1. Data controller
The controller of your personal data is [LEGAL ENTITY NAME — e.g. Your Story Your Song, S.L.] (Your Story. Your Song.), [Registered address, Spain], NIF [NIF / CIF]. Privacy contact: privacy@yourstoryyoursong.com. This policy explains how we process personal data in compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
2. Data we process
- Account data: first and last name, email address, hashed password, and optional contact and delivery details (phone, address, city, postal code, country).
- Order & billing data: products purchased, amounts, invoices, and payment status (payment card data is processed by our payment provider, not stored by us).
- Song brief data: information you provide to create a song, which may include a child's first name, age range, hobbies, personality traits, occasion and short personal memories.
- Usage data: essential session cookie and, with your consent, analytics data (see our Cookie Policy).
- Sharing data: email addresses you enter to invite others, and comments/guestbook messages left on a song's public page.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create your account and provide the service | Performance of a contract (6.1.b) |
| Produce, review and deliver the personalised song | Performance of a contract (6.1.b) |
| Process payments and keep accounting records | Legal obligation (6.1.c) |
| Send service communications | Contract / legitimate interest (6.1.f) |
| Analytics and marketing cookies | Consent (6.1.a) |
| Save your creative profile for future orders | Consent (6.1.a) |
| Prevent misuse and ensure content safety | Legitimate interest (6.1.f) |
4. AI-assisted production & processors
Songs are produced with the help of third-party AI music technology combined with our own creative process and quality controls. To deliver the service we share the minimum necessary data with processors acting on our behalf, which may include: an AI music generation provider, cloud hosting, email delivery and payment processing. All processors are bound by data-processing agreements. Customers never interact with the AI directly.
5. International transfers
Some processors may be located outside the European Economic Area. Where that is the case, transfers are protected by adequacy decisions or Standard Contractual Clauses. You may request a copy of the safeguards at privacy@yourstoryyoursong.com.
6. Retention
- Creative brief data: deleted within 30 days of successful delivery and the end of any support period, unless you opt in to save your profile for future orders.
- Invoices and accounting records: kept for the period required by Spanish tax and commercial law.
- Account data: kept while your account is active; deleted on request or after prolonged inactivity.
- Public comments: kept while the shared page is active or until removal is requested.
7. Your rights
You may exercise the rights of access, rectification, erasure, restriction, portability and objection, and withdraw consent at any time, by contacting privacy@yourstoryyoursong.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).
8. Public streaming pages
If you generate a share link or invite others, anyone holding that link can access the song's public page without logging in. Share links only with people you trust. You can ask us to disable a share link at any time.
9. Security
We apply appropriate technical and organisational measures, including password hashing, access controls, encryption in transit and restricted storage. No system is completely secure, but we work to protect your data and will notify you and the authorities of any breach as required by law.
10. Changes
We may update this policy. Material changes will be announced on this page with a new "last updated" date.