Privacy policy
Last updated: 2026-10-19
1. Controller
SongHearts (online service for personalized songs)E-Mail: hello@songhearts.com
Orders are sold and processed by our online reseller and merchant of record, Waffo.com Limited, which also handles payments, invoices and order-related inquiries and refunds together with us.
2. The short version
- We only use your input to create and deliver your song and to prevent abuse.
- We use no advertising, analytics or tracking cookies and no services such as Google Analytics.
- No account is needed. Your song is reachable through a random private link.
- Unpaid drafts are deleted after 30 days; paid songs stay available for at least 24 months.
3. What we process
Your song details
The recipient’s name or nickname, relationship, occasion, your story, style, voice and language, plus the generated lyrics and audio files. Legal basis: performing the contract and pre-contractual steps (Art. 6(1)(b) GDPR). Please only include information needed for the song, and only first names for children.
Order and payment data
Order number, package, price, currency, time and payment status, and the email address passed to us by the payment provider. We never see card data. Legal bases: Art. 6(1)(b) and (c) GDPR.
Technical data and abuse prevention
When you visit the site, our hosting provider processes technically necessary data such as IP address and browser details. To prevent abuse of the free lyrics, we count requests per day using a hash of the IP address combined with a random value that changes daily. We do not store the IP address itself, and the daily random value is deleted after two days. Legal basis: our legitimate interest in secure and affordable operation (Art. 6(1)(f) GDPR).
Where visits come from
When you arrive from another website, we store, without cookies, the referring domain, landing page, campaign parameters (utm), country and device type, linked to the same daily hash, so we can see which pages and channels lead to orders. Legal basis: Art. 6(1)(f) GDPR.
Your browser’s local storage
We keep a random device ID for daily limits, your form draft and the link to your latest song in your browser’s local storage so you can continue later. This is strictly necessary for the function you requested. You can clear it in your browser settings at any time.
4. Recipients and processors
- Cloudflare, Inc. (USA): hosting, database, storage and AI models for lyrics and content checks (Gemma 4 (Google), via Cloudflare Workers AI; Llama Guard 3 (Meta), via Cloudflare Workers AI).
- Mureka (Skywork AI): music and vocal generation. We send the lyrics, title and style settings, not your original story.
- Payment providers (e.g. Waffo as merchant of record, PayPal): payment processing under their own privacy policies.
Where data is transferred outside the EU, this is based on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission’s standard contractual clauses.
5. Retention
- Unpaid drafts: 30 days.
- Paid songs and lyrics: at least 24 months, then deleted unless you ask otherwise.
- Order records: as long as statutory retention duties apply.
- Content reports: until resolved, at most 12 months.
6. Your rights
You have the right to access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interests. Email hello@songhearts.com with the link to your song. You can also complain to a data protection supervisory authority.