Privacy Policy

Who is responsible

The controller for your personal data is [to be filled by owner], [to be filled by owner]. Email: aitaylorfan@gmail.com.

[

Owner: if the business is not established in the EU, appoint an EU representative (Art. 27 GDPR) and add it here: [to be filled by owner]. Delete this note if the business is in the EU.

]

What we collect and why

• Your email address. We create your account with it when you ask for your first preview, and send you sign-in links, the preview, the song, receipts and answers to your questions. Sign-in works with a link by email; there is no password. Legal basis: performing our contract with you (Art. 6(1)(b) GDPR).
• Your song details. The recipient's first name, how to pronounce it, who they are to you, the occasion, your story lines, and the style and voice you pick. We use them to write and record your song and keep them so you can see and download the song again. These details are about another person, so please only share what you are happy for the song to contain, and leave out sensitive details such as health, religion or sexual life. Legal basis: contract (Art. 6(1)(b) GDPR) and, for the details about the recipient, our and your legitimate interest in making the gift (Art. 6(1)(f) GDPR).
• Your songs. The lyrics and audio files we make for you, whether you have unlocked them, and the automatic check that the name was sung right. Legal basis: contract (Art. 6(1)(b) GDPR).
• Purchases. What you bought, the amount, the date, the order number and any refund. Card details go directly to Stripe; we never see or store them. Legal basis: contract, and our legal duty to keep accounting records (Art. 6(1)(c) GDPR).
• Photos for AI living photos (optional add-on). If you choose this add-on, the 3 photos you pick are uploaded to us and sent to the video model that animates them. Before upload you confirm that these are your photos, that everyone shown agreed, that you are the parent or guardian of any child shown, and that no one shown has passed away. Legal basis: contract (Art. 6(1)(b) GDPR); for the people shown, the consent you confirm on their behalf.
• Share links. If you turn on a share link, we store the link, the name and short note you add, and when the link was first opened. If you choose "Add this video to their link", we store the finished video file. The 15-second teaser link works the same way and stops after 14 days or when you switch it off. Legal basis: contract (Art. 6(1)(b) GDPR).
• Reviews. If you write a review of a song you bought, we store your rating, your text, the display name you choose and whether you agreed to publish it. A review appears on the site only if you agreed to publication and we approved it; we never hide a review for being negative, only for abuse or personal data. Legal basis: your consent for publication (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Occasion reminders (optional). If you ask us to remind you before an occasion, we store the recipient's first name, the occasion and its month and day. Legal basis: your consent (Art. 6(1)(a) GDPR).
• Technical data. IP address, browser and device type, and the pages requested, in server logs to keep the service secure and working. Legal basis: our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

The photo video is made in your browser: photos you use for it stay on your device and are not uploaded. Only the finished video file is uploaded, and only if you choose to add it to the share link.

Reaction videos and photos

If you choose "Film their reaction" on an unlocked song, you can upload one video or photo of the moment they heard it, with an optional short line and the name to show with it.

• What we store: the file, a still image taken from a video, your line, the display name you choose, who the song is for and the occasion (taken from the song), whether the song was a free song from a gift code, and the three boxes you ticked: that we may show it on our website, that everyone who can be seen or heard agreed to be shown publicly, and that no one under 16 is shown or a parent or guardian agreed.
• How we process it: our server re-encodes the file and removes its metadata, such as location and device details, before it is shown to anyone. The original upload is then deleted.
• Who sees it: you, and our team, who review it. It appears on our home page and reviews page only after we approve it. We may decline to show it for abuse, personal data, doubt about consent or a file that cannot be used, never for being unflattering.
• Labels: if your song was a free song from a gift code, given in exchange for honest feedback, your reaction and your review are labeled "Got a free song for sharing this"; otherwise a reaction is labeled "Verified purchase".
• Deleting it: you can delete it at any time on the song page. It comes off the site at once and the files are deleted. If the song is refunded, it is removed the same way.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by deleting the reaction; for the people shown, the consent you confirm you obtained from them.

[

Owner: a lawyer should confirm that the three confirmations are enough for showing other people's faces and voices in your markets, and whether the approved reactions may also be used in ads or social posts (this page only covers showing them on the website).

]

Emails we send

• Service emails: sign-in links, your preview and song, receipts and answers. These are part of the service and have no unsubscribe link.
• One review invite: a few days after you unlock a song (sooner if the recipient has opened the share link), we may send one email asking how it went. Legal basis: our legitimate interest in honest customer feedback (Art. 6(1)(f) GDPR). You can object at any time with the link in the email or by writing to us.
• Occasion reminders: only if you turned them on. A reminder goes out 21 days and 7 days before the occasion every year, and a note one year after you unlocked the song, if you chose that. Every reminder has a one-click unsubscribe link for that reminder or for all reminders, without signing in. You can also remove reminders under "My songs".

[

Owner: the review invite now has an unsubscribe link and one-click List-Unsubscribe. A lawyer should still confirm whether a review request needs prior consent in Germany (it is usually treated as advertising there).

]

Who processes your data for us

We use these service providers. They process data on our behalf and only for the purpose given:

• fal.ai (Features & Labels, Inc., USA): runs the AI models that make your song and videos. Through fal we use ElevenLabs Music (composing and singing the song), ElevenLabs Scribe (speech-to-text, to check the name was sung right), Kling AI Avatar (the AI singer video) and MiniMax (AI living photos). fal passes each request to the model and, for partner models, to that model's provider. They receive your song details, the generated audio and, for living photos, your 3 photos.
• OpenRouter (OpenRouter, Inc., USA), which passes the request to Google Gemini (Google): writing the lyrics, checking the name, and reading a story you type on the home page.
• Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA): payments.
• Resend (Resend, Inc., USA): sending our emails.
• Hosting and file storage: [to be filled by owner].
• Google Analytics 4 (Google Ireland Ltd. and Google LLC, USA) and Microsoft Clarity (Microsoft Ireland Operations Ltd. and Microsoft Corporation, USA): only with your consent; see Cookies and analytics below.

[

Owner: confirm a data processing agreement (DPA) is in place with each provider above, and where Kling (Kuaishou) and MiniMax process data. If any of them processes data in China or another country without an EU adequacy decision, a lawyer must confirm the transfer basis (SCCs plus a transfer impact assessment) before living photos and the singer video launch in the EU.

]

Some of these providers are outside the EU, mainly in the USA. Where a provider is certified under the EU-US Data Privacy Framework, transfers rely on that; otherwise they rely on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of the safeguards. [Owner: confirm the basis for each provider.]

We do not sell your data, and we do not use your songs, stories or photos to train AI models. [Owner: confirm with each AI provider that it does not train on our inputs; otherwise remove the second half of this sentence.]

How long we keep it

• Account, song details and songs: for as long as your account exists, so you can come back to your songs. When you ask us to delete your account, we delete them within one month. There is no delete button yet; email us (see Your rights).
• Uploaded photos for AI living photos: deleted automatically 30 days after the video is finished (or the job fails or is refunded), or 2 days after upload if you do not buy the add-on.
• A video added to a share link: deleted when you remove it, turn the link off, or delete your account.
• Teaser links: stop working after 14 days or when you switch them off.
• Reviews: until you withdraw your consent or delete your account. A withdrawn review is taken off the site.
• Reaction videos and photos: until you delete them on the song page, or until the song is refunded. The original upload is deleted as soon as it has been processed.
• Reminders: until you remove them or unsubscribe. If you unsubscribe from all reminders, we keep a note of that so we do not email you again.
• Purchase records: for as long as tax and commercial law requires us to keep them (in Germany up to 10 years), even after your account is deleted.
• Server logs: for a short period needed for security. [Owner: state the log retention period of the hosting provider.]

Cookies and analytics

We use cookies and similar storage that are needed for the site to work: your sign-in session, your language and your cookie choice (kept for 365 days). These need no consent.

Google Analytics 4 and Microsoft Clarity (which records how pages are used) load only after you click "Accept" in the cookie banner; before that, the site sends them nothing and sets none of their cookies. Legal basis: your consent (Art. 6(1)(a) GDPR and the rules on storing information on your device, such as § 25 TDDDG in Germany). You can change your choice at any time with "Cookie settings" in the footer.

[

Owner: AdSense and Plausible are off (nothing is set for them). If you turn either on, name it in this section first.

]

We also count how many visitors reach each step of making a song, in a first-party tally without cookies: we store only the day, the page, the language and the step, with no identifier, IP address or device data. Legal basis: our legitimate interest in improving the site (Art. 6(1)(f) GDPR).

AI-generated content

Lyrics, music, singing voices, the AI singer and the living photo clips are made by AI models. The AI singer is a fictional character, not a real person, and we do not imitate the voice or likeness of real people. The name check and lyrics are produced automatically, but no decision with legal or similarly significant effects is made about you by automated means (Art. 22 GDPR).

Children

NameSong is for adults. You must be at least 18 to create an account or buy. We do not knowingly collect personal data from children under 16 (under 13 in the USA); if we learn that we have, we delete it. A song may be about a child, and a parent or guardian may upload a photo of their own child for living photos; please share only what is needed for the song.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict processing, and to receive your data in a portable format (Art. 15 to 20 GDPR). Where we rely on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR).

Right to object: where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation (Art. 21 GDPR). You can object to emails such as the review invite at any time, without giving reasons.

To use any of these rights, including deleting your account and songs, email aitaylorfan@gmail.com from the address on your account. We answer within one month.

You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work.

California and other US states

We do not sell personal information and do not share it for cross-context behavioral advertising. California residents can ask to know, correct or delete the personal information we hold about them by emailing aitaylorfan@gmail.com, and we will not treat you differently for doing so. The categories we collect and why are listed above.

Changes

We will update this page when what we do with your data changes, and change the date at the top.