Privacy Policy

1. Who we are and what we collect

The data controller (within the meaning of the GDPR) is CUM FACEM SRL, tax ID (CUI) 49199284, Trade Registry no. J2023000897397, registered office at Str. Aurora, Bl. 5, Ap. 1, Focșani, Vrancea County, Romania, the company behind Cantavals, “Cantavals by CUM FACEM SRL”.

To create your song we collect: your names, your email address, your story and your musical preferences. If you sign in or write to us on WhatsApp, we also collect your phone number. If you ask for an invoice, we also collect your billing details. That is all: no passwords (signing in happens through a link sent by email, or through WhatsApp) and no tracking beyond standard analytics and the advertising pixels described below.

We also keep the conversations you have with us, in the chat on the site or on WhatsApp, so that we can see a discussion through and know what we promised you.

2. How we use it, and what we pass on

Your story is used solely to write and compose your song. We do not sell it, we do not publish it, and we do not use it as promotional material without your explicit consent.

To the music-composition supplier we send only the lyrics and the song title. We do not send your full name, your email, your phone number, your address, or the story as you wrote it to us. The artificial-intelligence providers we work with may process what they receive under their own terms of service, including, in some cases, to improve their models; that is precisely why we strictly minimize what we send them. We will not promise you what we do not control, but we do control how little we hand over.

Your email address is used for delivering your order and for messages about your service. Marketing messages are sent only if you have opted in, and unsubscribing is one click away, in every email.

3. The legal bases we rely on

Performance of the contract: the order, writing the lyrics, composing the song, delivery, and your song page.

Your consent: the advertising pixels, marketing messages, and any sensitive detail you choose to put in your story. You can withdraw it at any time, without losing anything you have already bought.

Our legitimate interest: the security of the site, technical logs, preventing abuse of the free previews, and preventing payment fraud.

Legal obligation: issuing and archiving invoices, accounting records, and responding to requests from the authorities.

4. Who receives the data (our suppliers, by name)

We do not sell anybody's data. We do work with suppliers who keep the service standing, and these are they:

Vercel: hosting the site and storing files (United States and European Union; Data Privacy Framework certified).

Upstash: the Redis database holding orders and songs (Frankfurt, European Union).

Stripe: payment processing. Your card details never pass through our servers (United States and Ireland; Data Privacy Framework certified).

Resend: sending emails (United States; Data Privacy Framework certified).

Infobip: sending and receiving WhatsApp messages (European Union, Frankfurt).

Google: the artificial-intelligence model behind the chat with Trilo, through the Gemini API, under a data processing agreement (United States and Ireland; Data Privacy Framework certified).

Third-party AI music-composition suppliers: they receive only the lyrics and the song title, never your contact details. Processing may also take place outside the European Economic Area.

Meta, TikTok and Google, through the advertising pixels, exclusively if you pressed “Accept all” in the cookie banner.

5. Transfers outside the European Economic Area

Some of the suppliers above are American companies. Transfers are made on the basis of the EU-US Data Privacy Framework for those that are certified, and where that framework does not apply, on the basis of the standard contractual clauses approved by the European Commission. We check periodically that the certifications are still valid.

6. Security and storage

Orders and songs are stored on secure cloud infrastructure. Your song page is reachable through a private, unguessable link: it does not appear in searches and cannot be stumbled upon.

Only the Cantavals team has access to your data, on individual accounts, and only as far as is needed to do the work.

7. How long we keep it

Unpaid orders: 90 days, then deleted.

Billing data and proof of the order: 5 years, because accounting law requires it.

The song and its page: for the duration of the service, a minimum of 3 years; we delete them whenever you ask.

The story in the order and the interview the song came out of: 90 days after delivery.

The conversations saved in your account: for as long as the account is active; you can delete them at any time, and deleting the account deletes them too.

Support conversations: 30 days.

Data used for marketing: until you unsubscribe, or after 2 years of inactivity.

Technical logs: between 30 and 90 days.

One transitional note, to be straight with you: automatic deletion is being rolled out class of data by class of data. Any deletion request coming from you is carried out immediately, whatever stage the automation is at.

8. Other people's data in the story

Our stories are about people: couples, parents, friends, children. When you send us a story, you confirm that you have the agreement of the people mentioned in it, or that you legitimately represent their interest.

We advise you to include only what you want to be heard in the song. Details about health, religious beliefs or other sensitive information are not necessary to us; if you nevertheless choose to put them in the story, you thereby give us your explicit consent to process them in order to write the lyrics.

When the song is a surprise gift, the person it is about is informed on delivery, on the song's page. This is a postponement, not an omission: the information notice required by art. 14 of the GDPR reaches the recipient together with the song, precisely so that the surprise is not spoiled.

9. Advertising pixels

Our pages may use the Meta pixel, the TikTok pixel and the Google tag to measure advertising. These are standard tools; they do not access your story or your song.

They load only after you press “Accept all” in the cookie banner. Without that consent, no request is ever sent to Meta, TikTok or Google. The full detail is in the Cookie Policy.

10. Your rights (GDPR) and how to exercise them

You have the right of access to your data, of rectification, of erasure, of restriction of processing, of objection to processing, and of data portability. You also have the right to withdraw your consent at any time, without that withdrawal affecting the lawfulness of the processing carried out before it.

To exercise them, one email to hello@cantavals.com is enough. We answer within the legal deadline of 30 days at most.

If you are not satisfied with how we handled your request, you may address the Romanian data protection authority (ANSPDCP), B-dul General Gheorghe Magheru 28-30, Bucharest, dataprotection.ro. You also have the right to go to court.