Your data, mapped plainly.

The controller for Leið is Attila Erdei, 1135 Budapest, Szent László út 15., Hungary. Privacy enquiries and requests can be sent to hello@deettalabs.com.

This notice applies to the Leið website, its account system, saved songs and compositions, public share links, AI Composer, and related support communication.

Route, stop, and vehicle information comes from public-transport data sources and is used to generate music. It is not used to identify passengers. Audio samples and impulse responses you upload to the instrument are decoded locally and are not uploaded to Leið or included in saved song snapshots. MIDI and WAV exports are generated on your device. Leið records only the export allowance used, not the exported file or its contents.

• Contract: to provide accounts, authentication, saved work, sharing, and requested features.
• Legitimate interests: to secure, maintain, troubleshoot, measure, and improve the service while limiting the data used.
• Legal obligation: to keep or disclose billing, tax, accounting, or other records where applicable law requires it.
• Consent: where the law requires it. Consent may be withdrawn at any time without affecting earlier lawful processing.

Leið uses the following service providers to operate the website:

Public transport agencies and feed operators supply route and vehicle data. They do not receive your Leið account data from us. Providers may process data outside Hungary or the European Economic Area using the transfer mechanisms described in their own privacy information and data-processing terms.

AI Composer is optional. Leið sends your prompt together with a system message describing the active city, available route names and IDs, and instrument controls to OpenRouter, which routes the request to the configured model provider. Leið does not deliberately add your name or email to that request and does not store the raw prompt or returned plan in its database. If you apply a plan and save the song, the resulting instrument settings become part of that saved song. OpenRouter and model-provider retention or training practices vary, so do not submit confidential, sensitive, or third-party personal data.

Leið uses essential authentication cookies to keep signed-in accounts secure. Local storage remembers the theme, active city, drum clipboard, product-tour and mobile-intro state, autosave choice, and last opened song. These local preferences remain on the device until you clear them or your browser storage.

Leið does not use advertising cookies or behavioural profiling. It uses Vercel Web Analytics, which does not use cookies, for page views and a small set of product events such as opening or troubleshooting the app, selecting a city, starting playback, generating or applying an AI plan, or sending a drum pattern. Vercel derives a daily-resetting visitor hash and provides aggregate reporting. These events do not include account names or emails, song content, prompts, exported files, or audio.

Sharing is off by default. If you publish a saved song, Leið creates an unlisted bearer link: no sign-in is required, and anyone who has the URL can retrieve the song name, city, schema version, and complete saved creative state and import a copy. Do not put personal, confidential, or third-party protected information in names or content you share. You can unpublish the link from the song menu, but that cannot recall copies already imported or saved.

Account data and saved creative work are kept while the account is active, until you delete the relevant work, or until an account-deletion request is completed. You can delete individual saved songs in the service. Verification records and sessions expire when they are no longer needed for authentication. Billing subscription history and usage records are kept while the account is active and longer where needed for tax, accounting, fraud prevention, disputes, or legal claims. Support correspondence, operational logs, and security records are retained only as long as reasonably necessary for those purposes and provider operations.

You may request account and personal-data deletion at any time by emailing hello@deettalabs.com. Data is removed from live systems when the request is completed; residual copies may remain in protected backups until their normal rotation completes, or longer where law or a legal claim requires it.

Leið does not retain AI prompts or generated plans in its application database, but OpenRouter and the selected model provider may retain request or response data under their own settings and policies. Vercel’s analytics visitor hash resets every 24 hours; aggregated analytics and provider records follow the provider’s configured retention.

When you begin checkout, Leið sends your display name, email address, and internal user ID to Lemon Squeezy to associate the purchase with your account. Leið stores the resulting subscription identifiers, status and dates needed for access control, but does not receive or store your full payment-card details. Lemon Squeezy retains payment, invoice, tax, and transaction records under its own legal obligations and policies.

Leið is not intended for children under 13. In Hungary, a user under 16 must have a parent or legal guardian authorize any consent-based processing needed for an account. If the law where you live sets a different threshold, that rule applies. A guardian who believes a child provided data without the required authorization should contact us so it can be removed.

Depending on the circumstances, you may ask to access, correct, erase, restrict, or receive a portable copy of your personal data; object to processing based on legitimate interests; and withdraw consent. You also have the right to complain to a supervisory authority.

AI Composer proposes musical settings for you to review and apply. Leið does not use solely automated processing to make decisions about you that produce legal or similarly significant effects.

In Hungary, the supervisory authority is the National Authority for Data Protection and Freedom of Information (NAIH). Contact us first if you can—we would like the opportunity to resolve the issue.

Reasonable technical and organisational safeguards are used to protect data, but no internet service can promise absolute security. Keep your password confidential and tell us promptly if you suspect unauthorized account access.

This notice may change when the product, providers, or law changes. Material updates will be announced in the service or by email where appropriate, and the updated date at the top of this page will change.