1. Who we are
Time for a Song is operated by Netlo Krzysztof Mrozowski, ul. Skłodowskiej 4/6, 49-304 Brzeg, Poland (VAT number PL7471886886, REGON 543210866) ("we", "us"). We are the data controller for the personal data described here. For privacy questions, contact hello@timeforasong.com.
2. What we collect
- Order details — recipient name, occasion, the story/description you write, song style and vocal preferences, and the generated lyrics.
- Contact data — your email address (to deliver the song and order updates).
- Photos — only if you choose the photo-slideshow add-on and upload them.
- Payment data — handled by our payment provider (see below); we do not store your card details.
- Technical & usage data — e.g. device/browser information and cookies (see our Cookie Policy).
3. How we use it & legal bases
- To create and deliver your song and provide the Service — performance of a contract.
- To send order-related and reminder emails — contract / legitimate interests; you can unsubscribe at any time via the link in each email.
- To process payments and meet tax/accounting duties — legal obligation, via our Merchant of Record.
- To measure and improve marketing — consent, where required (managed through the cookie banner).
- To publish and advertise with reaction videos you upload (recordings that contain image and voice) — your consent, which you can withdraw at any time for the future (see section 4); we keep proof of consent and of the declarations about other people in the video on the basis of our legitimate interest in defending claims.
- To invite you to upload a reaction video after delivery and to send the thank-you with your discount code — legitimate interest (collecting promotional content from our own customers); each such email has an unsubscribe link.
4. Photos, reaction videos & likeness consent
If you upload photos, you confirm you have the rights to them and the consent of every person shown (and, for minors, their parent or guardian) to display them on your song page. We use the photos solely to produce the slideshow you ordered, and we delete them according to our retention schedule.
Reaction videos. If you choose to upload a video of the song being given or heard, we process the file itself (the image, voice, words and surroundings of everyone in it), the optional caption, the email address and order it belongs to, and the date and scope of the consents you gave. We use the video only as described in section 10 of the Terms: on our websites, on our social media profiles and in our advertising (including paid ads on platforms such as Meta, Google and TikTok), on the basis of your consent. You are responsible for obtaining the consent of everyone who appears or can be heard in the video (for minors, their parent or guardian); if you appear in a video and did not agree to it, email us and we will take it down. A video published in an ad or on social media is also processed by the platform operator (e.g. Meta Platforms Ireland Ltd., Google Ireland Ltd., TikTok Technology Ltd.) as an independent controller under its own privacy notice; the original file is stored privately on servers in the EEA. Authors of approved videos receive a discount code, and we say so wherever we show the videos. You can withdraw your consent at any time by emailing hello@timeforasong.com — as easily as you gave it; within 14 days we remove the video from our sites and profiles, stop ads that use it and do not use it in new material. Withdrawal does not affect earlier use or copies already shared onward by others.
5. Processors & sharing
We share data only with service providers who help us run the Service:
- Creem (creem.io) — international payment processing, tax and invoicing, acting as Merchant of Record and based outside your country. For transaction data Creem is an independent controller and processes it under its own privacy notice.
- Dodo Payments (dodopayments.com) — international payment processing, tax and invoicing, acting as Merchant of Record and based outside your country, likewise an independent controller for transaction data. Which provider applies depends on the payment method you select at checkout.
- Language-model providers (for the lyrics, wishes and supporting text) — whatever you typed into the form (names, your story, the description of the person) is sent to the model. We currently use OpenRouter, Inc. (USA) as the intermediary through which we call Anthropic (Claude) models and, if those are unavailable, OpenAI (GPT) and Google (Gemini) models. As a backup we use kie.ai (a proxy to the same model families) and Anthropic PBC directly. At the intermediary we have disabled routing to providers that log prompts or train on them, and we require zero data retention.
- Suno, Inc. (USA) — generates the music and the vocal track from the lyrics and style description.
- Hosting and email providers — Hetzner Online GmbH (Germany, the production server) and Hostido (Poland, email), both inside the European Economic Area.
- Server-side advertising measurement — once an order is paid, our server sends a purchase event to Meta Platforms Ireland Ltd. (Conversions API) and Google Ireland Ltd. (Measurement Protocol and offline conversion import): a one-way hash of your email address, and for invoices issued to an individual also hashed first name, surname, city and postcode, plus your IP address, the browser/ad-click identifier and the order id and value. This happens regardless of your cookie settings, on the basis of our legitimate interest in measuring our own advertising; you can object using the contact details in section 9.
- Analytics and advertising scripts in your browser (Google Analytics, the Google Ads tag, the Meta pixel) — only with your consent in the cookie banner, which you can change or withdraw at any time.
- Advertising and social platforms (Meta, Google, TikTok and similar) — for reaction videos you agreed to have published in our ads or on our profiles; these platforms act as independent controllers.
The specific providers in the “language models” category can change — when one has an outage or we end the contract, the next one listed above takes over. We record which provider handled a given order, so if you ask us under Article 15 GDPR we can tell you per order. We will also send the current list on request.
We never sell your personal data.
6. International transfers
Some providers are located outside the European Economic Area, mainly in the United States: the AI providers (OpenRouter, Anthropic, Suno, kie.ai and, in the backup chain, OpenAI and Google) and the Merchant of Record payment providers (Creem, Dodo Payments). Where data is transferred internationally we rely on the safeguards GDPR provides — standard contractual clauses, or an adequacy decision of the European Commission (for US providers certified under the Data Privacy Framework). For language models we additionally require that your content is neither logged nor used to train models.
7. Retention
Song files and uploaded photos are kept online for 365 days (one year), counted from the payment date. Before the period ends we send a reminder; afterwards the files stay available to download for another 7 days and are then permanently deleted (access can be extended). You can download your files at any time to keep them. Order and billing records are kept as long as required for legal and accounting purposes. Reaction videos are kept for the licence period (5 years from upload) or until you withdraw consent, whichever comes first; afterwards we delete the video and its working copies and keep only proof of consent and withdrawal for as long as claims could be raised.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete or port your data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, email hello@timeforasong.com. You may also complain to your local data protection authority.
9. Changes & contact
We may update this policy; the current version is always shown here with its "last updated" date. Questions? Email hello@timeforasong.com.