1. Who is responsible
BeatBloom is operated by 2B Studios Inc. The registered address and privacy/support email have not yet been supplied. This is a pre-launch draft, not a completed public privacy notice. Those contact details, the final processing inventory, and applicable jurisdictions must be confirmed before launch.
2. Information we handle
We receive information you provide, technical records from your use, invitations from workspace owners, and transaction or security confirmations from service providers. Records may include email, display name, birth date, country, language, timezone, account security, workspace roles, prompts, lyrics, uploaded or generated audio, recipes, feedback and support correspondence. When commerce is enabled, we also handle order, invoice, credit, referral, licensing and payout records. Payment providers collect payment credentials in their own checkout; do not put card numbers, passwords or identity documents in creative prompts.
3. Why information is used
Account, workspace, and creation data support the service you request and its contract. Security records support legitimate interests in protecting accounts, preventing abuse, and resolving incidents, subject to your rights. Information may also be retained to meet legal obligations. Optional website-language storage relies on your consent. No marketing mailing list is collected on this page; marketing consent must be separate from account access.
4. Sensitive information, voices and other people
A voice recording and identifying details about another person can be personal data. Only submit material you are entitled to use and disclose, including appropriate permissions for voices and information about children. The service is not intended to collect health, financial, biometric-identification or other highly sensitive information in creative prompts. A recording is not automatically biometric identification data merely because it contains a voice. Do not submit confidential client material unless you have authority and have checked the enabled provider’s processing arrangements.
5. Providers and sharing
Selected cloud functions send the relevant text or audio to the configured provider. The current integrations include OpenAI for writing, Runpod for music inference, and ElevenLabs for optional speech; Kokoro can run in a separately configured service. Hosting, identity, private object storage, and SendGrid account emails also process data when enabled. Workspace members see information allowed by their role. The actual enabled processors, their locations, retention terms, and contractual safeguards must be verified for the deployed service.
6. Workspace visibility, providers and disclosure
Shared workspace members may see creations and activity according to their role; owners control membership and spending permissions. Public listings, reviews and creator profiles are visible to others when you choose to publish them. Hosting, identity, email, media-storage and enabled AI providers receive data needed for their task. Payment and payout providers may also act as independent controllers under their own notices. Necessary disclosures may be made to professional advisers or authorities to meet law, investigate abuse or establish legal claims. This notice does not authorise selling your private prompts or using them in advertising.
7. AI processing and automated checks
Generating music, text or speech sends relevant instructions and, where needed, audio to the selected service. These terms do not grant a general licence to train unrelated models on your private material. Actual provider retention and training settings must be checked before a provider is enabled; we do not promise every provider has zero retention. Automated eligibility, credit, rate-limit and security checks can prevent an operation. If you believe a restriction is wrong, seek review through the support route once published. Any legally significant solely automated decision-making requires its own explanation and applicable safeguards.
8. Required information and your choices
Account and age-eligibility information is needed to operate the requested account; billing or seller information may be required for payments, tax and verification. If essential information is missing, we may be unable to provide that function. Optional profile details, public sharing and website preference storage can be declined. The public site currently has no advertising or analytics trackers. A privacy notice explains processing; it is not blanket consent to every future use. New purposes require an appropriate legal basis and updated information.
9. International processing
A cloud provider may process information outside your country or the EEA. Where required, the operator must establish an appropriate transfer mechanism, such as an adequacy decision or standard contractual clauses, and assess additional safeguards. This draft does not promise EEA-only processing or claim that every provider arrangement has been completed.
10. Storage, retention, and security
We retain account and creative records to provide the requested service; security logs for proportionate abuse investigation and account protection; and transaction, licence and dispute records for applicable accounting duties and legal claims. Retention depends on the record, purpose, account state, legal holds and relevant limitation periods. Precise log, media, account and backup schedules remain to be confirmed before launch. Local drafts can remain on your device until removed. A deletion request does not instantly erase shared works, recipients’ copies, legally required records or backups. Access controls and secure sessions reduce risk, but no system guarantees absolute security.
11. Your choices and rights
Depending on the applicable law and processing basis, you can request access, correction, erasure, restriction and a portable copy, and withdraw consent without affecting earlier lawful processing. You can object to processing based on legitimate interests and to direct marketing. We may seek proportionate identity verification and must explain lawful refusals or extensions. Applicable statutory response periods apply, normally one month for UK/EU rights requests. The studio’s Privacy and your data area supports account exports and deletion case review where enabled; a case is not proof of erasure. Automated exports exclude audio files, other members’ data and some provider-held records. A monitored contact for wider requests still needs confirmation.
12. Teens and family spaces
Accounts are intended for adults and teens aged 13–17 in guardian-managed family spaces. Under-13 accounts are not supported. Local consent ages and guardian requirements still apply. Guardians manage access and teen credit budgets. Avoid including identifying or sensitive information about children in prompts, lyrics, or audio.
13. Updates
Material changes to purposes, providers, or rights information must be reflected in this notice before they take effect and communicated when required. The updated date identifies this draft. Review the separate cookie policy and terms for website storage and service conditions.
14. United Kingdom
2B Studios Inc. is incorporated in the United Kingdom. You may complain to the Information Commissioner’s Office (ICO). UK restricted transfers require an applicable UK transfer mechanism and assessment; EEA transfers require their applicable safeguards. These deployment arrangements still need verification.
Information Commissioner’s Office (UK)