SongDemand Privacy Policy
October 12, 2026
1. Data controller
The controller is BT Jan Zieliński, operating SongDemand, ul. Niecała 10, 32-500 Chrzanów, Poland, EU Tax ID PL6282099069, REGON 365428666. Privacy contact: contact@tuneondemand.com.
2. Data, purposes, and legal grounds
We process the subject’s name, occasion, traits, and stories to generate lyrics and audio; email to manage demos and orders, deliver files, and send expiry reminders; transaction ID and billing country for payment, tax, and fraud prevention; and technical logs and hashed email/IP identifiers for security, troubleshooting, and limits.
Depending on context, processing is necessary to perform or prepare a contract, comply with legal obligations, or pursue legitimate interests in security and legal claims. We request separate consent where law requires it.
The song is digital content supplied exclusively as an MP3 file available for download and streaming on the song page. We send the song link to the email address provided in the order. We do not supply CDs, USB drives, or other physical media.
3. Providers and transfers
Necessary data is shared with Stripe (payments), Resend (transactional email), Vercel and Supabase (application, database, and file hosting), and Google (Gemini/Lyria), OpenAI, and Apiframe/Suno (lyrics or audio generation). The data shared depends on the feature used.
For transfers outside the EEA, we use the mechanism applicable to that recipient and transfer, such as an adequacy decision or Standard Contractual Clauses, with suitable safeguards. We do not claim that one mechanism applies to every provider.
4. Song and record retention
For new orders, the private audio file is stored for 12 months from availability of the finished, paid song. Earlier and already-started orders retain indefinite hosting under their earlier terms. At expiry, the audio file is removed separately from the order record.
Order, payment, complaint, and tax records may remain longer where needed for legal duties or claims. Backups follow provider cycles and safeguards; we do not promise a fixed deletion time from every backup.
We remove unpurchased demo audio 7 days after it is ready, after checking payment status. An expired link retains a minimal record: identifier, language, and expiry date. Payment records and logs follow separate retention rules.
5. Service messages
We send confirmations and non-promotional expiry reminders about 30, 7, and 1 day before the deadline. After a reminder outage, access is extended by at least 7 days after the delayed warning is sent. Email-provider acceptance proves technical handoff, not receipt or reading.
6. Children and other people
The service is intended for adults. A customer ordering about a child or another person must be their parent, guardian, or otherwise authorized to provide the details. Do not submit sensitive or unnecessary personal information.
7. Rights, security, and browser storage
Subject to applicable law, individuals may request access, a copy, correction, deletion, restriction, portability, or object, and may withdraw consent. Some records remain when law or legal claims require them. Complaints may be lodged with Poland’s UODO, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, or another competent local authority.
We use access controls and transmission safeguards. The songdemand_locale cookie/localStorage remembers language; the necessary songdemand-order cookie enables purchase access for up to 365 days. Security logs and hashed email/IP identifiers enforce limits. Blocking this storage may disable features.
8. Privacy settings
Vercel Web Analytics measures visits and page views without cookies. Google Analytics runs only after optional analytics consent, measuring wizard steps, playback, generation, checkout and confirmed purchases. We do not send names, emails, stories, lyrics or private access identifiers. Google cookies are set to expire within 90 days. Your choice is stored locally and can be changed or withdrawn using Privacy settings.