Privacy Policy

1. Who we are and what we collect

The data controller (within the meaning of the GDPR) is CHUB PROFINANCE SRL, tax ID (CUI) 51011349, Trade Registry no. J2024047506004, registered office at Bdul. Siderurgistilor 7, Bl. PS1B, Sc. 2, Et. P, Sp. Com., 800478 Galați, Galați County, Romania, the company behind Cantavals, “Cantavals by CHUB PROFINANCE SRL”.

To create your song we collect: your names, your email address, your story and your musical preferences. If you sign in or write to us on WhatsApp, we also collect your phone number. For the invoice we use the name, billing address and email entered at payment (or the company details, if you choose the business option) and the card's country, which we keep for tax obligations. That is all: no passwords (signing in happens through a link sent by email, or through WhatsApp) and no tracking beyond standard analytics and the advertising pixels described below.

We also keep the conversations you have with us, in the chat on the site or on WhatsApp, so that we can see a discussion through and know what we promised you. If you send us a photo or a voice message on WhatsApp, we use it in the conversation: Trilo is shown the photo, and the voice message is transcribed into text.

2. How we use it, and what we pass on

Your story is used solely to write and compose your song. We do not sell it, we do not publish it, and we do not use it as promotional material without your explicit consent.

To the music-composition supplier we send only the lyrics and the song title. We do not send your full name, your email, your phone number, your address, or the story as you wrote it to us. The conversation with Trilo and the story the lyrics are written from are processed by the artificial-intelligence model providers named in section 4, because without them Trilo cannot answer you and the lyrics cannot be written. These providers may process what they receive under their own terms of service, including, in some cases, to improve their models; that is why each of them gets only what it needs for its part of the work. We will not promise you what we do not control, but we do choose what we hand over.

Your email address is used for delivering your order and for messages about your service. Marketing messages are sent only if you have opted in, and unsubscribing is one click away, in every email.

3. The legal bases we rely on

Performance of the contract: the order, writing the lyrics, composing the song, delivery, and your song page.

Your consent: the advertising pixels, marketing messages, and any sensitive detail you choose to put in your story. You can withdraw it at any time, without losing anything you have already bought.

Our legitimate interest: the security of the site, technical logs, preventing abuse of the free previews, and preventing payment fraud.

Legal obligation: issuing and archiving invoices, accounting records, and responding to requests from the authorities.

4. Who receives the data (our suppliers, by name)

We do not sell anybody's data. We do work with suppliers who keep the service standing, and these are they:

Vercel: hosting the site and storing files (United States and European Union; Data Privacy Framework certified).

Upstash: the Redis database holding orders and songs (Frankfurt, European Union).

Stripe: payment processing. Your card details never pass through our servers (United States and Ireland; Data Privacy Framework certified).

Oblio: issuing invoices and sending them to the Romanian tax authority's RO e-Factura system where the law requires it (Romania).

Resend: sending emails (United States; Data Privacy Framework certified).

Infobip: sending and receiving WhatsApp messages (European Union, Frankfurt).

Google: the Gemini artificial-intelligence models, through the Gemini API, under a data processing agreement. We use them to write the lyrics from your story, to answer in the support chat on the song page, to transcribe voice messages sent on WhatsApp, to listen to the finished song as a quality check, to describe the scene the cover is painted from (starting from the story, without the names in the order or the song title) and to write the public story of the song, if you enter it in the contest. Gemini also takes over the chat with Trilo and the painting of the cover when OpenAI is unavailable (United States and Ireland; Data Privacy Framework certified).

OpenAI (OpenAI Ireland Limited), through the OpenAI API, under a data processing agreement: the artificial-intelligence model behind the chat with Trilo, on the site and on WhatsApp, which receives the conversation with you, including recent messages from your other conversations with Trilo, the photos sent on WhatsApp and the details of the order you are discussing (names, lyrics, delivery email), and the model that paints the song's cover, which receives only the described scene, without the names in the order or the song title (United States; transfer based on standard contractual clauses).

Third-party AI music-composition suppliers: they receive only the lyrics and the song title, never your contact details. Processing may also take place outside the European Economic Area.

Meta, TikTok and Google, through the advertising pixels, exclusively if you pressed “Accept all” in the cookie banner.

5. Transfers outside the European Economic Area

Some of the suppliers above are American companies. Transfers are made on the basis of the EU-US Data Privacy Framework for those that are certified, and where that framework does not apply, on the basis of the standard contractual clauses approved by the European Commission.

6. Security and storage

Orders and songs are stored on secure cloud infrastructure. Your song page is reachable through a private, unguessable link: it does not appear in searches and cannot be stumbled upon.

Only the Cantavals team has access to your data, on individual accounts, and only as far as is needed to do the work.

7. How long we keep it

Unpaid orders: 90 days, then deleted.

Billing data and proof of the order: 5 years, because accounting law requires it.

The song and its page: for the duration of the service, a minimum of 3 years; we delete them whenever you ask.

The story in the order and the interview the song came out of: 90 days after delivery.

The conversations saved in your account: for as long as the account is active; you can delete them at any time, and deleting the account deletes them too.

Support conversations: 30 days.

Data used for marketing: until you unsubscribe, or after 2 years of inactivity.

Technical logs: between 30 and 90 days.

One transitional note, to be straight with you: automatic deletion is being rolled out class of data by class of data. Any deletion request coming from you is carried out immediately, whatever stage the automation is at.

8. Other people's data in the story

Our stories are about people: couples, parents, friends, children. When you send us a story, you confirm that you have the agreement of the people mentioned in it, or that you legitimately represent their interest.

We advise you to include only what you want to be heard in the song. Details about health, religious beliefs or other sensitive information are not necessary to us; if you nevertheless choose to put them in the story, you thereby give us your explicit consent to process them in order to write the lyrics.

When the song is a surprise gift, the person it is about is informed on delivery, on the song's page. This is a postponement, not an omission: the information notice required by art. 14 of the GDPR reaches the recipient together with the song, precisely so that the surprise is not spoiled.

9. Advertising pixels

Our pages may use the Meta pixel, the TikTok pixel and the Google tag to measure advertising. These are standard tools; they do not access your story or your song.

They load only after you press “Accept all” in the cookie banner. Without that consent, no request is ever sent to Meta, TikTok or Google. The full detail is in the Cookie Policy.

10. Your rights (GDPR) and how to exercise them

You have the right of access to your data, of rectification, of erasure, of restriction of processing, of objection to processing, and of data portability. You also have the right to withdraw your consent at any time, without that withdrawal affecting the lawfulness of the processing carried out before it.

To exercise them, one email to hello@cantavals.com is enough. We answer within the legal deadline of 30 days at most.

If you are not satisfied with how we handled your request, you may address the Romanian data protection authority (ANSPDCP), B-dul General Gheorghe Magheru 28-30, Bucharest, dataprotection.ro. You also have the right to go to court.