Privacy Policy

1. Introduction

ForeverSongs ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy describes the information we collect, how we use it, the parties to whom it is disclosed, the methods of disclosure, and the security practices we have in place to safeguard your information. By using our Service, you consent to the data practices described in this policy.

Data Controller

ForeverSongs is the data controller responsible for your personal data. For questions about how we handle your data, contact us at privacy@foreversongs.com.

EU/EEA Representative (GDPR Article 27)

As ForeverSongs is established outside the European Economic Area, we are in the process of appointing an EU representative in accordance with Article 27 of the GDPR. In the interim, you may direct any data protection inquiries to privacy@foreversongs.com. We will update this page with the contact details of our formal EU-based representative once appointed.

2. Information We Collect

We collect the following categories of information:

Personal Information

• Contact Information: Email address for order confirmations, delivery, and customer support
• Payment Information: Processed securely through our payment processor; we do not store credit card numbers on our servers
• Names: Recipient names and your name (if provided) for song personalization
• Phone Number: Used to send transactional and, where consent is provided, marketing communications via SMS

Content Information

• Memories and Stories: Personal stories, memories, and details you share for song creation
• Sensitive / Special Category Information: Your stories may voluntarily include sensitive information such as health conditions, religious or philosophical beliefs, racial or ethnic origin, or other special category data (as defined by GDPR Article 9). We process this information only with your explicit consent and solely for the purpose of creating your personalized song. During the order process, you will be asked to provide explicit consent before submitting stories that may contain such information. You may withdraw this consent at any time by contacting privacy@foreversongs.com, though this may affect our ability to complete your order
• Preferences: Genre, decade, voice, occasion, and style preferences
• Generated Content: Lyrics and audio files created for your order

Technical Information

• Device Information: Browser type, operating system, and device type
• Usage Data: Pages visited, time spent on site, and interaction patterns
• IP Address: For security, fraud prevention, and approximate geolocation purposes
• Referral Data: How you found us (UTM parameters, referrer URLs)

3. How We Use Your Information

We use the collected information for the following purposes:

• Service Delivery: To create and deliver your custom song
• Communication: To send order confirmations, delivery notifications, remake updates, and respond to inquiries
• Payment Processing: To process transactions securely through our payment provider
• Service Improvement: To analyze usage patterns and improve our service
• Security: To prevent fraud, unauthorized access, and other malicious activities
• Legal Compliance: To comply with applicable laws and regulations
• Marketing: To send promotional communications (with your consent, where required)
• No AI Training: We do not use your stories, memories, or personal submissions to train public AI models. Your content is processed solely to create your personalized song and is not used to improve or train third-party AI systems

Automated Processing and Decision-Making

Our Service uses automated processing, including artificial intelligence, to generate lyrics and music based on the information you provide. This automated processing is essential to deliver the Service and is performed under the legal basis of contract performance. The automated processing does not produce decisions with legal or similarly significant effects on you — it generates creative content based on your inputs. You always have the right to request human review of any aspect of your order by contacting privacy@foreversongs.com.

Legal Bases for Processing (GDPR)

For users in the European Economic Area, we process your data based on:

• Contract Performance: Processing necessary to fulfill your order
• Legitimate Interests: Improving our services, preventing fraud, marketing (where permitted)
• Consent: For optional marketing communications
• Legal Obligation: Compliance with applicable laws

3A. SMS Services

You may elect to receive text messages from us. When you sign up to receive text messages, we may send you information about promotional offers, reminders (including abandoned checkout messages), and other updates related to your interaction with our services.

We may also send transactional text messages, including order confirmations, delivery notifications, account updates, and customer support communications.

These messages may be informed by information automatically collected based on your interactions with our website, such as browsing behavior or actions taken during checkout.

To the extent you voluntarily opt to receive SMS notifications, we collect and store the information you provide, including your telephone number, messaging history, and engagement data (such as whether a message was opened or interacted with).

You may opt out of receiving marketing text messages at any time by replying "STOP" to any message. For assistance, reply "HELP" or contact us at support@foreversongs.com. Even if you opt out of marketing messages, you may still receive transactional messages necessary to complete your orders or provide services.

For more information about our SMS practices, please see our Terms of Service.

We do not sell your phone number or SMS consent data to third parties. SMS opt-in data and consent will only be used for the purposes described in this Privacy Policy and will not be shared with third parties except as necessary to deliver messaging services.

4. Information Sharing and Disclosure

We share your information only with the parties listed below and only as necessary to provide our Service. We do not sell your personal information to third parties.

Legal Requirements

We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Third-Party Service Providers (Sub-Processors)

We share your information with carefully selected third-party service providers to deliver our Service. Each provider is bound by a Data Processing Agreement (DPA) and is contractually obligated to protect your data in accordance with applicable data protection laws. We use the following categories of service providers:

• Payment Processing: A PCI-DSS Level 1 certified payment processor handles all transactions securely. We never store or have access to your full credit card number. Data categories processed: email, payment details, transaction amount.
• AI Content Generation: Your song request details are processed by AI service providers to generate personalized lyrics, music, and vocals. Data categories processed: song request details, recipient information, musical preferences.
• Email Services: Transactional and marketing email providers send order confirmations, song deliveries, and promotional communications (with your consent where required). Data categories processed: email address, order details, marketing preferences.
• Cloud Infrastructure: Cloud storage, database hosting, and application hosting providers store and serve your data with encryption at rest and in transit. Data categories processed: order data, audio files, request logs.
• Analytics and Optimization: Analytics and experimentation tools help us understand usage patterns and improve user experience (subject to your cookie consent preferences). Data categories processed: pseudonymous usage data, pseudonymous visitor IDs, device information.
• Error Monitoring: Application monitoring tools track errors and performance issues. Data is anonymized where possible. Data categories processed: anonymized error logs, device information.

Where required, our sub-processors are covered by appropriate transfer mechanisms such as the EU-US Data Privacy Framework or Standard Contractual Clauses. We use Data Processing Agreements (DPAs) with our sub-processors as documented upon request. For a detailed sub-processor list or copies of applicable DPAs, contact privacy@foreversongs.com.

6. Cookies and Tracking Technologies

Types of Cookies We Use

Essential Cookies (Required)

• Session cookies for maintaining your order state during checkout
• Authentication cookies for admin users
• CSRF protection tokens

These cookies are necessary for the Service to function and cannot be disabled.

Analytics Cookies (Optional)

• Website Analytics: We use analytics tools to understand how visitors use our site, including pages visited, time on site, and referral sources. These tools use cookies and collect pseudonymous usage data.
• Experimentation: We use A/B testing tools to improve user experience. These tools use pseudonymous visitor IDs to assign experiment variations.
• These analytics cookies help us improve user experience and are optional

Marketing & Advertising Cookies (Optional, Consent Required)

• Meta Pixel (Facebook/Instagram): Tracks conversions and enables remarketing. Only activated with your consent for advertising cookies.
• TikTok Pixel: Tracks conversions from TikTok advertising. Only activated with your consent for advertising cookies.
• Google Ads: Tracks conversions from Google advertising campaigns. Only activated with your consent for advertising cookies.

For users in the EU/EEA, marketing and advertising cookies are only placed with your prior opt-in consent. For users in the United States and other regions, these cookies may be placed unless you opt out through our cookie consent banner or your browser settings.

How to Manage Cookies

You can manage your cookie preferences through our cookie consent banner, which appears on your first visit. You can also change your preferences at any time through your browser settings. Refusing essential cookies may prevent you from completing orders.

Global Privacy Control (GPC) & Do Not Track

We honor the Global Privacy Control (GPC) signal as required by the California Consumer Privacy Rights Act (CPRA) and other applicable laws. When we detect a GPC signal from your browser, we treat it as a valid opt-out of the "sale" or "sharing" of your personal information, and we will disable non-essential cookies and tracking technologies for your session. We currently do not respond to legacy "Do Not Track" (DNT) browser signals, as there is no universally accepted standard for DNT.

7. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes described in this policy:

• Order Data: Retained for 7 years after your last transaction for legal, tax, and accounting compliance purposes, after which it is anonymized or deleted. During this period you may continue to access your purchase.
• Generated Songs: Stored for as long as your account or order record is active. You may request deletion at any time by contacting privacy@foreversongs.com. Songs associated with inactive orders will be reviewed for deletion after 7 years.
• Personal Stories and User Content: Retained for the duration necessary to fulfill your order and any remake requests, then for up to 12 months for quality assurance purposes. After this period, personal story content is deleted from active systems (but may persist in encrypted backups for up to 90 additional days).
• Support Conversations: Retained for 3 years after resolution
• Marketing Data: Until you unsubscribe or request deletion. Inactive marketing contacts are automatically removed after 24 months of inactivity.
• Technical Logs: Generally deleted after 90 days

You may request deletion of your data by contacting us at privacy@foreversongs.com.

8. Data Security

We implement comprehensive security measures to protect your information:

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS/SSL
• Secure Payment: Credit card information is processed by our payment provider and never touches our servers
• Database Security: Our database is hosted with encryption at rest and in transit
• Access Control: Only authorized personnel have access to user data, on a need-to-know basis
• Regular Audits: We regularly review and update our security practices
• Credential Management: Sensitive credentials are stored securely using industry-standard practices and are never exposed in client-side code

While we implement industry-standard security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Portability: Request your data in a portable format
• Opt-out: Unsubscribe from marketing communications at any time (contact support@foreversongs.comor click "unsubscribe" in any marketing email)
• Lodge a Complaint: File a complaint with your local data protection authority or consumer protection agency

To exercise any of these rights, please contact us at privacy@foreversongs.com. See the jurisdiction-specific sections below (Sections 10-13) for response timelines and your local supervisory authority.

13. Your Rights in Mexico, Colombia, Argentina, Chile & Other Latin American Jurisdictions

Mexico (LFPDPPP)

If you are in Mexico, you have ARCO rights under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP):

• Acceso (Access): Request access to your personal data
• Rectificación (Rectification): Request correction of inaccurate data
• Cancelación (Cancellation): Request deletion of your data
• Oposición (Opposition): Object to the processing of your data

To exercise your ARCO rights, submit a request to privacy@foreversongs.com. We will respond within 20 business days as required by LFPDPPP. You may also file complaints with the INAI (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales).

Colombia (Law 1581/2012)

If you are in Colombia, you have rights under the Personal Data Protection Law (Law 1581/2012), including the right to: access your data, update and correct it, request deletion when not required by legal obligation, request proof of consent, file complaints with the SIC (Superintendencia de Industria y Comercio), and revoke consent. We will respond to requests within 10 business days (extendable by 5 additional days). Contact privacy@foreversongs.com.

Argentina (Law 25.326)

If you are in Argentina, you have rights under the Personal Data Protection Law (Law 25.326), including the right to: access your data (free of charge, at intervals of no less than 6 months), rectify, update, or suppress your data. You may file complaints with the AAIP (Agencia de Acceso a la Información Pública). We will respond within 10 calendar days. Argentina has been granted an adequacy decision by the European Commission. Contact privacy@foreversongs.com.

Chile (Law 19.628)

If you are in Chile, you have rights under the Law on Protection of Private Life (Law 19.628), including the right to: access, modify, cancel, and block your personal data. You may file complaints with the SERNAC (Servicio Nacional del Consumidor) or the competent courts. Contact privacy@foreversongs.com.

Other Jurisdictions

If you are located in Venezuela, Puerto Rico, or any other jurisdiction with data protection legislation, you may exercise your applicable data protection rights by contacting privacy@foreversongs.com. We will process your request in accordance with the applicable data protection laws of your jurisdiction.

14. International Data Transfers

ForeverSongs is based in the United States. Your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate.

Transfer Mechanisms

For transfers from the EEA/UK/Switzerland to the United States, we rely on the following safeguards:

• EU-US Data Privacy Framework (DPF):Where applicable, we use sub-processors that are certified under the EU-US Data Privacy Framework (including the UK Extension and Swiss-US DPF), as recognized by the European Commission's adequacy decision of July 2023
• Standard Contractual Clauses (SCCs): For sub-processors not covered by the DPF, we use SCCs approved by the European Commission (and the UK International Data Transfer Agreement where applicable)
• Data Processing Agreements (DPAs): All service providers are bound by DPAs that include appropriate technical and organizational safeguards
• Adequacy Decisions: Where available, we rely on adequacy decisions issued by the European Commission for the recipient country

Your Consent

By using our Service, you consent to the transfer of your information to the United States and other jurisdictions that may have different data protection laws than your country of residence. Regardless of where your data is processed, we apply the same protections described in this Privacy Policy.

15. Data Breach Notification

In the event of a data breach that affects your personal information:

Notification Timeline

We will notify affected users within 72 hours of becoming aware of a breach that poses a risk to your rights and freedoms. We will also notify relevant supervisory authorities as required by law.

Notification Content

Our notification will include:

• Description of the nature of the breach
• Categories and approximate number of individuals affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact information for questions

How We Will Notify You

We will notify you via email to the address associated with your order, by a prominent notice on our website, and by other means as required by applicable law.

16. Children's Privacy

Our Service requires users to be at least 18 years of age (or the age of majority in your jurisdiction), as stated in our Terms of Service. The age thresholds below represent the regulatory floors under applicable children's privacy laws, below which heightened data protection requirements apply:

• United States: 13 years of age (in accordance with COPPA)
• European Union: 16 years of age (or the age set by your member state, which may be as low as 13 under GDPR Article 8)
• United Kingdom: 13 years of age (under UK GDPR)
• Brazil: 18 years of age, or 12 years of age with verifiable parental consent (under LGPD Article 14)
• All other jurisdictions: The age of digital consent in your country of residence, or 16 years of age if no specific age is defined

We do not knowingly collect personal information from children below the applicable age threshold. If you are a parent or guardian and believe we have collected information from a child below the applicable age in your jurisdiction, please contact us immediately at privacy@foreversongs.com and we will take steps to delete such information promptly.

17. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

18. Marketing Communications

Types of Communications

• Transactional Emails: Order confirmations, delivery notifications, change request links (required for service delivery - cannot be opted out)
• Marketing Emails: Promotional offers, new features, company updates (optional)

Opt-In/Opt-Out

You can opt out of marketing emails at any time by clicking "unsubscribe" in any marketing email or contacting support@foreversongs.com. Transactional emails cannot be opted out as they are necessary for order fulfillment.

Abandoned Cart Emails

If you start an order and provide your email address but do not complete checkout, we may send a limited number of reminder emails. The legal basis for these emails is our legitimate interest in completing transactions that you initiated (GDPR Article 6(1)(f)). We have conducted a balancing test and limit abandoned cart emails to a maximum of three (3) emails over a seven (7) day period.

You can opt out of abandoned cart emails at any time by clicking "unsubscribe" in any such email. For users in the EU/EEA where explicit consent for electronic marketing is required under the ePrivacy Directive, abandoned cart emails are only sent where we have obtained the necessary consent or where permitted under the "soft opt-in" exception (i.e., you provided your email in the context of an initiated transaction for a similar product).

We may also send marketing communications via SMS where you have provided consent. Please see Section 3A (SMS Services) for more details.

19. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page and, in some cases, by sending you an email notification. Your continued use of our Service after changes constitutes acceptance of the updated policy. If you do not agree to the modified policy, you should discontinue use of the Service.

20. Contact Us

If you have any questions about this Privacy Policy, our data practices, or would like to exercise your rights, please contact us:

We aim to respond to all inquiries within 30 days.