Privacy Policy

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

Connect Minds GmbH
Ferdinand-Koch-Str. 31, 26133 Oldenburg, Germany
Managing director: Joshua van Vliet
Amtsgericht Oldenburg, HRB 223605
Email: info@customsongstory.com

If you have questions about the processing of your personal data or want to exercise your rights, please use the contact details above. We usually handle requests within the statutory period of one month (Art. 12(3) GDPR). We are not legally required to appoint a data protection officer.

2. Legal bases and storage period

Where we obtain consent, Art. 6(1)(a) GDPR serves as the legal basis. Art. 6(1)(b) GDPR applies to the performance of a contract or pre-contractual measures. Art. 6(1)(c) GDPR serves to fulfill legal obligations, and Art. 6(1)(f) GDPR to protect legitimate interests. We only store personal data for as long as is necessary for the respective purpose or required by statutory retention periods (in particular § 257 HGB, German Commercial Code, and § 147 AO, German Fiscal Code; usually six or ten years for commercial and tax records).

3. Provision of the website and server log files

Each time the website is accessed, our hosting provider's system automatically records technically necessary data: IP address (shortened where possible), date and time of access, URL accessed, HTTP status code, amount of data transferred, referrer URL, and browser and operating system information. Processing is based on Art. 6(1)(f) GDPR; our legitimate interest lies in the functionality, stability and security of our service. Log files are usually deleted after 14 days.

4. Hosting and audience measurement by Vercel

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel processes the technically necessary connection data to deliver the content. We have a data processing agreement with Vercel in accordance with Art. 28 GDPR. Data is transferred to the USA; Vercel is certified under the EU-U.S. Data Privacy Framework, and EU standard contractual clauses under Art. 46(2)(c) GDPR also apply. The legal basis is Art. 6(1)(f) GDPR.

We also use Vercel Web Analytics, an audience measurement service built into the platform. It works without cookies and without accessing information on your device, and it does not create a cross-device user identifier; this means we cannot identify individual visitors. The legal basis is Art. 6(1)(f) GDPR. More information: vercel.com/legal/privacy-policy.

To display the website, we use the fonts "Plus Jakarta Sans" and "Bricolage Grotesque" (Google Fonts). These fonts are embedded locally when the website is built and are delivered from our own server or by our hosting provider. As a result, no connection to Google servers is established to load the fonts, and no personal data (in particular no IP address) is transmitted to Google for this purpose.

5. Database and file storage by Supabase

To store your order data, the information you provide in our questionnaire and the audio files created, we use Supabase, operated by Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992. We have a data processing agreement with Supabase in accordance with Art. 28 GDPR. Our database is operated in the Frankfurt am Main region, so the data is stored within the European Union. In particular, we store: email address, name of the person the song is for, the information you provided (occasion, style, your story), order status, payment reference, the song files and cover images generated, and, if you order a plaque, also your shipping address and, if provided, your phone number, as well as the history of your inquiries to our customer support and the information from a cancellation notice. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR. More information: supabase.com/privacy.

6. Creating your custom song (AI services)

To compose your song, we process the information you provide with the help of specialized service providers:

• Suno for setting the song to music, that is, for music and vocals. The music model is operated by Suno, Inc., USA. Technical access is provided by the service sunoapi.org, which forwards our request to Suno. The finished lyrics and the style details (such as genre, mood and vocal range) are transmitted.
• OpenRouter (OpenRouter, Inc., USA) for all text parts: the lyrics, the title, the lyrics preview and the image description for the cover. OpenRouter is an intermediary service that forwards the request to an underlying AI language model; the respective model providers (currently Anthropic, Google and OpenAI) may also be based in the USA. Privacy information: openrouter.ai/privacy.
• Cover image: we create a cover image for every song. For this, the first name of the person the song is for, the occasion and an image description derived from them are transmitted to an image model, which we also access via OpenRouter.

We only transmit to these services the content information required to create the song (in particular the occasion, the person the song is for, style preferences and your story). Your email address and payment details are not transmitted to these services. The legal basis is Art. 6(1)(b) GDPR (performance of the contract concluded with you). Where data is transferred to the USA, we rely on EU standard contractual clauses under Art. 46(2)(c) GDPR and supplementary safeguards. We recommend not entering any particularly sensitive personal data about third parties in the free text fields.

7. Customer support: chat and email

Our website offers a support chat that answers with the help of AI. Your message, the conversation so far and, where applicable, the link to your order are transmitted to OpenRouter in order to answer you (see the previous section). We point out in the chat that an AI assistant is answering you. The legal basis is Art. 6(1)(b) GDPR for contract-related matters and otherwise Art. 6(1)(f) GDPR.

Our customer support mailbox info@customsongstory.com is hosted by Hostinger (Hostinger International Ltd., Cyprus). Your emails are stored and answered there. Some first replies are drafted with the help of AI; a person supervises this as well, and you can ask to be helped by a member of our team. The legal basis is Art. 6(1)(b) GDPR for contract-related matters and otherwise Art. 6(1)(f) GDPR.

8. Payment processing via Stripe

To process the one-time payment, we use Stripe (Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Dublin, Ireland; parent company Stripe, Inc., USA). The data required for payment is transmitted to Stripe, in particular name, email address, payment details (depending on the payment method selected), the amount and the order reference. Stripe acts partly as an independent controller (in particular for fraud prevention and compliance with legal obligations) and partly as a processor. The legal basis is Art. 6(1)(b) and (f) GDPR. Stripe is certified under the EU-U.S. Data Privacy Framework; EU standard contractual clauses also apply. Payment-related master data is stored for up to ten years within the statutory retention periods. More information: stripe.com/privacy.

Via Stripe, we offer payment by credit or debit card, including the payment services Apple Pay and Google Pay, as well as PayPal. If you choose PayPal, the payment is processed by PayPal, which is an independent controller for the processing that takes place within its area of responsibility. Privacy information: paypal.com/us/legalhub/privacy-full.

In order to calculate any applicable taxes correctly, we need to know the country of the order. If this is not already apparent from the information provided by our hosting provider, we determine it based on your IP address using the geolocation service ip-api.com. Only the IP address is transmitted; we receive back the country, region, ZIP code and city at a coarse level. The legal basis is Art. 6(1)(c) GDPR (tax obligations) and Art. 6(1)(f) GDPR.

9. Acrylic song plaque: printing and shipping

If you also order an acrylic song plaque, we need a shipping address. Printing and shipping are handled for us by the service provider Posterflow (shipping address: Markircher Str. 17, 68229 Mannheim, Germany). We transmit to Posterflow your name, the shipping address, your phone number if provided (for questions about the delivery), and the image file to be printed with your individual song design. DHL then handles transport; we use the tracking number to show you the delivery status. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). We have a data processing agreement with Posterflow in accordance with Art. 28 GDPR.

When you enter your shipping address, we suggest matching addresses. For this, the characters you have already typed are transmitted via our server to the address service Photon (komoot GmbH, Germany), which generates suggestions from them. Only the entries in the address field are transmitted, no other order data and not your IP address either. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR; our legitimate interest lies in avoiding incorrect delivery addresses. Using the suggestions is voluntary; you can always type the full address yourself.

10. Publication on streaming services

If you book the publication of your song, we pass the recording on to streaming services such as Spotify, Apple Music and Amazon Music via the distribution service provider Too Lost (Too Lost, LLC, USA). The song title, the audio file, the cover image and the information about the work required for publication are transmitted.

Please note: the published song is then publicly available worldwide and typically contains the first name of the person the song is for as well as content from the story you told. The cover image is also made publicly available for the publication. This processing takes place exclusively at your express request; the legal basis is Art. 6(1)(b) GDPR. If the song concerns a person other than yourself, please make sure that they agree to the publication. If you want to withdraw a track that has already been published, a message to info@customsongstory.com is enough; we will then arrange its removal from the stores. After removal, it may take some time for cached copies at the individual services to disappear.

11. Sending emails (order confirmation, delivery, cancellation)

We send the order confirmation, the delivery of your song and any cancellation confirmations by email via the service Resend (Resend, Inc., USA). In particular, your email address, the name of the person the song is for, the details of your order and the attached audio files or links are processed. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). We have a data processing agreement with Resend in accordance with Art. 28 GDPR; for the transfer to the USA, the safeguards described in section 22 apply. More information: resend.com/legal/privacy-policy.

12. Your email address in the questionnaire

If you enter your email address in our questionnaire before completing an order, we store it together with the information provided up to that point so that you can continue your order, to carry out pre-contractual measures and to deliver the finished song to you after an order. The legal basis is Art. 6(1)(b) GDPR and, where we remind you of an incomplete order, Art. 6(1)(f) GDPR. We only send you marketing emails, personal messages and recommendations about Sing a Blessing if you check the corresponding box; the legal basis for this is Art. 6(1)(a) GDPR. You can withdraw this consent at any time with effect for the future, free of charge, via the unsubscribe link in every email or by sending a message to info@customsongstory.com. The emails are sent via Resend (see the previous section).

13. Cookies and similar technologies

On singablessing.com, we use cookies and similar technologies such as local storage, pixels and tags. Some of them are technically necessary, for example to keep your questionnaire session and your order going. In addition, we use the analytics and advertising tools described in sections 14 and 15. These tools load automatically when you open a page of our website; we do not show a cookie banner. They help us understand how our website is used, improve the ordering process and measure whether our ads work. We use them on the basis of our legitimate interest in doing so (Art. 6(1)(f) GDPR). You can object to this at any time; section 16 explains how.

14. Analytics

• DataFast (DataFast, Marc Köhlbrugge, Netherlands; service at datafa.st) measures reach and how our website is used. For this purpose, DataFast stores a pseudonymous visitor and session identifier in your browser (cookies datafast_visitor_id and datafast_session_id) and processes in particular the pages visited, referrer, approximate geographic origin, device and browser information and any ad click identifiers (e.g. fbclid). The data is collected via a same-origin path on our domain. More information: datafa.st/privacy-policy.
• Microsoft Clarity, an analytics service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA (in the EU: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland), helps us understand how visitors use our website by analyzing usage behavior in the form of session recordings and heatmaps (e.g. mouse movements, clicks, scrolling) as well as aggregated statistics. In particular, a pseudonymous visitor identifier (cookie clarity_user_id), pages visited, referrer, device and browser information and interactions with the page are processed. Entries in form fields are masked by Clarity and are not recorded in plain text. More information: privacy.microsoft.com/privacystatement.
• Brevo's website tracker (Sendinblue GmbH (Brevo), Köpenicker Str. 126, 10179 Berlin, Germany) stores an identifier in your browser and records which pages you visit. If we already have your email address from the questionnaire, we link these page views to your contact at Brevo so that we can send you relevant messages that are not already out of date. More information: brevo.com/legal/privacypolicy.
• Our own measurement of the ordering process: we measure at which points in our ordering process visitors move forward and where they drop off, and we test individual versions of the page against each other (so-called A/B tests). We record the step reached, the version shown and the time, and store these events in our database (see section 5). So that the events of a visit can be combined, we store a random identifier in your browser (local storage) or, if available, use the DataFast visitor identifier. This identifier is pseudonymous and contains no information about you as a person.

15. Advertising and conversion measurement

We use the following services to measure whether our ads work and to avoid counting the same order twice. Some of these providers process data outside the EU, in particular in the USA; see section 22.

• Meta Pixel and Meta Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (parent company Meta Platforms, Inc., USA). In particular, device and browser information, IP address, pages visited, ad click identifiers, pseudonymous browser identifiers and actions performed (e.g. starting the questionnaire, checkout and completing an order) are processed. For an order, we may also transmit the order value, the order ID as an event identifier and your email address in hashed form to Meta in order to match browser and server events and avoid duplicate counting. With regard to the collection on our website and the transmission to Meta, we and Meta are joint controllers within the meaning of Art. 26 GDPR; the agreement is available at facebook.com/legal/controller_addendum. Meta is certified under the EU-U.S. Data Privacy Framework. More information: facebook.com/policy.php.
• TikTok Pixel and TikTok Events API of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland (parent company ByteDance Ltd.). In particular, pages visited, device and browser information, the IP address, the ad click identifier (ttclid) and actions performed in the questionnaire are processed. For an order, we also transmit the order value and your email address in hashed form so that browser and server events can be matched and duplicate counting avoided. Data is transferred to third countries, in particular the USA and Singapore. More information: tiktok.com/legal/privacy-policy.
• Google Ads of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company Google LLC, USA). This loads the Google tag (gtag.js), which stores an identifier in your browser and records which pages you visit after clicking one of our ads. For an order, we also transmit the order value, the click identifier (gclid) and your email address in hashed form ("enhanced conversions") so that Google can attribute the order to the original ad. Google is certified under the EU-U.S. Data Privacy Framework. More information: policies.google.com/privacy.
• Microsoft Advertising (Universal Event Tracking), offered by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (parent company Microsoft Corporation, USA). We use it to measure which of our ads in Bing search and the Microsoft advertising network lead to orders. The UET tag stores an identifier in your browser and records pages visited, device and browser information and actions performed, such as completing an order including the order value. More information: privacy.microsoft.com/privacystatement.
• Fastlane (usefastlane.ai): an attribution tag that matches visitors to the organic Instagram and TikTok posts published for us. The page view and its referrer are processed.

16. How to object to analytics and advertising tools

You can object to the use of the tools described in sections 14 and 15 at any time (Art. 21 GDPR). You have these options:

• In your browser: you can block or delete cookies and local storage, use a content blocker or browse in a private window. This prevents most of the browser-based tools described above from storing an identifier on your device.
• With the providers: you can manage how Meta, Google and Microsoft use your data for advertising in your settings with them (facebook.com/adpreferences, myadcenter.google.com, account.microsoft.com/privacy/ad-settings), and for TikTok in the privacy settings of the TikTok app. Many advertising companies also offer an opt-out through the tools of the Digital Advertising Alliance (optout.aboutads.info) and the Network Advertising Initiative (networkadvertising.org/choices).
• With us: you can send us your objection by email to info@customsongstory.com.

17. Cancellation of your order

If you exercise your right to cancel via our electronic cancellation function at singablessing.com/widerruf-erklaeren, we process the information you enter (first and last name, email address, order ID, time of the cancellation and an optional reason) to identify the order, to process your cancellation notice and to send you the confirmation. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR. We store the notice and the confirmation in line with our statutory obligations to keep records as evidence.

18. Contacting us

If you contact us by email at info@customsongstory.com or via our contact form at singablessing.com/kontakt, we process the information you send us (in the form: name, email address, order number if provided, and your message) exclusively to handle your request. The legal basis is Art. 6(1)(b) GDPR for contract-related inquiries and otherwise Art. 6(1)(f) GDPR.

19. Job applications

If you apply for one of our positions, we process the data you send us (resume, contact details, references and anything else you send us) exclusively to carry out the application process. The legal basis is § 26 Abs. 1 BDSG (German Federal Data Protection Act) in conjunction with Art. 88 GDPR and Art. 6(1)(b) GDPR. Your documents are only seen by the people involved in filling the position.

If you are not hired, we delete your documents no later than six months after the process has ended; we keep them that long so that we can provide evidence regarding possible claims under the AGG (German General Equal Treatment Act). If you want us to keep your documents for future positions, just let us know: we will then store them on the basis of your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time. Of course, if you ask us to delete them earlier, we will do so right away.

20. Your rights

Under the GDPR, you have in particular the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

The supervisory authority locally responsible for us is the Landesbeauftragte für den Datenschutz Niedersachsen (State Commissioner for Data Protection of Lower Saxony), Prinzenstraße 5, 30159 Hannover, Germany (lfd.niedersachsen.de). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).

Residents of certain US states, such as California, may have additional rights under the privacy laws of their state, in particular the right to access and delete their personal information and to opt out of the "sharing" of personal information for targeted advertising. You can exercise these rights by emailing us at info@customsongstory.com.

21. Children

Our service is not directed at children under the age of 13.

22. Data transfers to third countries

Where data is transferred to recipients outside the EU or the EEA, this is done in compliance with Art. 44 ff. GDPR. For transfers to the USA, we rely on the European Commission's adequacy decision under the EU-U.S. Data Privacy Framework if the recipient is certified, and otherwise on standard contractual clauses under Art. 46(2)(c) GDPR and supplementary safeguards.

23. Data security and changes

We take appropriate technical and organizational measures in accordance with Art. 32 GDPR and, as a rule, transmit data in encrypted form via HTTPS (TLS). We reserve the right to adapt this Privacy Policy so that it always meets current legal requirements. The current version is always available on this page.