Privacy Policy (Datenschutzerklärung)

This policy is a courtesy translation of the German original (“Datenschutzerklärung”). German law governs; the German version is authoritative.

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

M&R Technologies UG (haftungsbeschränkt) An der Strusbek 12 22926 Ahrensburg Germany Email: moin@songmania.me

Songmania creates personal songs: you enter names and personal details, a language model writes the lyrics from them, a music service sets them to music. Personal data is generated along the way — including data about people who have never visited Songmania themselves, such as the person being celebrated. This policy describes, step by step, which data that is, what we process it for, who receives it and how long we keep it.

This website is hosted by netcup GmbH (Karlsruhe, Germany); the servers are located in Germany. When you access the site, the technically necessary data that every web server requires is processed: the IP address of the requesting device, date and time, the page requested, the browser type and the operating system. This data is processed in server logs in order to maintain operation and to be able to detect attacks and disruptions. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure and stable operation). Log data is deleted or anonymised after a few days.

To create a song, you enter details about the person being celebrated: their name, where applicable your relationship to them, the occasion and, voluntarily, personal details and memories. Added to this are the interface language, the desired singing language and the musical genre. We process these details in order to create and display the song (Art. 6 (1) (b) GDPR — performance of a contract or pre-contractual measures).

Please note: this also means you provide data about third parties — about the person being celebrated and about people mentioned in your input. This policy protects them in exactly the same way. By submitting the form you confirm that you are entitled to provide these details; for names and dedications among family, friends and colleagues that is regularly the case. If you share data of third parties with us, please make sure this does not conflict with their legitimate interests.

To prevent abuse (such as automated mass requests), we limit how many songs can be started per IP address and hour. For this purpose we store the IP address exclusively as a hash value: a non-reversible checksum from which the original IP address cannot be recalculated (SHA-256, truncated). We do not store plain-text IP addresses in the application. The legal basis is Art. 6 (1) (f) GDPR (abuse prevention). The hash value is stored with the song record and deleted together with it.

To download a song we ask for an email address. It unlocks the download and serves to restore your access if something goes wrong. No song and no other message is sent to this address: the notification that the song is ready goes automatically to the email address you provided during checkout. The field is voluntary; without it the download stays locked. The legal basis is your explicit consent (Art. 6 (1) (a) GDPR), which you actively give in the form. You may withdraw your consent at any time with effect for the future, for example by email to moin@songmania.me.

Payments are processed by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”). For this we process the email address you provide during checkout (the buyer email) and the transaction identifier of the payment. As product details of the order we additionally transmit the title of the song and the selected genres; the title is generated from your form input and usually contains the name of the celebrated person. Stripe additionally processes the payment data (card details, billing address, amount, currency) under its own terms and handles tax calculation and the receipt. The legal basis is Art. 6 (1) (b) GDPR; a data processing agreement is in place between us and Stripe. Details can be found in Stripe’s privacy policy: https://stripe.com/en-de/privacy.

The lyrics are generated with the AI language model Claude provided by Anthropic PBC (San Francisco, California, USA). For this we transmit your form input (names, occasion, personal details, singing language, genre) and the production brief to Anthropic. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract — without this processing there would be no song), combined with a data processing agreement. This involves a transfer to the United States; its lawfulness relies on the EU-US Data Privacy Framework, to which Anthropic is certified as a participating company. Details: https://www.anthropic.com/policies/privacy-policy.

The lyrics are set to music — vocals, instruments, recording — by a music service. This service runs on servers in the German netcup data centre; no transfer to a third country takes place. It processes the lyrics and the musical parameters (genre, length, language). The legal basis is Art. 6 (1) (b) GDPR; a data processing agreement is in place.

The email that informs you that your song is ready after your purchase is sent via the email service Resend, Inc. (San Francisco, California, USA). It goes to the email address you provided during checkout (the buyer email) — not to the voluntary address from the download step. For this purpose the recipient address, the subject line and the content of the message are transmitted to Resend. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR): without this message, a buyer who closes the page after paying would have no way back to their song. This involves a transfer to the United States; Resend also participates in the EU-US Data Privacy Framework. Details: https://resend.com/legal/privacy-policy.

netcup GmbH, Germany — hosting and provision of the website (data processing agreement). Anthropic PBC, USA — lyrics generation (data processing agreement, third country). Music service on servers in the German netcup data centre — music production (data processing agreement). Stripe Payments Europe Ltd., Ireland — payment processing (data processing agreement, EU). Resend, Inc., USA — email delivery (data processing agreement, third country).

Your data is not sold. Without these service providers Songmania cannot deliver its service; these transfers are therefore contractually necessary.

Two service providers are based in the United States: Anthropic PBC (lyrics) and Resend, Inc. (email). The lawfulness of these transfers relies on the EU-US Data Privacy Framework (the European Commission’s adequacy decision), to which both companies are certified participants. In addition, data processing agreements are in place with both providers.

Form input, lyrics, audio recording and the IP hash value are stored for as long as the song is meant to remain accessible — you share links to the song page, and whoever opens the link should be able to hear the song. Deleting earlier would destroy the gift. We will delete a song and all associated details earlier on request; send an email to moin@songmania.me with the link or the name of the celebrated person.

We store the email address for the download for as long as the song remains accessible and delete it together with the song; you may withdraw your consent at any time.

Purchase-related data (buyer email address, payment transaction) must be retained longer under commercial and tax law; the regular period is ten years (§ 147 of the German Fiscal Code). In our processing these exist in reduced form (email address, payment transaction identifier); invoice data is held by Stripe.

At any time you have the right to receive free information about your stored personal data (Art. 15 GDPR), to have it rectified (Art. 16), erased (Art. 17), to restrict its processing (Art. 18) and to receive it in a common format (Art. 20 — data portability).

Where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object to that processing (Art. 21 GDPR). Consent you have given may be withdrawn at any time with effect for the future (Art. 7 (3) GDPR).

To exercise your rights, an email to moin@songmania.me is sufficient.

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Independent Centre for Privacy Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, https://www.datenschutzzentrum.de. You may also approach the supervisory authority at your place of residence.

We do not use cookies for visitors to this website. There are no analytics tools, no tracking, no advertising cookies and no externally embedded fonts — the fonts are served by the site itself. Everything stored about you is described in this policy; no cookie consent is therefore required.

The application’s only cookie is the session cookie of the internal admin area (songmania_admin); it is set only for administrator logins and does not affect visitors.

We do not process data in a system that makes automated decisions with legal effect or significantly affects you (Art. 22 GDPR). Creating a song is not such a decision.

The site and all forms are transmitted encrypted via HTTPS/TLS. Access permissions are limited to the people who need them for operation.

If laws, case law or our processing change, we will adapt this policy. The current version can always be found at https://songmania.me/en/datenschutz.