Privacy Policy

PRIVACY NOTICE
Last updated September 22nd, 2026

This Privacy Notice for Sonauto, Inc. ("we," "us," or "our"), the company
that operates Treblo and its related services, describes how and why we
collect, store, use, and share ("process") your personal information when
you use our services (the "Services"), including when you:
- Visit our website at https://treblo.com or use our mobile application
- Create an account and generate, upload, or share music
- Use our developer API
- Contact us for support or otherwise interact with us

Questions or concerns? Reading this Privacy Notice will help you
understand your privacy rights and choices. If you do not agree with our
policies and practices, please do not use our Services. You can contact
us at support@treblo.com.

Developer API customers. Where we process personal information
contained in content submitted through our developer API on behalf of
a business customer, we act as a service provider or processor for
that customer, and our agreement with the customer governs that
processing. This notice applies to the information we collect about
API customers themselves, such as account, usage, and billing
information.

SUMMARY OF KEY POINTS
- We collect the information you give us (account details, and the
  prompts, lyrics, audio, and other content you submit) and technical
  information collected automatically (device, usage, and approximate
  location data).
- We do not request or intentionally collect sensitive personal
  information, and we ask that you not submit it.
- We use your information to provide and improve the Services,
  including AI music generation, content moderation, billing, and
  analytics.
- We share information with service providers that help us run the
  Services (hosting, AI model providers, payments, analytics). We do
  not sell your personal information.
- Content you post publicly is visible to others.
- You can access, correct, or delete your information by using your
  account settings or contacting us.

TABLE OF CONTENTS
1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. AI FEATURES, MODERATION, AND MODEL IMPROVEMENT
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?
7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
8. HOW LONG DO WE KEEP YOUR INFORMATION?
9. HOW DO WE KEEP YOUR INFORMATION SAFE?
10. DO WE COLLECT INFORMATION FROM MINORS?
11. WHAT ARE YOUR PRIVACY RIGHTS?
12. CONTROLS FOR DO-NOT-TRACK FEATURES
13. DO WE MAKE UPDATES TO THIS NOTICE?
14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Information you provide to us.
- Account information: email address, username, date of birth, password (handled by
  our authentication provider), and optional profile details such as a
  display name, avatar, or profile description.
- Content you create or submit: text prompts, style tags, lyrics, song
  titles and descriptions, audio files you upload, images and artwork
  prompts, comments, playlists, reports, and messages you send us. The
  music and other outputs generated for you, and technical artifacts
  derived from them (such as audio stems, transcriptions, alignments,
  and rendered videos), are stored as part of providing the Services.
- Payment information: payments are processed by Stripe. We do not
  store your full card number. We receive and store billing-related
  information such as your Stripe customer identifier, subscription or
  credit plan, transaction history, and billing contact details.
- Developer API information: if you use our developer API, we collect
  your API key names, hashed API keys, request inputs and generated
  outputs, webhook URLs you configure, and usage and credit records.
- Push notifications: if you enable them in our mobile app, we collect
  a device identifier, platform, and push notification token.

Sensitive information. We do not request or intentionally collect
sensitive personal information (such as information about racial or
ethnic origin, health, religious beliefs, or sexual orientation), and
the Services are not designed for it. Free-form content such as prompts,
lyrics, audio recordings, and comments may contain whatever you choose
to put in it; if you include sensitive information in such content, you
are directing us to process it as part of providing the Services.
Please avoid submitting sensitive personal information.

Voice and audio recordings. Audio you upload or record may include
your voice or the voices of others you have permission to record. We
process audio to provide the Services — for example, to transform it
into new musical content, separate stems, or transcribe lyrics. We do
not use voice recordings to identify individuals, and we do not create
voice identification profiles. Audio you submit is stored as part of
your content and retained as described in Section 8.

Information automatically collected.
When you visit or use the Services, we automatically collect certain
technical information, such as your IP address, browser and device
characteristics, operating system, language preferences, referring
URLs, approximate location (such as country and state or region, derived
from your IP address), and information about how and when you use the Services
(such as pages viewed, songs played, and features used). We collect
some of this information through cookies and similar technologies.
When you are signed in, some of this usage information is associated
with your account identifiers (such as your user ID, username, and
email address) in our analytics and error-monitoring tools.

2. HOW DO WE PROCESS YOUR INFORMATION?

We process your information to:
- Provide the Services, including generating music from the prompts,
  lyrics, and audio you submit; hosting, streaming, and delivering your
  content; and operating community features such as posts, playlists,
  and comments.
- Create and manage your account and authenticate you.
- Assess age and regional eligibility using your date of birth and
  approximate location, enforce access restrictions, and apply
  age-appropriate privacy and interaction settings. We keep a record
  of the eligibility assessment with your account.
- Process payments, subscriptions, and API credits.
- Moderate content and keep the Services safe, including automated and
  human review of content, filtering designed to prevent reproduction
  of existing lyrics, rate limiting, and fraud and abuse prevention.
- Improve and develop the Services, including analytics, debugging,
  and the model-improvement activities described in Section 3.
- Communicate with you about the Services, including service
  announcements, responses to support requests, and, where you have
  enabled them, push notifications.
- Comply with legal obligations and enforce our terms and policies.

3. AI FEATURES, MODERATION, AND MODEL IMPROVEMENT

The Services are built around artificial intelligence ("AI") music
generation. In providing them:
- Content you submit (such as prompts, tags, and lyrics) may be
  processed by third-party AI providers, such as OpenAI and Google, for
  example to expand or complete a prompt or to generate lyrics when you
  have not provided them, and to screen content under those providers'
  and our content policies. Artwork prompts may be processed by image
  generation providers such as Replicate.
- Content may be reviewed by automated systems and by our personnel for
  moderation, security, and support purposes. If our systems detect
  that submitted lyrics may reproduce existing lyrics, we keep a
  record of the submission for enforcement purposes.
- We may use content submitted to or generated on the consumer
  Services to develop and improve the Services, including to train and
  evaluate our models and content-classification and safety systems.
  We do not use content
  submitted to or generated through our developer API to train or
  fine-tune our generative models; our developer API Terms describe our
  commitments to API customers.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

We do not sell your personal information. We share personal information
in the following situations:
- Service providers. We use third-party vendors to operate the
  Services, who process information on our behalf, including: cloud
  hosting and storage providers (such as Microsoft Azure, Backblaze,
  Cloudflare, and Supabase); AI model providers (such as OpenAI,
  Google, and Replicate, as described in Section 3); payment
  processing (Stripe); analytics (PostHog); error and performance
  monitoring (Sentry and similar tooling); push notification delivery
  (Google Firebase and Apple); bot and abuse prevention (hCaptcha);
  and internal operations tooling such as team alerting.
- Other users and the public. Content you publish (such as posted
  songs, your username, profile information, comments, and playlists)
  is visible to other users and may be accessible to anyone, including
  through search engines and embeds.
- Business transfers. We may share or transfer your information in
  connection with any merger, sale of company assets, financing, or
  acquisition of all or a portion of our business.
- Legal and safety. We may disclose information where required by law
  or where we believe disclosure is necessary to protect our rights,
  your safety, or the safety of others, or to investigate fraud or
  abuse.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

We use cookies and similar technologies (including browser local
storage) to keep you signed in, remember preferences and drafts,
maintain the security of the Services, and understand how the Services
are used through analytics. You can limit cookies through your browser
settings, though some features of the Services may not work without
them.

6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

You can register or sign in using a Google, Discord, or Apple account.
When you do, we receive profile information from that provider, which
typically includes your name, email address, profile picture, and the
provider's account identifier. We use this information to create and
operate your account as described in this Privacy Notice. Your
relationship with the login provider is governed by their privacy
policy.

7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

We are based in the United States and our servers and service providers
are located primarily in the United States. If you access the Services
from outside the United States, your information will be transferred
to, stored, and processed in the United States, where data protection
laws may differ from those in your jurisdiction.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

We keep personal information for as long as needed for the purposes
described in this Privacy Notice:
- Account information is kept until you delete your account.
- Content you create is kept until you delete it or delete your
  account, except that we may retain content and records as needed to
  comply with law, resolve disputes, enforce our terms (including
  moderation and copyright-enforcement records), and maintain backups
  for a limited period.
- Billing records are kept as required for tax, accounting, and legal
  purposes.
- Logs, analytics, and diagnostic data are kept on rolling retention
  schedules appropriate to their purpose.
When we no longer need personal information, we delete or de-identify
it, or, where that is not immediately practicable (for example, in
backup archives), we isolate it from further processing until deletion
is possible.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

We use administrative and technical safeguards designed to protect
personal information, including encryption of data in transit (TLS),
hashed storage of passwords and API keys, and access controls. However,
no electronic transmission or storage technology can be guaranteed to
be 100% secure, and you use the Services at your own risk. Please keep
your password and API keys confidential.

10. DO WE COLLECT INFORMATION FROM MINORS?

The Services are not directed to children under 13. Users must be at
least 13 and meet any higher applicable minimum age and regional
eligibility requirements described in our Terms of Service at
https://treblo.com/tos. In some regions, access is limited to adults.
We process personal information about eligible users under 18 as
described in this notice, including their date of birth and approximate
location to assess eligibility and apply age-appropriate settings.
Depending on age and region, these may include certain default account 
privacy settings.
If an age assessment indicates that a user is ineligible, we may reject
registration or restrict or deactivate the account. We delete personal
information where required by applicable law; any permitted retention
is limited to the purposes described in Section 8. If you believe we
have collected personal information from a child under 13 or another
ineligible user, or want to request correction of a date of birth or
review of an eligibility decision, contact support@treblo.com.

11. WHAT ARE YOUR PRIVACY RIGHTS?

Depending on where you live, you may have rights regarding your
personal information, such as the right to access, correct, or delete
it, or to receive a copy of it. You can:
- Review and update your account and profile information in your
  account settings.
- Delete content you have created.
- Delete your account, which removes your account and associated
  information from our active databases (subject to the retention
  described in Section 8).
- Contact us at support@treblo.com to exercise any right, and we will
  respond in accordance with applicable law. We will not discriminate
  against you for exercising your rights.
If we are relying on your consent to process personal information, you
may withdraw that consent at any time by contacting us; withdrawal does
not affect the lawfulness of processing before withdrawal.

12. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems include a
Do-Not-Track ("DNT") feature or setting. No uniform technology standard
for recognizing and implementing DNT signals has been finalized, and we
do not currently respond to DNT browser signals. If a standard is
adopted that we must follow, we will inform you in a revised version of
this Privacy Notice.

13. DO WE MAKE UPDATES TO THIS NOTICE?

Yes, we will update this notice as necessary to stay compliant with
relevant laws and to reflect changes to the Services. The updated
version will be indicated by an updated "Last updated" date at the top
of this Privacy Notice. If we make material changes, we may notify you
by prominently posting a notice or by sending you a notification.

14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us
at support@treblo.com or write to us at:
Sonauto, Inc.
246 28th Street, Apartment 1
San Francisco, CA 94131
United States

15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You may review and update much of your information directly in your
account settings, and you may delete your account in the app or by
contacting us. To request access to, correction of, or deletion of your
personal information, contact us at support@treblo.com. We will
consider and act upon your request in accordance with applicable data
protection laws.