> For the complete documentation index, see [llms.txt](https://docs.suno.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.suno.finance/legal/privacy-policy.md). # Privacy policy A guide to Suno's Privacy Policy v1.0: who controls your data, what is collected and why, where it goes, how long it stays, and the rights you can exercise. Suno's Privacy Policy, version 1.0, took effect on 2026-09-16. It covers the personal data Suno Investments S.A. collects when you use the website, the app, and the support channels, and it was written to comply with Panama's Law 81 of 2019 and Bermuda's Personal Information Protection Act 2016. This page walks through what it says. The signed PDF is the binding text. {% file src="/files/eoJVXrJVhyQwY8zU5uI9" %} Suno Finance Privacy Policy, v1.0 (PDF) {% endfile %} ## Who is responsible Suno Investments S.A. is the data controller for what the platform collects to operate: onboarding data, account data, usage data, and communications. Two other kinds of party handle data in their own right. The providers that run identity verification, KYC and AML checks, and ongoing monitoring act as independent controllers or processors for the data inside their own programs, so retention and access there follow their rules as well as Suno's. Infrastructure providers, for hosting, authentication, email delivery, and analytics, process limited data on Suno's behalf under contract. The verification provider currently engaged is named on [Current designations](/legal/current-designations.md). The services are for adults in eligible jurisdictions only. Suno does not knowingly collect data from anyone under eighteen and deletes it if it turns out to have received some. ## What is collected * **Onboarding and account data.** Legal name, date and place of birth, nationality, residential address and proof of it, a government identity document, email, the wallet addresses linked to the account, and authentication metadata such as login times. For entities, the constitutional documents and the identity of representatives and beneficial owners. * **Verification data.** Photographic identification, proof of address where required, biometric checks such as liveness or facial recognition run inside the verification flow, and the results of sanctions and politically exposed person screening. * **Technical and usage data.** IP address and the approximate location derived from it, device and browser information, interaction logs, and session identifiers. The platform also runs performance and error monitoring: a share of production sessions may be recorded for review, sessions in which an error occurs are recorded in full, and the sequence of actions before an error is logged. Identifying context is cleared from the monitoring systems at logout, and debugging screenshots are used only in development environments. * **On-chain data.** Whitelist status and transaction history live on public blockchains. They are visible to anyone and Suno cannot delete or change them. * **Communications.** What you send through WhatsApp, email, or other support channels, with your contact details. * **Marketing data.** Your email and preferences, only if you opt in. ## Why, and on what legal basis | Purpose | What it covers | Legal basis | | ----------------------------- | --------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- | | Operating the platform | Account creation, onboarding, identity verification, distributions, platform services | Performance of a contract and the steps before it | | Regulatory compliance | Identity verification, sanctions screening, ongoing monitoring, directly or through providers | Legal obligation; legitimate interest in security and compliance | | Security and fraud prevention | Monitoring, abuse prevention, investigation of suspicious activity, system integrity | Legitimate interest | | Marketing | Optional newsletters and updates | Consent, withdrawable at any time | | Legal proceedings | Court orders, regulatory inquiries, dispute resolution | Legal obligation; legitimate interest | ## Where it goes and how long it stays Data is processed in Panama, where the controller sits, and in the jurisdictions of the infrastructure and verification providers. Where a destination does not offer equivalent protection, Suno relies on contractual safeguards substantially equivalent to recognized transfer mechanisms, plus encryption in transit and at rest, access controls, and data minimization. Retention follows the purpose. Account data stays for the life of the relationship and is deleted or anonymized afterward where the law allows. Verification data held by compliance providers stays for as long as anti-money-laundering rules require, on schedules Suno does not control. Technical data stays up to twelve months unless an investigation or a legal duty needs it longer. Communications stay as long as it takes to resolve them and a reasonable period after. Marketing data stays until you unsubscribe. Suno does not sell personal data. It shares data with the providers above, with authorities when a valid legal obligation requires it, with a successor entity in a merger or sale that accepts equivalent privacy practices, and in aggregated or de-identified form for research and analysis. A current list of key providers is available on request. ## Cookies, automated tools, and security The platform may use cookies, local storage, and similar technologies for essential functions, analytics, and app preferences. Suno gives notice and, where the law requires, asks for consent before placing anything non-essential, and you can manage cookies in your browser. Automated tools assist with sanctions screening, fraud detection, and risk scoring, but they support human review rather than replace it: no decision with significant legal effect on a user is made by automation alone. Data is protected by encryption in transit and at rest, role-based access with multi-factor authentication, regular security assessments and penetration tests, staff training, and contractual obligations on every provider. If a breach poses a significant risk to users, Suno notifies the affected users and the supervisory authority: ANTAI in Panama, the Office of the Privacy Commissioner in Bermuda. ## Your rights | Right | What it means | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | Access | Confirmation of whether Suno processes your data and a copy of it, with the purposes and recipients | | Rectification | Correction of inaccurate or incomplete data | | Deletion | Deletion of the data Suno controls, except data kept under mandatory compliance retention and records on public blockchains | | Withdrawal of consent | For consent-based processing such as marketing, at any time, without affecting the rest of the service | | Opposition | Objection to processing based on legitimate interests; where the processing is a condition of the service, objecting may mean losing access | To exercise a right, use your platform account where the feature exists or write to with the subject line "Data Protection Request". Suno may ask for information to confirm your identity and aims to answer within thirty calendar days. Where the data sits with an independent provider, Suno tells you who the controller is and coordinates where it can. Complaints go to the same address first, with the same thirty-day commitment. If the answer does not satisfy you, you may complain to [ANTAI](https://www.antai.gob.pa/) in Panama or the [Office of the Privacy Commissioner for Bermuda](https://www.privacy.bm/). ## Changes to the policy Material changes are announced by email, where an address is registered, or by a notice on the services at least five calendar days before they take effect. Administrative changes take effect immediately. Continued use after a change is acceptance; a user who disagrees with a material change may stop using the services. Each version of the policy carries its own number and date, and this page names the version it describes. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.suno.finance/legal/privacy-policy.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.