freebeat

GDPR overview

freebeat makes no explicit claim of GDPR compliance anywhere on its site. What it does offer is concrete but partial: article 6 of the privacy policy opens a GDPR Request Form to residents of the European Union and the United Kingdom, and describes rights of access, rectification, erasure and restriction, with reasoned limits. A Data Protection Officer is mentioned but is neither named nor directly reachable, and the privacy contact (privacy@freebeatfit.com) sits on a sibling domain. No representative under Article 27 is designated, no data processing agreement is published and no sub-processor list exists. Transfer to the United States is set as a condition of use: "By using the Services, you consent to freebeat's transfer of your data to the United States." Privacy disputes are placed under Georgia law while the terms of service point to New York law.

Who owns the data?

Under the terms of service, the user keeps the rights to everything they upload or generate: article 4 states that "You retain rights to content you upload or generate", article 8 that "You own content created using the Services". freebeat owns the platform itself — algorithms, models and interfaces — and receives a non-exclusive, worldwide licence to process user content to operate the service. The home page FAQ adds a commercial-use licence on generated visuals, avatars, images and music, subject to the terms: publishing, distribution and monetisation are permitted, and freebeat states that it claims no ownership of the videos and does not reuse them without authorisation.

Reuse rights

freebeat collects account data (username, email, password), purchase records, usage history (credits consumed, generation types, formats, prompts) and saved projects. Media submitted for generation — images, video, audio and prompts — are processed to produce the requested output, and material containing faces, voices or likenesses is passed to third-party model providers such as ByteDance/Seedance and OpenAI. The privacy policy states that uploaded media are not used to build standalone biometric identification databases and that biometric data is not sold. Media and prompts also go through automated moderation targeting CSAM, non-consensual imagery and unauthorised biometric use. Location data (IP, GPS, city, region) and technical data are collected automatically, Google Analytics is in use, and targeted advertising is run with third-party partners with an opt-out. Browser Do Not Track signals are explicitly not honoured, and support and sales calls are recorded.

Data retention & training

Hosting summary

freebeat commits to no hosting country. Article 4.2 of the privacy policy is a permissive transfer clause rather than a location guarantee: personal information may be "transferred, Processed and stored anywhere in the world", with the United States, Canada and the European Union named only as examples, and with processing possible in the cloud, on freebeat's servers, on those of its affiliates or on those of its service providers. Article 9 goes further and makes consent to transfer to the United States a condition of using the service. No hosting region can be selected by the customer, and no data residency option is offered. On the infrastructure side, the domain resolves to 216.198.79.1, an anycast node announced by AS16509 (Amazon.com Inc.) and geolocated in the United States, which points to US cloud hosting but says nothing about where stored data finally sits. In practice, a European or British customer should treat freebeat as a service under United States jurisdiction, with worldwide transfer permitted by contract.