Privacy Policy

1. What we collect

When you use our site or submit an intake, we may collect your name, email address, phone number, communication preference, occasion, recipient details, story, musical preferences, event and requested-delivery dates, reference links, consent choices, and other details you choose to provide. Some song briefs can include sensitive personal information about you or another person. Please share only what is necessary to create the song.

When you make a payment, Stripe processes your payment information. We receive limited payment and order information such as payment status, transaction identifiers, discount amount, and final amount. We do not store full payment-card details or a customer-entered promotion code.

2. How we use information

We use personal information to create and manage custom songs, process and confirm payment, provide customer support, send delivery and service messages, prevent fraud and misuse, keep operational records, comply with law, and improve our service. We use optional marketing consent to send future Memory on Repeat news or offers. We do not sell personal information as that phrase is commonly used.

For the FROM THE HEART campaign, we maintain daily aggregate page-action counts only when optional analytics is enabled. Those counts do not store a visitor name, email address, song story, payment information, or a persistent visitor identifier.

3. Technology-assisted creation

To create a private song draft, we may transmit the song brief details needed for that task to technology providers used for lyric and music generation. The data can include the recipient’s name, occasion, story, personal details, musical direction, and requested phrases. We use the resulting draft only to create, review, and deliver your order.

4. How information is shared

We share information only as needed to operate the service. This includes Stripe for hosted payment processing, Resend for customer and operational email, secure hosting and storage providers for our application and delivered audio, privacy-focused analytics when you opt in, and technology providers used to help create private song drafts. These providers process information under their own terms and privacy practices. We do not authorize them to use your personal story for unrelated advertising.

We may also disclose information when required by law, to protect rights and safety, or in connection with a business transfer. We do not publish a customer’s story, name, image, voice, or song without separate permission.

5. Cookies, local storage, and privacy choices

We use strictly necessary technologies for security, secure Checkout, required sessions, and remembering your privacy choices. The intake form uses browser-local storage for an unfinished draft only when you allow functional storage and choose Save & continue later. Optional Umami analytics load only when you permit analytics. We do not run advertising pixels or retargeting technologies. You can change your choices at any time through Privacy choices. Our Cookie Policy lists the categories and current known technologies.

6. Your choices and requests

You may ask us to access, correct, or delete personal information that we hold about you, subject to legal, security, and operational limits. You may withdraw optional marketing consent or unsubscribe from marketing and payment-recovery emails at any time. You can also ask us not to use your data for targeted advertising or sale; we do not run targeted-advertising profiles from intake data.

Use our Privacy Request form or email orders@memoryonrepeat.com with the subject line Privacy Request. We may request enough information to verify that the request is from you or an authorized representative before taking action. If you disagree with a request decision, reply to the decision notice and ask for an internal review.

7. Retention and security

We keep information only for as long as reasonably necessary to fulfill the purposes in this policy, support an order, resolve disputes, enforce agreements, prevent fraud, and meet legal obligations. We use access controls, passwordless team access, encryption in transit where supported, secure service providers, and a least-privilege approach. No system is perfectly secure, so please do not send passwords, payment-card details, Social Security numbers, or other unnecessary sensitive information in a song brief.

We have not adopted a single public retention period for every order and record type. If we adopt one, we will update this policy and operational controls together.

8. Children, state rights, and international users

Our service is not directed to children as independent purchasers. A parent, guardian, or other authorized adult must submit any information about a child. If you believe a child’s personal information was provided without proper authority, contact us so we can review and address the request.

Depending on where you live and applicable law, you may have rights to access, correct, delete, obtain a portable copy of, or opt out of certain processing of your personal information. Colorado residents may have rights under the Colorado Privacy Act, including access, correction, deletion, portability, and certain opt-out rights. We evaluate privacy laws based on our actual business practices and applicable thresholds. This policy is not a statement that every state or international privacy law applies to us. We do not currently direct this service to European Economic Area or United Kingdom customers; contact us before submitting an international order if you have a question about cross-border processing.

9. Changes to this policy

We may update this policy as our service or legal obligations change. The effective date above identifies the current version. If a change materially affects how we use information already collected, we will provide notice where required by law.