Privacy Policy

Larka AI (the "App"), operated by Asaf Shevach ("Larka," "we," "our," or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard information when you visit our website at larka-music.com (the "Website") or use the Larka AI mobile application. By using the Website or App, you agree to the practices described here.

For users in the European Economic Area, the United Kingdom, and other jurisdictions with similar laws, the data controller is Asaf Shevach, located in Poland. You can reach us at the contact details in the Contact Us section.

Please read the Information We Collect — App, Voice Data, and Third-Party Services sections carefully: because Larka creates AI music, some of the audio and content you submit is uploaded to our infrastructure and shared with our AI provider to generate your results.

Email address

When you join our waitlist or send a message via the contact form, you voluntarily provide your email address. The contact form additionally collects your name and the message content.

IP address & request metadata

When you load any page or submit a form, our hosting provider (Vercel) automatically logs your IP address, request timestamp, user agent, and the URL you requested. We use a short-lived hash of your IP for rate limiting (to prevent form abuse) via Upstash Redis; rate-limit counters expire within one hour.

Cookies & tracking

We do not use cookies, pixels, or analytics scripts on the Website. We do not run Google Analytics, Meta Pixel, or any third-party tracking tools. No consent banner is shown because we have no non-essential cookies to disclose.

Account data

To use the App you sign in (currently via Google Sign-In; Sign in with Apple is planned). Through your sign-in provider and Firebase Authentication we receive an account identifier and basic profile details such as your email address and name. We use a unique user ID (uid) to associate your data and activity with your account.

Audio & microphone data (on-device features)

Some features — chord detection, the tuner, and Listen Mode — process audio locally on your device in real time and are not uploaded to us.

Audio you submit for AI features

When you use AI features — such as turning a hum or recording into a song, "Cover a Song" (uploading audio or selecting a saved recording to restyle), generating stems or videos, or voice cloning — the audio you submit is uploaded to and stored on our infrastructure (Vercel Blob), and the file location is shared with our AI provider (kie.ai, which operates Suno) so it can generate your result. This means the raw audio you submit for these features does leave your device and is stored and shared as described here and in the Third-Party Services section. See also the Voice Data section for voice cloning.

Other content you create

Lyrics, prompts, song notes, titles, and generated Output are associated with your account so you can access them across the App's features (for example, playback, re-generation, stems, and videos).

Usage & event data

We log per-account usage and events to Firestore, keyed to your user ID (uid) — for example, which generations you run, feature usage, credit consumption, and billing/refund markers. This data is associated with your account and is not fully anonymous.

Subscription & purchase data

Subscriptions and credit purchases are processed by Apple via the App Store, and (as we roll it out) managed through RevenueCat. We do not receive or store your payment-card details; we do receive subscription and entitlement status so we can provide the features you paid for.

The App offers an optional voice-cloning feature. Because voice data is sensitive, we describe it separately here.

What we collect. If you choose to use voice cloning, we collect a recording of your voice, including a spoken verification phrase.

How it is used and shared. Your voice recording is sent to our AI provider, kie.ai, which uses it to create a reusable voice model tied to your account. That model can then be used to generate vocals in your Output. Your voice recording and the resulting voice model are stored in connection with your account until you delete them.

Own voice only. You may use this feature only with your own voice. Submitting or cloning another person's voice is prohibited under our Terms of Use.

Sensitive / biometric-adjacent data. We treat voice recordings and voice models as sensitive personal information. Depending on where you live, this data may be considered biometric or otherwise specially protected (for example, under the Illinois Biometric Information Privacy Act, the California Privacy Rights Act's "sensitive personal information" category, and Article 9 of the GDPR). Where the law requires your explicit consent to process such data, we rely on the consent you provide when you choose to enable voice cloning, and you can withdraw it by deleting your voice model.

Deletion. You can delete your voice model at any time from within the App. When you do, we delete it from our systems and instruct kie.ai to delete the associated model. See the Account & Data Deletion section.

We use the information described above to:

— Provide, operate, and improve the Website and App

— Authenticate you and maintain your account

— Generate your AI Output (songs, stems, videos, lyrics, cover art, cloned vocals) using our providers

— Store your recordings, uploads, and Output so you can access, replay, and re-generate them

— Manage subscriptions, credits, entitlements, and refunds

— Send you product updates, launch news, and the welcome email after you join the waitlist

— Respond to messages sent through the contact form

— Prevent abuse and fraud (rate limiting, spam and abuse detection)

Lawful basis (EU/UK users): contract performance (Article 6(1)(b) GDPR) for providing the App's core and AI features to your account; consent (6(1)(a)) for waitlist emails and marketing updates and, where required, explicit consent (Article 9(2)(a)) for processing voice data; and legitimate interests (6(1)(f)) for fraud and abuse prevention and basic server logs.

We do not sell your personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects. We do not use the private content of your recordings to train our own foundation models; our AI providers process your data under their own terms.

Website

— Waitlist emails: retained until you unsubscribe or request deletion, or until 12 months after Larka publicly launches (whichever comes first).

— Contact form messages: retained until your inquiry is resolved plus up to 12 months for reference.

— Rate-limit counters (hashed IP): expire automatically within one hour.

— Vercel access logs: retained per Vercel's standard retention (typically up to 30 days).

App

— Account data, uploaded audio (Vercel Blob), generated Output, and usage/event data (Firestore): retained while your account is active and until you delete the relevant item or your account, subject to short-term residual copies in routine backups and any retention our providers apply under their own terms.

— Voice recordings and voice models: retained until you delete them or delete your account, after which we instruct our provider to delete the model.

You can delete individual items in the App, or delete your entire account (see Account & Data Deletion).

We rely on a limited set of vendors who process data on our behalf or receive data to provide their part of the Service. Where required, each is engaged under a data-processing agreement and, for transfers out of the EEA/UK, relies on Standard Contractual Clauses or another lawful transfer mechanism.

App

— kie.ai (Suno) — AI music and vocal generation, including voice cloning. Audio you submit for AI features, and your voice recording for voice cloning, are shared with kie.ai to generate your Output and to create/store your voice model.

— Vercel Inc. (United States) — application hosting and Vercel Blob storage, where audio you submit for AI features is uploaded and stored.

— Google / Firebase (Google Cloud) — Firebase Authentication (account/sign-in) and Firestore (per-account usage, events, and billing/refund markers).

— Google Gemini / Imagen — AI generation of lyrics and cover art from your prompts and parameters.

— Stability AI — used for generating some cover audio.

— Upstash, Inc. — job/queue state for generation tasks.

— Apple — App distribution, and processing of subscription and in-app purchases.

— RevenueCat — subscription and entitlement management (being rolled out).

— Google Sign-In — account authentication (Sign in with Apple is planned).

Website

— Vercel Inc. (United States) — website hosting, deployment, and access logs. https://vercel.com/legal/privacy-policy

— Resend Inc. (United States) — email delivery, waitlist contact storage, and welcome/notification emails. https://resend.com/legal/privacy-policy

— Upstash, Inc. (United States / EU) — Redis-based rate limiting using short-lived hashed IP counters. https://upstash.com/trust/privacy.pdf

We encourage you to review the privacy policies of these services.

You can delete your account from within the App. Deleting your account removes your associated data, including your Firebase account data, audio you uploaded for AI features (Vercel Blob), your usage/event records where no longer required for legal or accounting purposes, and your kie.ai voice model, and removes you from our marketing/waitlist contacts. Some records may be retained where required by law (for example, tax or transaction records) and residual copies may persist briefly in backups.

If you cannot access the in-app deletion tool, you can email us at larka.ai.music@gmail.com and we will delete your data as described above.

The App may offer an optional feature to back up your songs and content to your own iCloud account. This backup is stored under your Apple ID and controlled by you and Apple's iCloud terms; it is separate from the storage we operate. You can disable it or remove backed-up content through the App and your device settings.

Some of our sub-processors are located in the United States and other countries. When personal data is transferred outside the European Economic Area, the United Kingdom, or other jurisdictions with restrictions on cross-border transfers, we rely on the European Commission's Standard Contractual Clauses (or the UK equivalent) and, where the recipient is certified, the EU-U.S. Data Privacy Framework.

If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the CPRA.

Categories of personal information we collect: identifiers (such as account ID, email, name); audio/electronic information (recordings and uploads you submit for AI features); commercial information (subscription and purchase status); internet/usage activity (feature and event logs); and inferences we draw to operate features. We also collect sensitive personal information, specifically your voice data when you use voice cloning, which we use only to provide the voice-cloning feature you requested and not to infer characteristics about you.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under California law.

Your California rights: to know/access the personal information we hold about you, to delete it, to correct inaccurate information, to limit the use of sensitive personal information, and not to receive discriminatory treatment for exercising your rights. To exercise these rights, contact us at larka.ai.music@gmail.com; we may need to verify your identity before responding.

The App requests access to your microphone for features such as chord detection, the tuner, Listen Mode, the voice recorder, humming/recording for AI songs, and voice cloning. Microphone access is only active while you are actively using one of these features. You can revoke microphone permission at any time in your device Settings > Larka AI.

The Website and App are not directed to children under the age of 13 (or under 16 in jurisdictions where that is the applicable threshold). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

Depending on your location, you have the right to:

— Access the personal data we hold about you

— Rectify inaccurate or incomplete data

— Erase your data ("right to be forgotten")

— Restrict or object to certain processing

— Portability — receive your data in a machine-readable format

— Withdraw consent at any time, without affecting the lawfulness of prior processing

— Lodge a complaint with your local data protection authority

To exercise any of these rights, email us at larka.ai.music@gmail.com. We will respond within the time required by applicable law. To unsubscribe from waitlist emails, click the unsubscribe link in any email we send you, or reply with "Unsubscribe" in the subject.

If you have any questions about this Privacy Policy or want to exercise your rights, please contact Asaf Shevach at:

larka.ai.music@gmail.com

Warsaw, Poland

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the date at the top of this page, and for material changes affecting subscribers, by sending an email or in-app notice. Continued use of the Website or App after changes constitutes acceptance of the updated policy.