Privacy Policy
Effective 10 November 2026. Applies to the Hummable website, the Hummable plugin for ChatGPT and Codex, and the Hummable connector for Claude (together, the "Service").
Hummable is operated by Magnificent Labs ("Hummable", "we", "us"), established at Carolina MacGillavrylaan 1200, Amsterdam, the Netherlands. We are the controller of the personal data described in this policy. If anything is unclear, email hello@hummable.io.
1. Summary
- We keep your email address, the songs you make (title, style description, lyrics, the audio file) and when you created your account and last used it.
- To make a song, the style description and lyrics are sent to a music-generation provider that runs the model for us. The provider does not receive your name or email.
- We do not sell personal data, we do not use your songs or lyrics to train any model, and we do not run advertising or analytics trackers.
- You can delete any song at any time from the app or from a chat, and your whole account by emailing us.
2. Information we collect
Information you give us
Account information. When you sign in with Google, we receive the email address and display name of the Google account you choose, and a Google account identifier. We store the email address. If you create an account with an email address and password instead, we store the email address and a salted hash of the password.
Songs. For every song you make: the title, the style description, the lyrics (if any), the requested length, the generated audio file, and the generation status. Lyrics and titles may be written by you or by the AI assistant you use Hummable through.
Correspondence. If you email us, we keep the correspondence for as long as needed to handle your request.
Information created by using the Service
Account activity. The date you created your account and the date you last signed in, and a count of songs made in the last 24 hours to apply the free allowance.
Authorization records. When you connect Hummable to ChatGPT, Codex, or Claude, we store the grant and tokens that let that assistant call the Service on your behalf, until you revoke them or they expire.
Information collected automatically
Operational logs. Our hosting provider records request metadata (time, URL path, response status, approximate region, IP address) to run and secure the Service. Logs are kept for up to 30 days.
We do not use advertising or analytics cookies, pixels, or fingerprinting. See section 12 for the cookies we do use.
3. How we use information
- To provide the Service: sign you in, generate songs you ask for, store them in your library, and play them on the web and inside your assistant.
- To keep the Service secure and fair: detect abuse, apply the daily allowance, and investigate incidents.
- To communicate with you about your account, such as a change to these terms or a security notice. We do not send marketing email.
- To comply with law.
We do not use your lyrics, style descriptions, or songs to train or fine-tune any machine learning model, and we do not sell or rent personal data.
4. Legal bases
Where the General Data Protection Regulation (GDPR) applies, we rely on performance of a contract (Article 6(1)(b)) to provide the Service, legitimate interests (Article 6(1)(f)) to secure and improve it and keep operational logs, legal obligation (Article 6(1)(c)) where we must keep or disclose information, and consent (Article 6(1)(a)) where we ask for it. You can withdraw consent at any time.
5. Songs, lyrics and style descriptions
When you make a song, the style description, the lyrics and the requested length are sent to a music-generation provider (see section 7) that runs the open-source ACE-Step model on our behalf. The provider receives only those fields and returns an audio file. It does not receive your name, email, or any identifier that links the request to you. We store the returned audio in your library so you can play, download and delete it.
Lyrics may contain personal data about you or others. Please include only what you have the right to use. Songs are private to your account; we never display them to other users.
6. Using Hummable inside ChatGPT, Codex, or Claude
When you use Hummable through an AI assistant, that assistant's provider (OpenAI for ChatGPT and Codex, Anthropic for Claude) is a separate controller of your conversation. We receive only what the assistant sends to a specific Hummable tool: a title, style description, lyrics, length, or a song id. We cannot see the rest of your conversation, and we send nothing to the assistant provider other than the tool's response and the song card.
Connecting an assistant creates an authorization grant in our systems. You can revoke it at any time from the assistant's settings; revoking does not delete your Hummable account or songs.
7. Who we share information with
| Provider | Purpose | Data |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, email delivery, network security | All data described in this policy, processed on Cloudflare's network |
| Replicate, Inc. | Running the music model | Style description, lyrics, requested length; the generated audio is returned to us |
| Google LLC | Sign-in | Your Google account email, name, and identifier at sign-in |
We may also disclose information if required by law, to protect the rights, safety, or property of Hummable or others, or as part of a merger, acquisition, or sale of assets, in which case we will tell you before your data becomes subject to a different policy. We do not share personal data with advertisers or data brokers.
8. Retention
| Data | Kept for |
|---|---|
| Email address and account dates | Until you delete your account, then removed within 14 days |
| Songs (title, style, lyrics, audio) | Until you delete them or your account |
| Requests sent to the music provider | Per the provider's policy; Replicate deletes inputs and outputs after one hour |
| Password reset links | 1 hour, or until used |
| Assistant authorization grants and tokens | Until revoked or expired |
| Operational logs | Up to 30 days |
| Support correspondence | Up to 2 years after the matter is closed |
9. Security
All traffic to the Service is encrypted in transit with TLS. Songs and account data are stored in Cloudflare's managed database and storage with encryption at rest. Audio links are signed and expire. Assistant access tokens are stored only as hashes. Passwords are stored only as salted PBKDF2 hashes, and reset links are single-use and expire after an hour. If we learn of a breach affecting your personal data, we will notify you and the relevant authority as required by law.
10. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent. You also have the right to lodge a complaint with a supervisory authority; in the Netherlands that is the Autoriteit Persoonsgegevens.
You can delete songs yourself in the app or from a chat and revoke assistant access in the assistant's settings. For anything else, including deleting your account or receiving a copy of your data, email hello@hummable.io from the address on your account. We respond within 30 days.
11. International transfers
We are established in the Netherlands. Our hosting and model providers operate in data centres outside the European Economic Area, including in the United States. Where that happens, transfers are protected by the European Commission's Standard Contractual Clauses and, for providers certified under it, the EU-US Data Privacy Framework.
12. Cookies
We use only cookies that are strictly necessary for the Service to work: a session cookie that keeps you signed in on the website (30 days), a short-lived cookie that protects Google sign-in against forged requests (10 minutes), and short-lived cookies that protect the assistant authorization page (10 minutes). None are used for tracking, so we do not show a cookie banner.
13. Children
The Service is not directed to children under 16 and we do not knowingly collect personal data from them. If you believe a child has created an account, email us and we will delete it.
14. Changes to this policy
We may update this policy as the Service or the law changes. The date at the top shows when it was last revised. For material changes we will give you notice in advance, by email or inside the Service.
15. Contact
Magnificent Labs
Carolina MacGillavrylaan 1200, Amsterdam, the Netherlands
hello@hummable.io