Songs From Your Heart

1. Introduction & Data Controller

Songs From Your Heart ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy describes the information we collect, how we use it, the parties to whom it is disclosed, the methods of disclosure, and the security practices we have in place to safeguard your information. By using our Service, you consent to the data practices described in this policy.

Data Controller

Songs From Your Heart is the data controller responsible for your personal data. For questions about how we handle your data, contact us at Songs From Your Heart.

EU/EEA Representative (GDPR Article 27)

As Songs From Your Heart is established outside the European Economic Area, we are in the process of appointing an EU representative in accordance with Article 27 of the GDPR. In the interim, you may direct any data protection inquiries to Songs From Your Heart. We will update this page with the contact details of our formal EU-based representative once appointed.

2. Information We Collect

We collect the following categories of information:

Personal Information

• Contact Information: Email address for order confirmations, delivery, and customer support
• Payment Information: Processed securely through our payment processor; we do not store credit card numbers on our servers
• Names: Recipient names and your name (if provided) for song personalization

Content Information

• Retention Policy: All song content you added during creation of your song is deleted within 30 days of song completion.
• Memories and Stories: Personal stories, memories, and details you share for song creation
• Sensitive / Special Category Information: Your stories may voluntarily include sensitive information such as health conditions, religious or philosophical beliefs, racial or ethnic origin, or other special category data (as defined by GDPR Article 9). We process this information only with your explicit consent and solely for the purpose of creating your personalized song. During the order process, you will be asked to provide explicit consent before submitting stories that may contain such information. You may withdraw this consent at any time by contacting Songs From Your Heart, though this may affect our ability to complete your order
• Preferences: Genre, decade, voice, occasion, and style preferences
• Generated Content: Lyrics and audio files created for your order

Technical Information

• Device Information: Browser type, operating system, and device type
• Usage Data: Pages visited, time spent on site, and interaction patterns
• IP Address: For security, fraud prevention, and approximate geolocation purposes
• Referral Data: How you found us (UTM parameters, referrer URLs)

3. How We Use Your Information

We use the collected information for the following purposes:

• Service Delivery: To create and deliver your custom song
• Communication: To send order confirmations, delivery notifications, remake updates, and respond to inquiries
• Payment Processing: To process transactions securely through our payment provider
• Service Improvement: To analyze usage patterns and improve our service
• Security: To prevent fraud, unauthorized access, and other malicious activities
• Legal Compliance: To comply with applicable laws and regulations
• Marketing: To send promotional communications (with your consent, where required)

No AI Training

We do not use your stories, memories, or personal submissions to train public AI models. Your content is processed solely to create your personalized song and is not used to improve or train third-party AI systems.

Automated Processing and Decision-Making

Our Service uses automated processing, including artificial intelligence, to generate lyrics and music based on the information you provide. This automated processing is essential to deliver the Service and is performed under the legal basis of contract performance. The automated processing does not produce decisions with legal or similarly significant effects on you — it generates creative content based on your inputs. You always have the right to request human review of any aspect of your order by contacting Songs From Your Heart.

Legal Bases for Processing (GDPR)

For users in the European Economic Area, we process your data based on contract performance (fulfilling your order), legitimate interests (improving services, preventing fraud, marketing), consent (optional marketing communications), and legal obligation (compliance with applicable laws).

4. Information Sharing and Disclosure

We share your information only with the parties listed below and only as necessary to provide our Service. We do not sell your personal information to third parties. We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Third-Party Service Providers (Sub-Processors)

We share your information with the following third-party service providers to deliver our Service. Each provider is bound by a Data Processing Agreement (DPA) and is contractually obligated to protect your data in accordance with applicable data protection laws:

• Payment Processing (Stripe, Inc.): Processes payments securely. We never store or have access to your full credit card number. Stripe is PCI-DSS Level 1 certified and participates in the EU-US Data Privacy Framework. Data processed: email, payment details, transaction amount.
• Music Generation (Kie.ai / Suno): Generated lyrics and style preferences are processed to create original music and vocals. Data processed: lyrics, musical style, voice preference.
• Email Delivery (Resend, Inc.): Sends order confirmations, song deliveries, and transactional emails. Data processed: email address, order details, song links.
• Database Hosting (DigitalOcean, Inc.): Hosts our application database with encryption at rest and in transit. Data processed: all order and account data.
• Analytics (Google Analytics): Analyzes website usage patterns to improve the Service (subject to your cookie consent preferences). Data processed: anonymized usage data, device information, pages visited.

If you would like a copy of our sub-processor list or any applicable DPA, contact Songs From Your Heart.

6. Cookies and Tracking Technologies

We use essential cookies (order state, authentication, CSRF tokens), optional analytics cookies (Google Analytics, GrowthBook), and marketing/advertising cookies (Meta Pixel, TikTok Pixel, Google Ads) with user consent. You can manage your preferences through our cookie banner or browser settings. We honor Global Privacy Control (GPC) signals under applicable privacy laws.

7. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill regulatory requirements:

• Order Data: Retained for 7 years after your last transaction for legal, tax, and accounting compliance.
• Generated Songs: Stored while your account or order record is active, or until deletion is requested.
• Personal Stories and User Content: Retained during order fulfillment and remakes, then up to 12 months for quality assurance before purging from active systems.
• Support Conversations: Retained for 3 years after resolution.
• Marketing Data: Until you unsubscribe or request deletion (inactive contacts removed after 24 months).

8. Data Security

We implement robust security measures including TLS/SSL encryption for data transmission, encrypted database storage at rest and in transit, strict role-based access controls, and secure payment tokenization via Stripe. While we use industry standards, no internet transmission is 100% secure.

9. Your Rights & GDPR Compliance

Depending on your jurisdiction (including the EEA, UK, and Switzerland under the GDPR), you have the right to access, correct, delete, restrict, or port your data, object to processing, or withdraw consent at any time. European users may also lodge complaints with their local data protection authority. To exercise these rights, contact us at Songs From Your Heart. We respond to all valid requests within 30 days.

10. Data Breach Notification

In the event of a personal data breach posing a risk to your rights and freedoms, we will notify affected users and relevant supervisory authorities within 72 hours via email and prominent website notices.

11. Children's Privacy

Our Service is strictly for users at least 18 years of age (or the local age of majority). We do not knowingly collect information from children under 13 (COPPA) or 16 (GDPR/UK GDPR). If you believe a minor has submitted personal information, contact Songs From Your Heart immediately for prompt deletion.

12. Marketing Communications & Changes

You can opt out of optional marketing or abandoned cart emails at any time by clicking the unsubscribe link in any message. Transactional emails required for order fulfillment cannot be opted out of. We may update this policy periodically and will revise the "Last Updated" date above.