Privacy Policy (Datenschutzerklärung)

This policy is a courtesy translation of the German original (“Datenschutzerklärung”). German law governs; the German version is authoritative.

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

M&R Technologies UG (haftungsbeschränkt) An der Strusbek 12 22926 Ahrensburg Germany Email: moin@songmania.me

Songmania creates personal songs: you enter names and personal details, a language model writes the lyrics from them, a music service sets them to music. Personal data is generated along the way — including data about people who have never visited Songmania themselves, such as the person being celebrated. This policy describes, step by step, which data that is, what we process it for, who receives it and how long we keep it.

This website is operated in a data centre in Germany; the servers are located exclusively in Germany. When you access the site, the technically necessary data that every web server requires is processed: the IP address of the requesting device, date and time, the page requested, the browser type and the operating system. This data is processed in server logs in order to maintain operation and to be able to detect attacks and disruptions. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure and stable operation). Log data is kept for no longer than 30 days and is deleted afterwards.

To create a song, you enter details about the person being celebrated: their name, where applicable your relationship to them, the occasion and, voluntarily, personal details and memories. Added to this are the interface language, the desired singing language and the musical genre. We process these details in order to create and display the song (Art. 6 (1) (b) GDPR — performance of a contract or pre-contractual measures).

Please note: this also means you provide data about third parties — about the person being celebrated and about people mentioned in your input. This policy protects them in exactly the same way. By submitting the form you confirm that you are entitled to provide these details; for names and dedications among family, friends and colleagues that is regularly the case. If you share data of third parties with us, please make sure this does not conflict with their legitimate interests.

To prevent abuse (such as automated mass requests), we limit how many songs can be started per detected IP address and hour. In the song record we do not store the plain-text IP for this purpose, but a SHA-256 hash truncated to 32 characters and using a fixed Songmania prefix. This value is used to compare requests and remains pseudonymous personal data; particularly for IPv4 addresses, the limited possible address space means it is not anonymous or guaranteed to be irreversible. The legal basis is Art. 6 (1) (f) GDPR (abuse prevention). The hash is stored with the song record and deleted together with it. This is separate from the server logs above and — if you select the voluntary marketing box — the plain-text IP proof below.

After the form and before the waiting screen, we ask for a valid email address. The regular creation flow does not proceed to the waiting screen without this required information. We use the address for any completion notice that becomes due, to prefill Stripe Checkout (it is not transmitted to PayPal) and, after a purchase, as the controlling address for the delivery email containing access to the song and, when paying via PayPal, for the purchase confirmation. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures and performance of the contract); there is therefore no separate consent box for this required field.

Only where an older or technically incomplete song record exceptionally has no flow address does the download gate ask for it again and require consent to storage (Art. 6 (1) (a) GDPR), which you can withdraw with effect for the future by emailing moin@songmania.me. We additionally store the time the address was last captured and the number, but not the content, of address changes. A different address can be entered no more than three times before purchase and is locked after purchase; this protects the song from being redirected to someone else’s inbox without authority (Art. 6 (1) (f) GDPR).

While your song is being created and while the owner result page remains open, we store a coarse browser activity timestamp on a 30-second grid. We also store when the finished result page is first opened and when an advance notification was sent successfully. These details are used exclusively to decide whether a one-off message is still due three minutes after completion: it is suppressed if you remain present or have already opened the result page. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures); the timestamps remain stored with the song record.

Below the email field you can additionally and expressly voluntarily tick a box indicating that you would like to occasionally receive news and offers from Songmania by email. This checkbox is unticked by default and has no effect on the further process — whether ticked or not. The legal basis is exclusively your consent (Art. 6 (1) (a) GDPR).

If you tick the checkbox, we first send an advertising-free confirmation email containing a confirmation link (double opt-in procedure). The consent becomes effective only after you open that link and submit the confirmation on the page using its button. The confirmation link is valid for 72 hours; after that, confirmation is no longer possible and a standalone signup that was never confirmed is deleted by the regular cleanup process. Per email address we send at most three such confirmation emails within 24 hours.

For proof we store the email address and related song, language and form source, the opt-in, sending, confirmation and, where applicable, withdrawal times, sending attempts, the exact wording and version identifier, separate random confirmation and withdrawal tokens and — where it can be determined through the trusted proxy chain — the IP address in plain text and user agent at opt-in. To enforce the recipient-level sending limit we also store the start and count of the 24-hour window for each address. If consent is given again after withdrawal, the superseded proof remains in a history. This data serves to prove consent under Art. 7 (1) GDPR and protect against abusive confirmation-email sending; the legal basis is Art. 6 (1) (f) GDPR.

You may withdraw this consent at any time with effect for the future — via the withdrawal link contained in the confirmation email and in every marketing email, or informally by email to moin@songmania.me. After a withdrawal we send no further marketing emails to that address; the proof data about the withdrawal itself remains for documentation purposes.

Payments are processed through Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”); Songmania remains the merchant and contracting party. We transmit the flow address as a prefill, the song title (which regularly contains the name of the celebrated person), selected genre(s), offer and version identifier, internal song and session keys, price and currency. In Checkout, Stripe collects the email address entered there, payment method and payment data, and the address and tax details needed for Stripe Tax and the invoice. Songmania receives in particular the checkout email, payment status, amount, currency, tax/invoice status and Stripe identifiers; we do not receive full card or bank-account details. Stripe calculates the tax and creates the invoice or receipt. The legal basis is Art. 6 (1) (b) GDPR. Where Stripe processes data on our behalf, the agreed data-processing terms apply; Stripe processes data for its own legal obligations under its own responsibility. Details: https://stripe.com/en-de/privacy.

Alternatively, you can pay via PayPal. The payment is then processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (“PayPal”); Songmania remains the merchant and contracting party here too. As soon as the song page with the purchase area loads, your browser retrieves the script for the PayPal button from PayPal; PayPal thereby receives your IP address and technical details of your browser. When you buy, we transmit to PayPal the song title (which regularly contains the name of the celebrated person) with the selected genre, the offer and internal song and version identifiers, price, currency and the order language; your email address is not transmitted. The payment itself takes place in the PayPal window; PayPal collects your login and payment data there under its own responsibility. Songmania receives the payment status, amount, currency, the PayPal identifiers of the order and the payment, the email address stored in your PayPal account and the country of your billing address; we need the country to allocate VAT, because unlike Stripe, PayPal does not calculate tax. In this case you do not receive a receipt from PayPal but a purchase confirmation from Songmania, sent to the address you gave when creating the song. The legal basis is Art. 6 (1) (b) GDPR; PayPal processes the data as an independent controller. Details: https://www.paypal.com/en/legalhub/privacy-full.

The lyrics are generated by a provider of AI language models. Only the song details are transmitted for this: the form input (first name of the celebrated person, occasion, personal details), singing language, genre, intended length and the production brief. Your email address, your IP address and any account or payment data are not sent along; in our assessment, the transmitted details do not allow the provider to identify a particular person. The generated lyrics may be sent to the same provider in further narrowly scoped calls for language correction and shortening of overlong lines. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures — without this processing there would be no song), combined with a data processing agreement. The provider is based in the United States; the transfer relies on an adequacy decision of the European Commission or on standard contractual clauses.

The lyrics are set to music — vocals, instruments and recording — by a music production service. This service runs on servers in a data centre in Germany; no transfer to a third country takes place. It processes the lyrics and production description as well as singing language, length, tempo and technical generation parameters. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures); a data processing agreement is in place.

We send four kinds of messages through an email delivery provider: the advertising-free double-opt-in confirmation when the marketing box is selected; a one-off message three minutes after completion if you have left the waiting screen and have not yet opened the result page; after purchase, the delivery email with the link to the purchased version or both versions; and, after a payment via PayPal, the purchase confirmation with the contract details (for payments via Stripe, the invoice sent by Stripe covers this). The latter three go to the flow address stored before waiting; only for legacy records without that address is the address captured by the payment provider used as a fallback.

The recipient address, subject and message content, including the song title and access or consent link, are transmitted to the delivery provider. In our database we store successful sending times and, for the double-opt-in email, the limited number of sending attempts. The legal basis for the confirmation email is Art. 6 (1) (a) GDPR; for the advance and delivery emails it is Art. 6 (1) (b) GDPR. The provider is based in the United States; the transfer relies on an adequacy decision of the European Commission or on standard contractual clauses.

To the email address saved while waiting or at the download we send reminders about your own song while it can still be purchased, and once between seven and fourteen days after a purchase a mail asking whether someone else deserves a song; the “song is ready” mail then also names the price and the purchase deadline. The legal basis is section 7(3) of the German Unfair Competition Act (UWG) together with Art. 6(1)(f) GDPR (legitimate interest in direct marketing to existing customers). We point out the right to object when the address is collected and in every one of these mails; an address collected without that notice receives no reminders. Stored on the song record are the time the notice was shown, the number and time of reminders sent, an objection token and the time of an objection; links in the mails carry a campaign tag without personal data. The recipient is the mail delivery provider, as for all other mails. Before a purchase at most four reminders go out within the 14-day purchase window and none after it; none go out after a refund, to an undeliverable address, or for songs created before 12 September 2026. You can object at any time with one click in every mail or informally at moin@songmania.me, at no cost beyond the basic transmission rates. An objection applies to every song of that address, including songs created later, and is stored as proof. The marketing consent for news and offers is separate from this.

On the result page you can activate a share link. We store a random token and the on/off state for this purpose. Anyone who knows the resulting public address can, without signing in, access the title, genre, a cover derived from the song identifier and the enabled audio streams; the share page does not offer the full written lyrics or a file download. Without activation the address responds like a link that does not exist. Switching it off makes the page unavailable, but the token remains stored with the song so the same previously sent link works again if re-enabled. The legal basis is Art. 6 (1) (b) GDPR; the feature is optional and initiated by you.

A data centre in Germany — hosting and provision of the website (data processing agreement). A provider of AI language models based in the USA — lyrics generation and revision (data processing agreement, third country). A music production service on servers in a data centre in Germany — music production (data processing agreement). Stripe Payments Europe Ltd., Ireland — payment, tax and invoice processing (processor or independent controller depending on the processing). PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg — payment processing for payments via PayPal (independent controller). An email delivery provider based in the USA — email delivery (data processing agreement, third country).

Your data is not sold. Without these service providers Songmania cannot deliver its service; these transfers are therefore contractually necessary. We will tell you which companies are behind these categories on request to moin@songmania.me.

Data is transferred to service providers based in the United States for lyrics generation and for email delivery. The lawfulness of these transfers relies on an adequacy decision of the European Commission or on standard contractual clauses, and on data processing agreements. According to its privacy information, Stripe may involve affiliates and subprocessors outside the European Economic Area; Stripe explains the safeguards used for those transfers at https://stripe.com/en-de/privacy. The same applies to PayPal, which may transfer data to affiliates outside the European Economic Area, in particular in the USA; PayPal explains the safeguards at https://www.paypal.com/en/legalhub/privacy-full.

Songs, audio recordings and the associated data — form input, lyrics, production parameters, IP hash, flow address, capture/presence/page-opening and sending times, and the share token and status — remain stored even after the song page has been closed at the end of the 14-day preview and purchase period, until Songmania deletes them or you request erasure. We deliberately do not name a fixed deletion period, because we do not want to promise one that operations do not keep. You can request erasure at any time (Art. 17 GDPR): email moin@songmania.me and include the link or the name of the celebrated person, and we will then delete the song and the associated details except where statutory retention duties prevent this. Those duties concern above all the purchase-related invoice data set out below.

An unconfirmed marketing signup can be confirmed for 72 hours and is then deleted in the cleanup process that runs regularly every six hours, provided it carries no history that must be retained. Confirmation-email quota records are cleaned up after their 24-hour window expires.

We keep proof data for confirmed marketing consent for as long as the consent remains in force and beyond that for as long as we must be able to prove its grant or withdrawal under Art. 7 (1) GDPR. Withdrawal ends future marketing emails but does not immediately erase proof of whether and when it was declared.

We store purchase-related data for the applicable commercial and tax retention periods. This includes checkout email, price, currency, purchased version(s), payment, invoice and refund status, timestamps, and the session and payment identifiers of the payment provider (Stripe or PayPal), and for payments via PayPal additionally the country of the billing address and the time of your consent under § 7 of the terms; full invoice and payment-instrument data is held by the respective payment provider.

At any time you have the right to receive free information about your stored personal data (Art. 15 GDPR), to have it rectified (Art. 16), erased (Art. 17), to restrict its processing (Art. 18) and to receive it in a common format (Art. 20 — data portability).

Where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object to that processing (Art. 21 GDPR). Consent you have given may be withdrawn at any time with effect for the future (Art. 7 (3) GDPR).

To exercise your rights, an email to moin@songmania.me is sufficient.

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Independent Centre for Privacy Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, https://www.datenschutzzentrum.de. You may also approach the supervisory authority at your place of residence.

We do not use cookies for visitors to this website. There are no external analytics tools, no advertising cookies, no pixels and no externally embedded fonts — the fonts are served by the site itself. Everything stored about you is described in this policy; no cookie consent is therefore required.

When you visit the site through an advertising or partner link, source information may appear in the address, for example source, ref, the usual utm_ parameters or advertising-network click identifiers such as gclid or fbclid. We store this information with the generated song, as well as the path of the entry page and, where available, the referring external website. This allows us to understand how an order came about and to evaluate our own advertising in economic terms. The legal basis is our legitimate interest under Art. 6 (1) (f) GDPR in economically evaluating our own advertising. For this purpose, we do not set a cookie, assign a visitor identifier or recognise you across multiple visits. During the current browser session, the value is held in the browser’s sessionStorage so it is not lost when moving between pages; it is discarded when the tab is closed. We store the information for as long as the associated song record is stored (see “Storage period”). We do not disclose source information to advertising partners or to any other third parties beyond the recipients and processors named under “Recipients of your data at a glance”; it is stored with the other order data and subject to the same recipients and processors, except that we do not transmit source information to Stripe or PayPal. You may object to this processing at any time (Art. 21 GDPR).

To allow you to continue a multi-step creation form after reloading the page, the form stores values you enter, genre, singing language, voice preference and the current step in your browser’s localStorage. This local temporary storage serves that purpose alone, does not itself leave your browser and cannot be accessed by us. Only when you submit the form do you deliberately send the information you entered to us; we store it as order data, as described above under “Creating your song (form input)”. This is not a cookie, and the data is not deleted automatically. You can delete it by clearing your browser data.

The application’s only cookie is the session cookie of the internal admin area (songmania_admin); it is set only for administrator logins and does not affect visitors.

Songmania pseudonymously records interaction steps in the creation and purchase flow in order to identify abandonment and technical difficulties and improve the service. We store the relevant step and time, device type, occasion and source parameters. We do not use cookies for this purpose, store no identifier on your device and collect neither your IP address nor names, email addresses or form input. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in improving the service). The measurement data is deleted after 400 days.

We do not process data in a system that makes automated decisions with legal effect or significantly affects you (Art. 22 GDPR). Creating a song is not such a decision.

The site and all forms are transmitted encrypted via HTTPS/TLS. Access permissions are limited to the people who need them for operation.

If laws, case law or our processing change, we will adapt this policy. The current version can always be found at https://songmania.me/en/datenschutz.