Skip to content
Song Wrappio
Create

Privacy

Privacy Policy

  1. [LEGAL REVIEW] Who is responsible for your data

    [COMPANY] runs Song Wrappio and is the controller of the personal data described here. Write to [DSAR EMAIL] about anything on this page, or to [SUPPORT EMAIL] about anything else.

  2. [LEGAL REVIEW] What we collect

    Your email address, when you ask for a sign-in link or buy a song. Your quiz answers, including the recipient's first name, your relationship to them and anything you write in your own words, because those become the song. The recipient's name and email address, if you schedule a gift. Payment records from Stripe: amounts, currency and payment identifiers, never your card number. Usage events, such as which step of the quiz you reached, only if you allow analytics. And a keyed hash of your email address and IP address for rate limiting, which we cannot turn back into the original.

  3. [LEGAL REVIEW] Why we use it, and on what basis

    We use your answers and your email to make and deliver what you ordered and to sign you in (performance of a contract). We keep payment and credit records because tax and accounting law requires it (legal obligation). We moderate free text, count requests and watch for abuse to keep the service safe and working (legitimate interests). We measure the funnel only with your consent, which you can withdraw at any time below. We do not sell personal data, and we do not use it to train AI models.

  4. [LEGAL REVIEW] Who handles data for us

    Google (Gemini for lyrics, Lyria for music), MiniMax through fal.ai (music), Stripe (payments), Resend (email), Cloudflare R2 (audio storage), Neon (database), Vercel (hosting), Inngest (background jobs) and Sentry (error monitoring). Each of them acts on our instructions under a data-processing agreement. Your quiz text reaches the AI vendors so that a song can be written; your email address does not.

  5. [LEGAL REVIEW] How long we keep things

    We delete a song you have not paid for, and its audio, 30 days after you make it. A song you have paid for stays while your account exists, so you can play it again. We delete analytics events after 13 months. Sign-in links expire after 15 minutes and we clear their records within a day; sessions last 30 days. Gift records live as long as the song does. We keep orders and credit records for as long as tax law requires, with your account details removed from them once you delete your account. We also keep content-safety records — a short excerpt of the text that was submitted and the classifier's verdict on it, with no link to your account — for 13 months, so that abuse can still be recognised when it comes back.

  6. [LEGAL REVIEW] Your rights, and how to use them

    You can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, and take it elsewhere in a portable form. The fastest route to deletion is the delete button on your account page, which removes your account, your songs and their audio straight away. Deletion has one exception: the content-safety records above — a short excerpt and a verdict, unlinked from your account — are kept for 13 months, because the ability to recognise abuse cannot depend on the person who committed it deleting their account. For anything else write to [DSAR EMAIL]: we answer within 30 days and ask for no more than enough to show the account is yours. You can also complain to your local data protection authority.

  7. [LEGAL REVIEW] Cookies and what this site stores

    This site stores four things in your browser, and only the last needs your permission. A session cookie keeps you signed in. Your answer to the cookie question is kept so that we stop asking it. While you are filling in the quiz, your draft — the recipient's name, your answers and anything you have written in your own words, never your email address — is held in session storage so that a refresh does not lose it, and it goes when you close the tab. And if you allow analytics, we keep our own session key: a random string that ties your steps together and says nothing about who you are. There are no third-party tracking or advertising scripts on this site. Withdraw your consent at any time with the control below, which clears the key as well as the choice.

  8. [LEGAL REVIEW] Children

    The service is for people aged 13 and over, and we ask you to confirm that before a song is made. A song is often about a child, for a birthday or a new baby, and those details live only inside the song and the answers that made it, which are deleted together with it. We do not knowingly collect data from a child under 13; write to [DSAR EMAIL] if you believe we have and we will delete it.

  9. [LEGAL REVIEW] AI, watermarks and provenance

    Every song is generated by AI, and we say so on every player and every share page. The audio carries the engine's own inaudible watermark, SynthID for music generated by Google, which we preserve rather than re-synthesise, plus a machine-readable provenance record naming the generator, the engine and the model and published at the song's own provenance address. We never pass a generated song off as a human performance.

  10. [LEGAL REVIEW] Where your data goes

    We and our processors operate in the United States and the European Union, so your data may be transferred outside the country you live in. Where that happens from the UK or the EEA, the transfer relies on the European Commission's standard contractual clauses or on an adequacy decision, and our processors are bound by them.

  11. [LEGAL REVIEW] Changes to this policy

    We will post any change on this page and say what changed. If a change materially affects how we use your data, we will tell you by email before it takes effect.

Analytics on this browser: not chosen yet.