30 more days in that service’s trash before they are removed for good.
• Account: until you delete it. Newsletter: until you unsubscribe. Showcase excerpts you allowed: until you ask us to remove them.
• Style pictures, and the lyric line and note kept with them: pictures you do not pick are deleted 7 days after they were made, together with that lyric line and note. The picture you pick is kept with your order and follows the order periods above. This deletion is automatic. A photo you add in the style step is kept only to make your clip and is deleted once your full clip is ready. If you never place an order it is deleted 7 days after the pictures were made, and if an order is never completed, after 90 days at the latest. It is also deleted when you delete your account.
• Automatic recognition: a song uploaded for it and not ordered is deleted automatically after about 24 hours (never later than about 25 hours), and the draft words after about 24 hours. The consent record follows the 7-year period above.

You can delete a project or your whole account in the app at any time. Deleting removes your account, projects and the files stored with them from our systems, subject to the legal retention above. Files held on the machines used for production (our cloud account and the computers we operate) are deleted there as well, no later than 30 days after you delete, and within the periods above in any case. When you delete your account, we keep for 60 days a one-way hash (an irreversible code) of your internal account identifier, with the time of deletion. It contains no email, name or content. We use it only to delete the account again if the database ever has to be restored from a backup. It is removed automatically after 60 days. Copies held by providers follow their own retention (see below).

Service providers (subprocessors)

• Cloudflare, Inc.: hosting, file storage (R2), database (D1), network and security, a bot check (Turnstile) where we switch it on, and Workers AI for speech recognition and short text suggestions. Receives site data and uploaded files. Global network including the United States and the European Union.
• OpenAI, L.L.C.: image generation and content moderation. Receives text prompts, your lyrics and notes for moderation, and photos only with your explicit consent. United States. OpenAI states in its API data documentation (checked 1 October 2026) that data sent to the API is not used to train its models by default, and that abuse-monitoring logs are kept for up to 30 days unless the law requires longer.
• Dodo Payments, our payment partner and Merchant of Record: checkout, payments, taxes, invoices and refunds. Receives your name, email and billing and payment details; card data never reaches us. It acts as an independent controller for payment data under its own privacy policy, which states where it processes data.
• Brevo (Sendinblue SAS): sign-in emails, order and reminder emails and the newsletter. Receives email address, language and email content. European Union (France). Brevo also delivers internal notification emails to us about activity on your account (your email address, project title and order amount).
• Google LLC: "Sign in with Google". Per Google's sign-in flow we receive your email and basic profile. United States and others. Google Drive is also our backup storage: copies of the database backup are kept in the owner’s private Google Drive account (see the retention section).
• Amazon Web Services EMEA SARL (region eu-north-1, Stockholm, Sweden): our own cloud account, which runs the style service, video production (audio processing, lyric timing and rendering) and, when you choose it, our cloud lyric recognition. Receives the song, lyrics, notes, photos you allowed and production files while the work runs; files are deleted as described above.
• Anthropic, PBC: AI text model used to design the scenes. Receives the lyrics and your note, never audio. If you add a photo in the style step, it also receives a small copy of that photo, only for this purpose: to design the scenes around the person (for example whether the subject is a woman or a man) and to check that the pictures keep the same person's likeness (not to identify anyone). It also receives the finished style pictures made for you (which may show a person generated from the photo you added), only to describe what is in the picture, so that the video is built to match the picture you chose. United States. Anthropic states that data sent through its commercial API is not used to train its models by default.

International transfers

Your information is processed outside your country, including in the United States and the European Union, and outside Israel. Where required, transfers rely on adequacy decisions, standard contractual clauses or equivalent safeguards offered by the providers. The European Commission recognises Israel as providing adequate protection.

Cookies and similar storage

We use one strictly necessary session cookie (HttpOnly) to keep you signed in, and browser storage for your language preference and, if you choose, a local draft. If you sign in while creating a clip, the song and photo you chose are kept temporarily in your own browser on this device for up to 30 minutes so they are not lost during sign-in, and are then deleted. We do not use advertising or tracking cookies, and we use no third-party analytics script. To understand how the site is used we run our own first-party, cookieless statistics: when a page loads, your browser sends our server the page path, the website you came from (the host name only), any campaign tags in the link, the page language and a screen-size class (phone, tablet or desktop), and the server adds your country from the connection. The server also reads from your browser string only the browser family and operating system (for example Chrome on Android) and counts them in the same daily totals. We do not store your IP address, your full browser string or any identifier, and we set no cookie for this. To count unique visitors per day, the server computes a one-way hash of your IP address and browser string with a secret salt that changes every day and is never stored; the hash cannot be traced back to you or linked across days, and it is deleted after 2 days. Only aggregate daily totals are kept. While you browse, your browser may keep the source of your visit in session storage (it disappears when you close the tab); if you place an order it is saved with the order, together with your country, so that we can see which channels bring customers. We do not count visits from signed-in site operators, automated crawlers, or browsers that send a Do Not Track or Global Privacy Control signal. Our hosting provider Cloudflare processes technical request data (such as IP address) to deliver and secure the site and, where enabled in our account, may count visits in aggregate without cookies. Your sign-in session lasts up to 30 days. Where we switch it on, a bot check from Cloudflare (Turnstile) runs on the sign-in and newsletter forms and in the style step; it is used only to tell people from automated programs.

Your rights

Depending on where you live you have rights under the Israeli Protection of Privacy Law, the GDPR and UK GDPR, the CCPA/CPRA (California) and similar laws, including:

• Access to the information we hold about you, and a copy.
• Correction of information that is inaccurate, incomplete, unclear or outdated.
• Deletion of your information (you can do this in the app: delete a project or your account).
• Restriction or objection to certain processing, and portability where the law provides.
• Withdrawing consent (newsletter, showcase, photo permission, automatic recognition) at any time, without affecting earlier lawful processing.
• Not being discriminated against for using your rights. For California residents: the right to know what is collected, and we do not sell or share personal information for advertising.
• Complaining to a supervisory authority (in Israel, the Privacy Protection Authority; in the EU, your local data protection authority).

To use a right, email [email protected] from the address on your account. We may verify your identity in a proportionate way and aim to answer within 30 days.

Security

Encrypted connections, access limited to what is needed, hashed sign-in tokens, rate limits and access controls. No system is perfectly secure; we will notify you and the authorities where the law requires.

Age

The service is for adults aged 18 and over. We do not knowingly collect information from minors. Photos of minors may be uploaded only by a parent or legal guardian who consents. If you believe a minor gave us information, email [email protected] and we will delete it.

Changes

We will update this page when the service or the law changes and show the update date. For material changes affecting existing orders we will notify you by email.

Contact

[email protected]

Shai Barak (שי ברק), business number 033654807

מודיעין, ישראל (Modi'in, Israel); legal notices by email to [email protected]