Privacy Policy
Last updated
This policy explains how P.O.S. (sole trader, trading as MerrySongs), Tax ID available on request, Madrid, Spain (“MerrySongs”, “we”) processes personal data when you use merrysongs.com. We are the data controller. Contact: hello@merrysongs.com.
We follow a simple rule: we ask for the minimum, use it only to make and deliver your song, and delete it quickly.
1. Data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Contact data | Your email address; recipient email if you schedule delivery | You |
| Song details | First names, relationship, up to 3 memories or achievements, age (for children’s songs), wish to Santa, style, voice type, optional pronunciation hint | You |
| Photos (Song + Video only) | 6–12 photos you upload | You |
| Order data | Product, price, order status, delivery date; we do not see or store your card details | You and our merchant of record |
| Technical and usage data | IP address, device and browser type, pages viewed, events (e.g. preview played, checkout started) | Your device, cookies and similar technologies (see Cookie Policy) |
| Support messages | Anything you write to us | You |
Children’s data. The Service is for adults (18+). If you order a song for a child, you, as an adult, enter a small amount of information about the child: first name, age, a few achievements and their wish to Santa. Please do not include surnames, addresses, school names, photos that reveal locations, health information or any other sensitive data. We never knowingly collect data directly from children, and we never create accounts for children. If we learn that a child has used the Service, we delete the data.
2. Why we use it and our legal basis (GDPR / UK GDPR)
| Purpose | Legal basis |
|---|---|
| Generate your preview and song, render your video, deliver them, and handle regenerations and support | Performance of a contract (Art. 6(1)(b)); for the details you give us about other people, including children, our legitimate interest in providing the gift you requested (Art. 6(1)(f)), relying on your confirmation that you are entitled to share them |
| Send the preview email and up to two reminder emails (1 h and 24 h) about your unfinished order | Legitimate interest (Art. 6(1)(f)); you can opt out with one click |
| Marketing emails about future songs (e.g. Valentine’s Day) | Consent (Art. 6(1)(a)), or for existing customers soft opt-in where permitted; unsubscribe at any time |
| Analytics and advertising measurement (PostHog, Meta Pixel and Conversions API) | Consent through the cookie banner (Art. 6(1)(a)) |
| Accounting, tax and legal obligations | Legal obligation (Art. 6(1)(c)) |
| Preventing abuse and keeping the Service secure, including automated content filters | Legitimate interest (Art. 6(1)(f)) |
We do not sell your personal data, and we do not use your content to train AI models. Our paid AI providers are contractually barred from using it to train their models (see section 4).
3. How long we keep it
| Data | Retention |
|---|---|
| Photos | Deleted automatically 30 days after upload |
| Form texts (names, memories, achievements, wishes, pronunciation hints) | Deleted automatically 90 days after submission |
| Generated song, lyrics, video and gift page | Available for 12 months so you can download and share them, then deleted; or earlier if you ask |
| Email address of non-buyers (preview only) | Until you unsubscribe, or 6 months after your last interaction |
| Order and invoicing records | As long as required by tax law (in Spain generally 4–6 years); these records do not include song details |
| Analytics data | 12 months, pseudonymised |
You can ask us to delete your data, including your song, earlier at any time (section 7).
4. Who processes it for us (processors) and recipients
We use the following providers, who process personal data on our behalf under data processing agreements:
| Provider | Role | Location / transfer safeguard |
|---|---|---|
| Vercel Inc. | Website and API hosting | USA – EU-US Data Privacy Framework (DPF) / SCCs |
| Supabase Inc. | Database and file storage | EU and US – DPF / SCCs |
| Trigger.dev (Trigger.dev Ltd) | Background job queue | UK/EU – adequacy / SCCs |
| Google LLC / Google Ireland (Gemini API, Lyria, image model) | Lyrics, music and cover image generation (paid tier: no training on your data) | EU/USA – DPF / SCCs |
| ElevenLabs Inc. (if used) | Music generation | USA – DPF / SCCs |
| Anthropic PBC (if used) | Lyrics generation | USA – DPF / SCCs |
| Fly.io Inc. / Railway Corp. | Video rendering | USA/EU – DPF / SCCs |
| Resend Inc. | Transactional emails | USA – DPF / SCCs |
| PostHog Inc. | Product analytics (with consent) | EU and US – DPF / SCCs |
Independent controllers:
- Link (Sold through Link, a Stripe company), our merchant of record, which processes your payment, billing and tax data under its own privacy policy.
- Meta Platforms Ireland Ltd, for advertising measurement through the Meta Pixel and Conversions API (only with your consent). We are joint controllers with Meta for the collection and transmission of this data.
We may also disclose data where required by law or to protect our rights.
5. International transfers
We use processors in the EU and the US. Where a provider is located outside the European Economic Area, we rely on an adequacy decision (including the EU-US Data Privacy Framework for certified companies) or on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable).
6. Automated processing
Your song is generated automatically by AI, and an automated filter blocks offensive content, celebrity names and existing song lyrics. This processing does not produce legal or similarly significant effects on you. If a request is blocked, you can contact us for a human review.
7. Your rights
Depending on where you live, you have the right to access, rectify, erase, restrict, object, data portability, and to withdraw consent at any time. Write to hello@merrysongs.com; we answer within one month.
- EU: you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es) or your local authority.
- UK: the Information Commissioner’s Office (ico.org.uk).
- US residents (e.g. California): we do not sell or “share” personal data for cross-context behavioural advertising without consent, and you may request access or deletion.
- Australia / New Zealand / Canada: you may access and correct your data and complain to the OAIC, the NZ Privacy Commissioner or the OPC.
8. Security
We use encryption in transit, private storage with signed time-limited links, access controls and automatic deletion. No system is 100% secure; we will notify you and the authorities of any breach as required by law.
9. Changes
We will post any changes here with a new date. Material changes will be notified by email where appropriate.
10. Contact
P.O.S. (sole trader, trading as MerrySongs) · Madrid, Spain · hello@merrysongs.com