Legal

Privacy notice

Last updated: 30 August 2026

1. Controller and scope

Daniel Jöhnk, sole proprietor (Einzelunternehmer), Weißdornstieg 21a, 25469 Halstenbek, Germany, is the controller for the VaLea Website at valea-music.com and the VaLea App at app.valea-music.com. You can reach us at daniel@koenigderphoenixinseln.de or by phone at +49 (0) 172 874 9092.

This notice explains the processing connected with the public VaLea website, the member Vault, and the VaLea App. We process personal data in accordance with the GDPR and applicable German data-protection law.

2. Hosting, database and secure operation

The VaLea website and the VaLea App run on Google Cloud Run. The application database is operated with Google Cloud SQL, and finished songs are stored in Google Cloud Storage. These run in Google's europe-west4 region in the Netherlands, so account records, lyrics and finished songs are held inside the EU. In order to deliver and protect the service, Google processes technical request data such as IP address, browser and device information, requested URL, referrer, date and time. We use this data to operate the service, prevent abuse and investigate faults (Art. 6(1)(f) GDPR).

Account records, memberships, song projects, generated lyrics, entitlement records and necessary service data are stored in the application database. We do not use advertising pixels or web analytics on the VaLea website. Details of Google Cloud's own data processing are available in the Google Cloud Privacy Notice.

3. Cookies and browser storage

The strictly necessary, HTTP-only cookie app_session_idkeeps a signed-in VaLea account working across the valea-music.com subdomains. It contains no profile in readable form and expires after one year or when you sign out. Its legal basis is Art. 6(1)(b) GDPR where it is needed for the account service and Art. 6(1)(f) GDPR for secure operation.

The preference cookie valea_cookie_preferences stores your cookie choice for all valea-music.com subdomains, so you are asked once rather than on every VaLea page. If you allow it, valea_vault_enteredremembers that you have already seen the Vault entrance; the entrance ritual still replays after every fresh sign-in. Join data and campaign parameters may be held briefly in your browser's session storage during the sign-in handover; they are removed after successful handover. We do not use advertising cookies.

4. Account and sign-in with Google

When you choose Continue with Google, Google authenticates you. We receive the verified email address, name and Google account identifier required to create or recognise your account. The information is used for account access, ownership of your songs and membership access (Art. 6(1)(b) GDPR). Google may process data outside the EU; its own information is available in Google's Privacy Policy.

5. The VaLea App: creating a personal song

To create and keep a song, we process the details you enter: title, mood or emotion, your story or context, voice and sound choices, generated or edited lyrics, the resulting audio and the history of the project. The legal basis is Art. 6(1)(b) GDPR because these steps are necessary to provide the song-creation service you request.

A song about your life may touch on things the GDPR singles out for extra protection (Art. 9 GDPR): health, beliefs, ethnic origin, someone's sex life. We never ask for any of it, and nothing in the app requires it. If you write it into your story or your lyrics anyway, you are asking us to turn it into a song, and that is the only thing we do with it: we process it on your explicit consent under Art. 9(2)(a) GDPR and on no other basis. You can withdraw that at any time by deleting the project from your dashboard in the app, or by deleting your account — both remove the story, the lyrics and the recording, not only your access to them. Please enter only what you want turned into music.

We use the OpenAI API to turn your creative briefing and lyric revision requests into draft lyrics. The briefing can include your story/context, selected mood, genre and voice preference, as well as existing lyrics and an editing instruction. If you attach a picture to a lyric change or a chat message, that picture is sent to OpenAI as well. We never store it: it is made smaller in your browser, travels with that one request, and exists nowhere on our side afterwards — your chat history keeps a note that a picture was there, not the picture. OpenAI processes that content on our behalf for this purpose. OpenAI states that API inputs and outputs are not used to train its models by default. Further information is available in OpenAI's Data Processing Addendum and API data-use information.

We use ElevenLabs to create the requested audio. For this purpose, a musical style description and the exact lyrics of your song are transmitted to ElevenLabs, which returns the generated audio to us. Provider information is available in the ElevenLabs privacy policy.

The app also offers an in-app assistant with three characters (Valentina, Lea and Raphaël). If you use it, your messages and the replies are stored with your account, separately per character, and short notes about your creative preferences are derived from them so the assistant can pick up where you left off. While a song-project is open, what is currently on your screen (such as the lyrics being edited) is sent to OpenAI together with your message so answers can refer to it. Each character's memory can be deleted in the chat panel at any time; all of it is deleted with your account, and none of it is used to train any AI model. Details are in the app's own privacy policy.

A word of honesty about AI. This service runs on artificial intelligence, and we want to be straight with you about what that means. The system we control is held to the standards in this notice, and our providers process your content under contracts that forbid training on it. Two things are worth keeping apart. The encryption that protects your data in transit and at rest is ordinary, well-understood cryptography, and a more capable AI model does not weaken it. The real uncertainty sits in the AI layer itself: anything you write into a story or into the chat is, by design, sent to a model in readable form, and the industry still has no dependable defence against a model being talked out of its instructions. So nobody — not us, not the providers, not the researchers building these models — can honestly promise that a future frontier model will never find a way around today's safeguards. Anyone who claims 100% certainty in this field is selling something. Our honest advice: share what you are comfortable turning into music. If something absolutely must never surface — a secret that could harm you or someone else — do not enter it here, or into any AI product. We give this everything we have, and we respect the power of what AI may become in the years ahead; we would rather say that plainly than pretend otherwise.

6. The Vault and HD-WAV downloads

The Vault is rendered only after the server has verified your session and membership. For entitled Black members, HD-WAV masters are kept in a protected Google Drive source folder. When you request a master, our server reads the permitted file from Google Drive and streams it directly to you; a Google Drive link or file ID is not exposed in the browser. We record the necessary download event for entitlement and service operation (Art. 6(1)(b) and (f) GDPR).

7. Email, contact management and support

We use Resend to send transactional emails from the VaLea App, for example a song-delivery message. Resend receives the email address and the content necessary to send that message, which may include the song title and lyrics. See Resend's Privacy Policy.

Where you opt in to the VaLea email journey, we use GoHighLevel (HighLevel Inc., also known through LeadConnector) as the contact and sending system. We send the verified name and email address necessary to address and deliver the messages; richer journey data, interests and campaign attribution remain in our own application database. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in the email or by writing to us. See GoHighLevel's Privacy Policy.

8. Payments and memberships

Payments for song purchases and paid Island PASS memberships are handled by Stripe. We do not receive or store complete card details. Stripe receives the payment and billing information needed to open Checkout, take payment, calculate applicable tax and meet its own legal obligations. We process membership and payment-status data to fulfil the contract and retain required records (Art. 6(1)(b) and (c) GDPR). See Stripe's Privacy Policy.

9. Embedded media, fonts and external links

Website fonts are delivered with the website itself. The VaLea App uses Google Fonts; when its interface loads, your browser can request font files from Google and thereby transmit technical connection data such as your IP address. We use this to display the interface consistently (Art. 6(1)(f) GDPR). Transactional email templates may also reference those fonts, subject to the settings of your email program.

The VaLea App also delivers selected public logo and audio assets through Amazon CloudFront. When your browser loads one of those assets, Amazon receives the technical connection data necessary to deliver it. This is used for reliable media delivery (Art. 6(1)(f) GDPR).

Vault videos use YouTube's extended privacy embed at youtube-nocookie.com. When you actively start a video, YouTube may receive your IP address and process data under its own responsibility. Music-service and social links lead to the respective provider; their privacy notices apply after you follow them.

10. Campaign parameters

Links from our own videos or campaigns may contain parameters such as utm_source, utm_medium orutm_campaign. If you later complete joining, we store them with the contact record to understand which of our own paths brought you to VaLea. They are not used for cross-site tracking.

11. International transfers

Account records, lyrics and finished songs are stored in Google's europe-west4 region in the Netherlands, so the data itself stays in the EU. Several of the providers named above are nonetheless companies based in the United States. Where data reaches them, it does so on one of the two bases European law recognises: the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection, or the Commission's Standard Contractual Clauses.

We have a data processing agreement under Art. 28 GDPR in place with each of them. If you would like a copy of the safeguards that apply to any of these transfers, write to the contact in section 1 and we will send it to you. Each provider also publishes its own terms at the links above.

12. Retention and deletion

We retain account and song-project data while the account exists or while it is needed to provide the service. You can delete your account through the account menu or contact us. We delete data when it is no longer needed unless statutory retention duties apply. Payment and invoice records may have to be retained for up to ten years under German commercial and tax law. Security logs are kept only for the short period needed for operation and incident review. Email-journey data is removed when you withdraw consent and request deletion, subject to overriding legal obligations.

13. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and, where applicable, objection (Art. 21). You may withdraw consent at any time with effect for the future. To use a right, write to the contact in section 1.

We do not use your data for automated decision-making that produces legal effects for you, and we do not profile you. The AI in the app writes songs; it does not decide anything about you.

You also have the right to lodge a complaint with a data-protection supervisory authority. The authority competent for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstraße 98, 24103 Kiel, Germany.

14. Changes to this notice

We update this notice when the service or its processing changes. The date at the top identifies the current version.