Privacy

Song Me This is a US service operated by Benbetter AI, LLC, intended for adults in the United States. The computers that run it are in the United States. If you open the site from somewhere else, you are sending information to the US.

This policy is for buyers, for people invited to add a story, and for anyone named in a song. I am not a “business” under the California Consumer Privacy Act at this size. I still write this the way that law expects, because it is the clearest shape, and because California’s older website law (CalOPPA) does apply.

This is not a HIPAA notice. I am not a health-care provider. I will not call your stories “PHI.”

From you, when you buy

• Your email. Sign-in is a link in that inbox — no password.
• Your name, if you give it.
• Payment goes through Stripe. I never see your card number. I store Stripe’s customer and checkout identifiers so I can find the purchase.
• The stories you write or speak: who the song is for, what happened, the people in it, how you want it to sound. That free text often includes full names — sometimes of children — hometowns, dates, and, because people write about real life, health information. Addiction, relapse, overdose, a death, mental health, sometimes a crisis. I do not ask for that. People tell it anyway. I treat it as sensitive. See the health data notice.
• Names, spellings, and pronunciations I keep so the next song gets a name right. That store is meant to be names and how to say them — not health.
• Musical taste: artists you named, versions you picked, things you rejected. That follows you, not the group.
• Phone numbers or emails of people you want to invite, if you type them in. Today the invite is a text you paste into your own messages, from your own phone. If that ever changes, this page will say so before it does.

From someone invited to add a story

• A first name they type. That is the only identifier they give. They never make an account.
• The story they write, and — if they tap the record button — the sound of them telling it. Same sensitivity as above.

From the person the song is about

Nothing directly. They may be a minor. They may not know the song exists. What I hold about them came from someone else.

Automatically

• Ordinary web logs from the host (IP address, browser, pages), kept briefly and used for security and debugging.

I do not run product analytics, session replay, or advertising pixels on this site today. If that changes, this page will name the service before it ships.

Buyers and invited people represent that they may share what they share. I do not contact the person a song is about — that is a product decision, not a privacy dodge. If you are named in a song and you want it gone, use the takedown page. You do not need an account. You do not need to say why.

I may decline to show you someone else’s full story, because that story is also their personal information. Deletion is different. Deletion I will do.

• To write and produce the song you asked for.
• To get names and pronunciations right the next time — that is the memory across songs, and it is only for that.
• To send the invite you asked me to send, if you asked.
• To take payment and send a receipt.
• To keep the site secure and to see, in the aggregate, what is broken.

I do not use your stories to train a model of my own. I do not license them to anyone for training. I do not send you marketing mail unless you asked for it.

To write and produce a song I send material to other companies. I read every story myself; a machine is not the only reader.

OpenAI and Fireworks

Write the tappable example answers you see while you write. That means a slice of what you have already answered may leave this system. On a paid API they say they do not train on those inputs by default. They may keep text for a short abuse-monitoring window.

xAI, OpenAI, or Fireworks (images)

Make the decorative Polaroid stills. Those prompts are mood and scene. I do not send your story there on purpose.

Anthropic

May help draft lyrics when that path is on. On a paid API they say they do not train on those inputs. They may keep text for a limited trust-and-safety window.

ElevenLabs

Writes down a story when someone talks instead of types. The sound itself leaves the device and goes to their speech-to-text service so the words can appear as they speak. I keep the recording in a private bucket. On a paid API they say they do not train on those inputs by default. They may keep audio for a short abuse-monitoring window. Talking is optional — typing never sends sound.

The music service (currently Suno)

Generates the audio. Today I operate that by hand, which still means the lyrics and a production brief leave this system. I strip artist names first. Their terms say they may use submissions to improve their models, and they do not currently offer an opt-out. I send the smallest brief that will still make the song — not the raw pile of stories — and I do not send your email or your payment information.

I do not sell personal information. I do not share it for cross-context advertising. I do not share mobile phone numbers with anyone for marketing or promotional purposes.

These companies process information so the product can run. A story reaches only the ones marked below.

Supabase

Database, sign-in, and private audio storage. Stories and audio live here.

Stripe

Payment. They should never see a story — I do not put story text in payment metadata.

Resend

Transactional email. Invite and lifecycle mail. Stories are not quoted in those emails.

Twilio

SMS, if I ever send a text from this business rather than handing you a message to send yourself. A story should never be in an SMS body.

Vercel

Hosts the site. May see information in server logs.

Cloudflare

DNS. Does not see story content if it is not proxying the app.

OpenAI, Fireworks, xAI, Anthropic, ElevenLabs, the music service

See the AI section above.

I am the only person at Song Me This who reads stories. If I ever flag a crisis to myself, the notification is a link into the admin page, not the story sitting in Gmail or Slack.

I do not share mobile phone numbers with third parties or affiliates for marketing or promotional purposes. Message frequency, if I ever text you from this business, will be stated at the moment you opt in — typically a handful of messages about one song, not a recurring campaign. Message and data rates may apply.

Today, invites are a draft you paste into your own messages. That text comes from your phone, to people you chose. If I start sending invite texts from a Song Me This number, I will say so here first, and I will only text a number whose owner agreed to hear from me.

Raw stories (yours and the people you invited)

Deleted about 90 days after the song is delivered. The finished lyrics stay.

Finished lyrics

While the account exists, and a short window after you delete it.

Finished song audio

While the account exists, then about 12 months. Download it if you want it forever on your own disk.

A recording of someone telling a story

Kept with the story it belongs to. How long that file stays, versus the finished song, is not settled yet — I will not advertise a shorter number until it is. Ask me to delete it and I will, the same as a typed story.

Names, spellings, pronunciations

While the account exists.

Musical taste

While the account exists.

Invite phone numbers and emails

About 30 days after delivery, or immediately if someone says stop. I keep a hashed record so I do not contact them again.

Stripe identifiers and receipts

About 7 years — tax and accounting.

Web logs

About 30 days, on the host’s default.

Database backups

A short rolling window (on the order of a week). A deletion is gone from backups when that window rolls over, and in any case within 30 days.

Encryption in transit and at rest. Audio lives in a private bucket; playback uses a short-lived signed URL. Database rows are behind row-level security. The key that bypasses that security never goes to the browser. Invite links are unguessable tokens, handled only on the server. I am the only operator.

I will not call this bank-grade, and I will not say it is HIPAA-compliant.

You can ask to see what I have, correct it, or delete it. You can opt out of analytics. You can withdraw a consent you gave. If you are named in a song and you never used the site, you can still ask me to take it down.

Email hello@songmethis.com or use the takedown page. You do not need an account to ask. I am aiming for 72 hours and I will not take longer than 30 days.

I may decline to disclose a story that is also about other people. I may need enough information to find the right song — a link, or the email or number the invite used. I will not ask for a selfie or a government ID for a deletion.

You have to be 18 to buy. I do not knowingly collect information from anyone under 13. Songs are often about children; that information comes from an adult. If you believe a child under 13 submitted a story, email me and I will delete it.

I do not sell or share personal information for advertising, and I do not run analytics or advertising cookies, so a Global Privacy Control signal currently has nothing extra to switch off. I do not respond to the older “Do Not Track” browser header, because there is no common industry meaning for it. That sentence is here because California requires me to say how I handle it.

I will date this page when it changes. A material change gets an email to the address on the account. I review it at least once a year.

hello@songmethis.com. 5415 West 161st Terrace, Overland Park, KS 66085. Ask for a song, a refund, a takedown, or a copy of what I hold — same address, different subject.