RAP DUO
Privacy Policy
How RapDuo handles accounts, music, creative inputs, shared gifts and payments.
Updated October 25, 2026
Operator and contact
Wang Xiaochun, an individual operator in Hong Kong, is responsible for RapDuo's collection and use of personal data. Contact support@rapduo.io for privacy questions or requests. Messages are forwarded to the support team for handling.
Information we process
We process account names, email addresses, sign-in information, creative inputs and results, order references, credit activity, payment status and service diagnostics. Creative data may include portraits, uploaded audio, song titles, descriptions, lyrics, style choices, cover images and videos. Birthday-song details can include a recipient's name or nickname, relationship, birthday milestone, pronunciation guidance, memories and a personal message. Provide only details needed for your song; avoid sensitive information about yourself or others. Stripe and PayPal handle payment details in hosted checkout; we do not store your complete card number.
Why we use it
We use the data needed to authenticate you, prepare and deliver the music, lyrics, artwork, video or gift you request, review content for safety, verify payments, manage credits and subscriptions, prevent abuse, diagnose failures and answer support requests. Required fields are identified in the relevant form; without the necessary inputs we cannot provide that feature. Optional story details and optional analytics are not required to maintain an account. Birthday information is prepared locally and is sent with the song request when you confirm generation in the music studio.
Legal grounds where applicable
Where the GDPR or UK GDPR applies, we rely on performance of your contract for the account and creative services you request, legal obligations for required records, and legitimate interests for proportionate security, fraud prevention and service troubleshooting. Optional analytics relies on your consent, which you can withdraw in Privacy choices. These grounds do not make optional tracking necessary or remove your applicable rights.
Service providers
Infrastructure providers supply hosting, databases, private file storage and transactional email. Google processes the sign-in flow if you choose Google login; Stripe and PayPal handle payments. Music, lyric, artwork and standard video requests use APIMart and the selected upstream model. Relevant images and creative text are checked by SeeAPI, NVIDIA and an OCR service; uploaded and generated audio is checked by Alibaba Cloud's audio moderation service in its Singapore region. Optional Z.ai and OmniHuman processing is described below. Providers receive the inputs needed for the requested feature or safety check. We do not sell your photos or automatically publish your work in a public gallery.
Private media and retention
Source portraits in our application storage expire after 7 days. Stored audio, cover images and finished videos normally expire after 30 days; a gift link may expire earlier with its selected files. Account access is required except for scoped provider input links and gift links you explicitly choose to share. Expiry of a media file does not erase every related record: account and task details are retained as needed for the service and support, and payment and credit records for balances, disputes and applicable recordkeeping duties. Upstream providers and backups have their own retention arrangements; deleting a RapDuo file does not itself delete their copies. Contact us to request deletion or details of the relevant retention arrangements.
International processing
RapDuo operates from Hong Kong and uses providers that may process information in other countries, including the audio review in Singapore described above. Where data protection law requires safeguards for an international transfer, those requirements apply to the relevant processing relationship. You can contact support@rapduo.io for information about the provider and applicable safeguards for your request. Accepting general terms does not waive your data protection rights.
Gift links and local audio tools
Creating a mixtape gift requires a separate sharing confirmation. Anyone with its link or QR code can see the chosen message and cover, and play or download the chosen songs. The link can be forwarded; it is not limited to a named recipient. You can revoke it in Mixtape Maker, but cannot recall copies someone has already downloaded. Local-file MP3 to MIDI, audio visualizer and lyric-video processing runs in your browser; selecting a local file in those tools does not submit it to a generation provider. Choosing a separate cloud upload or generation feature has the processing described for that feature.
Optional AI polish
When you click AI polish, your short topic and selected scene are sent to Z.ai to improve the wording. Your photos are not sent for this feature. You can edit or undo the suggestion before creating a video. We keep the request fingerprint and limited usage diagnostics to prevent repeated requests and abuse. A reusable suggestion is retained for up to 24 hours, and call metadata and token-based cost estimates for up to 13 months. AI polish does not use your video credits.
Optional music video director and performance generation
When you prepare an OmniHuman creative plan, your selected song title, lyrics, style and creative direction are sent to Z.ai. Photos and audio are not sent to Z.ai for this feature. A plan is retained for up to 24 hours and usage metadata for up to 13 months. When you confirm video generation, the selected character image, selected song audio and confirmed direction are sent to the configured OmniHuman 2.0 provider, BytePlus or fal. The provider route is fixed for that task; a failed or unknown request is not automatically sent to another provider. Private, job-scoped links allow the provider to retrieve the input files. SeeAPI, NVIDIA and the existing OCR service review relevant images and creative text. Source audio must already have passed our audio review. Intermediate audio and video files are private and expire within 30 days; uploaded source portraits expire after 7 days. Your confirmed plan and billing diagnostics remain with the private task record for delivery and support. These providers may process data internationally under their own terms.
Cookies and local drafts
Necessary cookies maintain your session and preferences. Your browser can temporarily keep creative drafts on this device so you can continue after signing in; photo drafts last up to 24 hours. Remove unneeded drafts and sign out on a shared device. Other people using the same browser profile may be able to access an unexpired local draft. Browser storage and local-file processing are separate from files you explicitly upload to our service.
Your choices
Use Privacy choices in the footer to refuse or withdraw optional analytics; this does not prevent purchases or creation. Email support@rapduo.io to request access to or a copy of your personal data, correction of inaccurate data, or applicable account and media deletion. Where the relevant law provides them, you can also request portability or restriction, object to processing, withdraw consent and complain to the competent privacy authority, including Hong Kong's Privacy Commissioner for Personal Data. Use your account email when possible; people without a RapDuo account can also contact us. We may reasonably verify identity and retain records required by law or needed for disputes. We respond within applicable legal time limits; extensions or refusals require the applicable explanation. Download results you want to keep before requesting deletion.
Optional analytics
With your permission, we store a random browser identifier for up to 90 days, a visit identifier that expires after 30 minutes of inactivity, and your consent choice for 180 days. We record sanitized source domains and campaign labels, device class, public page paths and product steps. We link these observations to your account when you are signed in. We do not include portrait files, creative topics, passwords, card details or private file URLs in analytics events. Detailed visit and behavior records are retained for up to 13 months; first-source attribution associated with your account is retained while needed to understand account activity. Payment and account records have their separate retention periods described above.
Google Analytics and Microsoft Clarity
When enabled and with your consent, Google Analytics 4 measures visits and product interactions on public pages, and Microsoft Clarity helps us understand public-page interactions through session replay and heatmaps. Creative inputs are masked. Recording is disabled on account, billing, checkout, login, administrator and private video pages; query-bearing pages are excluded from Clarity. These services process browser and device information under their own privacy policies. Our internal revenue reports use verified payment records rather than a browser payment-success click.
Performance measurement and email
Production uses Vercel Speed Insights at 5% sampling for page performance. We remove query strings and fragments and use generalized routes to avoid reporting private result identifiers; this measurement does not create a cross-page session replay. Account verification, password resets and necessary service messages are transactional. Registration does not automatically subscribe you to marketing emails; our newsletter is currently disabled. Any future optional marketing has its own applicable consent and unsubscribe requirements.
Contacting support
Please include only what is needed to resolve your question. Never send a password, payment card number, authentication code or API key. We use support messages to resolve your request and may retain them with related order records.
Questions?Contact RapDuo support.