Privacy Policy

Last updated: September 8, 2026

Suno Styles ("we", "our", "us") is operated by Cuutio Software Ltd (Business ID: 2397231-2, VAT ID: FI23972312), a Finnish technology company. We operate sunostyles.com. This Privacy Policy explains what data we collect, why we collect it, how it is stored, and your rights under applicable law including the General Data Protection Regulation (GDPR).

If you have questions or requests regarding your data, contact us at hello@sunostyles.com.

1. Data We Collect

Account Information

When you sign up using Google, GitHub, or email/password, we receive and store:

  • Your email address
  • Your display name (from Google or GitHub profile, or as entered)
  • Your profile photo URL (from Google or GitHub, if provided)
  • A unique user ID assigned by Firebase Authentication
  • Your sign-up date and last login date

Usage Data

  • Your account tier (Explorer, Artist, or Producer)
  • Styles you have favorited
  • Wishlist / style requests you have submitted

The customer-facing service does not send your searches or copied prompts to an AI model. Suno Styles is a library of existing prompts that you can browse, search, and copy.

Purchase Data

If you purchase an Artist or Producer plan, payment is handled by Lemon Squeezy. We keep purchase details, terms-acceptance and withdrawal records. We do not store credit card numbers, bank details, or any raw payment data.

Analytics Data

We use Vercel Web Analytics for privacy-friendly page view and referrer reporting. Vercel Web Analytics does not use cookies or send personal identifiers to Vercel.

We also keep first-party product analytics in our Turso database to understand and improve Suno Styles. These events can include pages viewed, searches, audio plays, style prompt copies, favorites, ratings, wishlist requests, checkout starts, purchases, and refunds. For signed-in users, some product events are linked to your internal account ID so we can understand feature usage by account tier and keep the product working correctly.

For anonymous usage, we create a daily-rotating visitor hash from IP address, browser user agent, and date. This helps us count visitors and sessions without storing a raw IP address in the product analytics table. The hash changes each day and is not meant to identify you across long periods.

Technical Data

Standard server logs may include your IP address, browser type, and pages visited. These are retained for a short period for security and debugging purposes only.

2. Why We Collect This Data

  • Account management: to authenticate you, remember your favorites, and apply your correct tier permissions
  • Service delivery: to show you content and features appropriate to your plan
  • Payments: to process purchases and assign tier upgrades via Lemon Squeezy webhooks
  • Product improvement: first-party and Vercel analytics help us understand which styles are popular and how the product is used
  • Communications: to send you transactional emails (purchase confirmations, tier upgrades) and, with your consent, product update emails

Legal bases under GDPR: contract performance (account and service delivery), legitimate interest (security, analytics and legal claims), legal obligations (statutory notices and withdrawal records), and consent (marketing emails).

3. How and Where Data Is Stored

Firebase Authentication (Google)

Your email, name, and authentication credentials are stored in Firebase Authentication, operated by Google LLC. Firebase Authentication data may be stored in the United States. Google is certified under the EU-U.S. Data Privacy Framework.

Turso Database

Your account tier, legal records, favorites, wishlist requests, style data, and first-party product analytics are stored in a Turso SQLite database hosted in the EU (aws-eu-west-1, Ireland).

Lemon Squeezy

Purchase records are handled by Lemon Squeezy Inc., which acts as our Merchant of Record. Their privacy policy applies to payment processing: lemonsqueezy.com/privacy.

Email

Resend processes email addresses and message contents in the United States, using the standard contractual clauses in its Data Processing Addendum. Our email hosting provider retains support correspondence and sent-mail copies.

Abuse prevention

Upstash Redis processes rate-limit identifiers and access-audit records for abuse prevention. Its Data Processing Addendum covers transfers outside the EEA.

Vercel

Our application is hosted on Vercel. Vercel may process request data (IP address, headers) as part of serving the application and provides anonymized analytics. See Vercel's Privacy Policy.

4. Cookies

We use only technically necessary cookies. Firebase Authentication sets a session cookie to keep you logged in. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

You can clear cookies via your browser settings, which will log you out of Suno Styles.

5. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), you have the following rights:

  • Right of access — request a copy of the personal data we hold about you
  • Right to rectification — request correction of inaccurate data
  • Right to erasure ("right to be forgotten") — request deletion of your account and all associated data
  • Right to data portability — request your data in a machine-readable format
  • Right to restrict processing — request that we limit how we use your data
  • Right to object — object to processing based on legitimate interest, including marketing emails
  • Right to withdraw consent — unsubscribe from marketing emails at any time via the unsubscribe link in any email

To exercise any of these rights, email hello@sunostyles.com. We will respond within 30 days.

6. Data Retention

  • Active accounts: retained as long as your account is active
  • Deleted accounts: data is deleted within 30 days of an account deletion request, except legal records retained until contract-related claims are time-barred or longer where legally required.
  • Purchase records: retained for 7 years for tax and legal compliance (handled by Lemon Squeezy as Merchant of Record)
  • First-party product analytics: retained as operational history for product improvement, abuse prevention, and business analysis. If analytics are linked to your account, they are included in account deletion handling where reasonably possible; some aggregated, non-identifying statistics may be retained.
  • Vercel Analytics: retained according to Vercel's own analytics retention policy and not tied to your Suno Styles account by us

7. Children

Suno Styles is not directed at children under 13. We do not knowingly collect personal data from children. If you believe we have received data from a child, contact us and we will delete it promptly.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. For significant changes, we will notify you via email.

9. Contact

For privacy-related requests or questions:

Cuutio Software Ltd
Email: hello@sunostyles.com
VAT ID: FI23972312