Privacy Policy

The controller responsible for processing your data is:

• Owner: 7AM Marketing, S.L.
• Tax ID (NIF): B02816338
• Address: C/ Carmelo Betore Bergua, 2, 7D, Esc. C8, 50014 Zaragoza (España)
• Registration details: Registro Mercantil de Zaragoza, tomo 4495, diario 352, folio 195, hoja Z-67824, inscripción 1.ª
• Trade name: Music Wizard
• Website: https://musicwizard.pro
• Contact and privacy email: hola@musicwizard.pro

We have not appointed a data protection officer. For any question about your data, write to hola@musicwizard.pro.

We only process the data the service needs in order to work.

Account data:

• Your email address.
• Your password, but never in plain text: we only store a hash computed with scrypt, from which the password cannot be recovered. If you only sign in with Google, there is no password.
• Your name, if you choose to add it. It is optional.
• The interface language you were using when you signed up.
• Whether your email address has been confirmed as yours, and when. It is confirmed when you sign in with Google or use a password reset link. When you sign up with email and password, we do not confirm it.
• Your credit balance, the credits held for generations in progress, and your transaction history, with the reason for each entry and a note, if there is one. For example, the welcome credits you receive when you create your account.
• Your open sessions: a random identifier and the date each one expires.
• The password reset links you request, which are valid for one hour and can be used only once. This feature is not currently active, so no links are created.

If you sign in with Google, Google gives us your Google account ID, your email address, whether Google has verified it, and your name. We only request this basic profile data: we do not receive your Google password, we do not store your photo, and we do not request access to YouTube, Gmail or any other service in your account. If you already had a Music Wizard account with that email address, we link it to Google and, if it had no name, we give it the name from Google. If that account had a password but its email address had never been confirmed, we remove the password and close its sessions, so that nobody can keep control of an account by signing up with someone else's email address.

Content you create:

• Your channels: name, description, concept and scene, music style, visual style, color palette and publishing language.
• What is generated for them: frames, logos, banners, animated clips, music tracks, assembled MP4 videos and the chapter list with song titles, for the video description.
• The photos you upload: the one from «Upload my image» as a starting frame, your reference photos and the start, end or shot photos of a clip. They are stored on our server with the video draft (see the next point). If you animate one, it is sent to GenAIPro; if you save the channel with it, it is stored as the channel image; and if you assemble a video with it, it is stored as that video's cover image.
• Drafts of the videos you are making. While you use the video wizard, we automatically save your progress on our server: the options you choose, the text you write, the photos you upload and a copy of the generated images, clips and songs. This lets you pick it up later from Videos, also from another device. Only your account can see and open them.

On our server we store the logo, banner and frame the channel has when you save it, and the assembled MP4 videos. For each video we also store its title, which is the channel name, the music style, the language, the chapter list, the cover image or its URL, and the URLs of the clip and tracks that were used. Generated options, clips and tracks are created at temporary URLs belonging to the provider; while they are part of a draft, we keep a copy on our server so they do not expire, and those copies are only served to your account.

Do not include particularly sensitive data, such as health data, in the text or images you submit, and do not upload images of other people without their permission.

Technical and security data:

• Your IP address, held in temporary counters that slow down mass attempts to sign in, create accounts or request reset links. For sign-in, the email address being tried is also counted. The counters are deleted automatically between 10 minutes and 1 hour after the last attempt. Sign-in counters are also deleted as soon as you sign in successfully.
• Technical server error logs, which we use to detect and fix problems.

Usage statistics: we count how many times each page is opened, grouped by day, page and language. To do this we do not store your IP address, we do not read cookies and we do not assign you any identifier, so these counts cannot show who visited what.

Nothing is charged inside Music Wizard and there is no payment gateway, so we do not process payment data. The home page links to a paid community on Skool (https://www.skool.com). That purchase is handled by Skool under its own terms and its own privacy policy.

When you paste the URL of a public YouTube channel, or of one of its videos, our server requests that channel's public information from the YouTube Data API: name, ID, URL, description, keywords, avatar, banner, subscriber and video counts and, for up to its 100 most recent videos, the title, date, views, likes, duration and tags. For the most viewed videos, we also fetch the images YouTube publishes for each one.

We use those images to work out the channel's colors on our own server, without sending them to anyone. If you ask for the channel's style to be analyzed, we send up to three of those images, together with the channel's name, description, video titles and tags, to Gemini, Google's vision model. If Gemini is not configured, we send only that text to a text model through OpenRouter. If you generate frames using images from that channel as a reference, those images may also reach GenAIPro and kie.ai.

We do not store that channel's data. Your account only keeps what you accept and save in your own channel, such as the scene, style or color palette.

This is public, third-party data. We use it only as a style reference, on the basis of legitimate interest, and we do not build profiles of the people who run those channels. If you own a channel and want to exercise your rights, write to us at hola@musicwizard.pro.

This feature uses the YouTube API Services. When you use it, the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy) also apply. The lookup is made by our server with our own key: we do not access your YouTube account or post anything to it.

• Creating and maintaining your account, letting you sign in with email and password or with Google, and keeping track of your credit balance. Legal basis: performance of the contract you accept when you sign up (Article 6(1)(b) GDPR).
• Generating and storing your content: sending the AI providers the instructions and images they need, assembling the videos and storing them so you can download them. Legal basis: performance of the contract.
• Sending you a password reset link when you request one, once this feature is active. Legal basis: performance of the contract.
• Protecting the service and accounts: slowing down mass sign-in, sign-up or password reset attempts, closing sessions, removing unconfirmed passwords when an account is linked to Google, and detecting and fixing problems. Legal basis: our legitimate interest, and yours, in the service and your account being secure and working properly (Article 6(1)(f) GDPR).
• Measuring how much each page is used, with counts that do not identify anyone, to improve the service. Legal basis: our legitimate interest in improving the service.
• Looking up and analyzing public YouTube channels when you ask us to, as a style reference. Legal basis: the legitimate interest, yours and ours, in using public references to create your own channel.
• Replying when you write to us, handling requests to exercise your rights and complying with the legal obligations that apply to us. Legal basis: compliance with legal obligations (Article 6(1)(c) GDPR) and, for other inquiries, performance of the contract or our legitimate interest in replying to you.

We do not use your data to send you advertising.

We do not make decisions based solely on automated processing that produce legal effects on you or affect you in a similar way, and we do not create profiles. When too many attempts come from the same IP address, or with the same email address, the attempt limit blocks further attempts for between 10 minutes and 1 hour. This is a temporary security measure, not a decision of that kind.

Where the legal basis is legitimate interest, you can object to the processing as explained under Your rights.

To create an account you need an email address and a password, or a Google account. Without them we cannot sign you up. Your name is optional.

To generate content you have to provide what each step asks for: the scene for frames, the channel name and scene for the logo and banner, and the music style for music. To save a channel you need at least its name and scene. Without these, nothing can be generated or saved.

Your IP address and other technical connection data reach the server on every visit. The website cannot work without them.

We do not sell your data or hand it over to anyone to use for their own purposes, unless the law requires us to, for example in response to a court order. To provide the service we work with the following providers, who only receive what they need for their part:

• Hostinger: the server that hosts the database and files.
• Google: Google sign-in; Gemini, which receives public images and text from a YouTube channel to infer its style, and which names the songs in the chapter list and suggests channel names, for which it receives your channel name, its scene, its music style and, if you start from another channel, that channel's name and tags; and the YouTube Data API, which receives the URL of the channel you look up.
• kie.ai: generates images and music. It receives instructions based on the channel settings, such as the name, scene, visual style, music style or palette, and sometimes reference images.
• GenAIPro: generates images and animates the frame to create the looping clip. It receives the instructions and images it needs, including the image you upload if you animate it.
• OpenRouter: provides access to text models that, when Gemini is not configured, do the same text work instead: naming the songs in the chapter list, suggesting channel names and inferring a style from a YouTube channel's public text. In those cases it receives the same data Gemini would.
• Resend: will send password reset emails, with your email address and the link. It is not currently active and receives no data.

kie.ai, GenAIPro and OpenRouter act as intermediaries: they may pass the instructions and images on to models from other companies, such as Google, OpenAI, Anthropic or Suno, depending on the model we use at any given time.

We do not send your email address or account data to the AI providers. They receive instructions and images to generate the content. Unless you put personal data in the text or in the image you upload, what they receive does not identify you.

Google, when you sign in with your Google account or load YouTube content, and Skool, if you make a purchase there, also process your data on their own account, as controllers, under their own privacy policies.

Some of these providers, such as Google, OpenRouter, kie.ai, GenAIPro or Resend, and the companies whose models they use, may process data outside the European Economic Area.

For that reason, we limit what we send them to what is needed to generate the content or provide their part of the service. We do not send your email address or account data to the AI providers.

If you want to know where a specific provider processes data and under what conditions, write to us at hola@musicwizard.pro.

• Account, channels, saved content and credit transactions: for as long as you have the account.
• Video drafts and their files (uploaded photos and copies of images, clips and songs): deleted when you delete the draft, when the period shown in Drafts passes without opening or changing it (30 days unless stated otherwise), 7 days after the video is assembled and, in any case, when the account is deleted. A file no draft uses any more is deleted the next day, and an uploaded photo that never gets saved in a draft, within a few hours.
• Sessions: they stop being valid after 30 days or when you sign out. They are deleted when you sign out. Sessions that expire without being closed are deleted when your browser presents them again or, at the latest, when the account is deleted.
• Password reset links: valid for one hour and for one use only. The record of the link is deleted along with the account.
• Security counters: deleted automatically between 10 minutes and 1 hour after the last attempt.
• Technical error logs: for as long as needed to detect and fix problems.
• Usage statistics: no time limit, because they are counts that contain no personal data.
• Emails you send us: for as long as needed to deal with your message and, if you exercise a right, for as long as needed to show that we replied.

When you ask us to delete your account, we will delete your data. Any data we must keep because of a legal obligation or to deal with possible claims will be blocked, available only to judges, courts and authorities, for the applicable limitation periods, and then deleted.

Files generated by the AI providers may stay on their servers for some time, under their own terms.

Music Wizard only uses first-party technical cookies, which are needed so you can sign in and the website can work, and it stores one preference in your browser's local storage. We do not use analytics or advertising cookies, usage statistics do not use cookies, we do not load third-party scripts except the YouTube player if you click it, and fonts are served from our own domain.

• mw-session (first-party cookie): keeps you signed in. It is signed and page scripts cannot read it. It lasts 30 days or until you sign out.
• mw-google (first-party cookie): while you sign in with Google, it stores the data used to check that the return from Google matches your sign-in attempt, and which page to take you back to. It lasts 10 minutes and is deleted when sign-in finishes.
• mw-admin (first-party cookie): only created on signing in to the admin panel, which is for whoever manages the service. It lasts 8 hours or until they sign out.
• mw-theme (local storage): remembers whether you prefer the light or dark theme. It is only saved if you change the theme, and it stays in your browser until you delete it.

Because the cookies are technical and you choose the theme preference yourself, the law does not require us to ask for your consent to use them, so we do not show a cookie notice. You can delete or block them in your browser settings, but without mw-session you will not be able to sign in to your account.

The home page shows YouTube video thumbnails, which your browser downloads from Google's servers, and a demo video that does not load until you press play. When you press it, the YouTube player loads, and Google may set its own cookies and store data in your browser, for purposes Google decides, under its policy (https://policies.google.com/privacy). If you do not want this, do not play the video.

Inside the app, your browser loads some images, clips and tracks directly from the servers of the provider that generated them, and loads images of the YouTube channels you look up from Google's servers. As with any connection, those servers receive your IP address and technical data about your browser.

At any time, you can ask us for:

• Access: find out what data about you we process and get a copy.
• Rectification: have data that is wrong or incomplete corrected. There is currently no screen to change your account's email address, name or language, so ask us by email.
• Erasure: have your data deleted. The account cannot be deleted from the app. Ask us by email and we will delete it along with its channels and content.
• Objection: have us stop processing your data where we rely on legitimate interest, unless we have compelling legitimate grounds that override your objection or we need the data to defend ourselves against a claim.
• Restriction: have us keep your data without using it while we check whether it is accurate or whether your objection is justified, when the processing is unlawful and you prefer that we do not delete the data, or when we no longer need it but you do, for a claim.
• Portability: receive the data you gave us in a structured, commonly used format, or have us transfer it to another controller where technically possible.

To exercise them, write to hola@musicwizard.pro from your account's email address, or tell us what that address is, and say which right you want to exercise. If we have reasonable doubts about your identity, we may ask you for more information to confirm it. It is free, and we will reply within one month at most. In complex cases that period can be extended by two more months, and we will tell you if that happens.

If you signed in with Google, you can remove Music Wizard's access to your Google account at https://myaccount.google.com/permissions. This does not delete your Music Wizard account. To delete it, write to us.

If you think we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency, the Agencia Española de Protección de Datos (https://www.aepd.es). If you like, write to us first and we will try to resolve it.

We apply technical and organizational measures appropriate to the risk. These include:

• Connections to the website are encrypted (HTTPS).
• We do not store passwords in plain text, only a hash computed with scrypt using a random salt.
• The session cookie is signed, page scripts cannot read it, and the session can be revoked from the server. It is revoked when you sign out, and resetting your password closes all sessions.
• We slow down repeated attempts to sign in, create accounts and request password reset links.
• When you sign in with Google, we only accept email addresses that Google has verified.
• Provider keys stored in the database are encrypted.
• The admin panel has its own password and attempt limit, and only whoever manages the service can access it.

No system is infallible. If we suffer a security breach that affects your data, we will notify the Spanish Data Protection Agency within the period set by law, unless the breach is unlikely to pose a risk to you. If it poses a high risk, we will also inform you.

Music Wizard is only for people aged 18 or over. We do not knowingly accept accounts from minors, and if we find out that an account belongs to a minor, we will close it and delete its data. If you are a parent or guardian and believe a minor has given us their data, write to us at hola@musicwizard.pro.

We may change this policy when the service or the law changes. The date of the last update is shown at the top.

If a change significantly affects how we process your data, for example because we plan to use it for a new purpose, we will tell you before it takes effect.