Privacy Policy

Who controls your data

Custom Song Gifts is the data controller for the personal data described in this policy. You can reach our privacy team at privacy@customsonggifts.com.

Information we collect

We collect the information you give us directly and a small amount of information collected automatically.

• Survey answers you submit in the order wizard, including the recipient's first name, who they are to you (with a short description in your own words if you choose Other), the language the song should be written in, and any stories and memories you write about them.
• Your email address, used to send your order confirmation, the finished song, any support replies, and up to three reminders if you leave an order unfinished.
• The phone number you enter on the order form, used to help with your order and for up to two reminders by SMS or WhatsApp if you leave an order unfinished.
• Order and payment metadata from Polar, such as the order total, currency, and payment status, and the name and billing address you enter at checkout. For measuring our advertising we keep SHA-256 hashes of the name and address and the billing country as its two-letter code, and we never keep your street address. Your name is also kept in our record of each payment and can appear in the internal payment notifications we receive. We do not receive or store your full card number; Polar handles payment details directly.
• Technical data such as your IP address, browser type, device type, and the pages you visit, collected through cookies and similar technology.

Why we use your data, and our legal bases

We use Customer Content and your email address to create your song and deliver it to you. This is necessary to perform the contract we enter into when you place an order.

We use your phone number to contact you about your order if our emails do not reach you or there is a problem with delivery, and to help you when you contact customer support. This too is necessary to perform the contract. To measure our advertising we also send Meta and TikTok a SHA-256 hash of it, as described below; we do not share it with any other advertising platform.

We use order data and technical data to keep the site secure, prevent fraud, understand how the site is used, and improve it. We do this on the basis of our legitimate interest in running and improving our business, balanced against your rights.

We use analytics and marketing cookies and pixels for every visit to measure and improve our advertising, on the basis of our legitimate interest in promoting our business and your continued use of the site.

If you create an order and receive a song preview but do not complete the payment, we may send you up to three reminder emails about that unfinished order, all within four days of creating it. We do this on the basis of our legitimate interest in helping you finish a purchase you started. Every reminder contains an unsubscribe link, and once you use it we send no further reminders to your address. You can also object at any time by writing to privacy@customsonggifts.com. Apart from these reminders, we only send marketing emails if you have agreed to receive them, and you can unsubscribe at any time.

On the same basis, and as the order form tells you on the page where you enter your phone number, we may send up to two reminders about that unfinished order to the phone number you gave, by SMS or WhatsApp, all within three days of creating it and only between 9:00 and 20:00 in your time zone. Every message contains a link to stop them, and once you use it we send no further messages to your number. Unsubscribing from the reminder emails stops these messages too. You can also object at any time by writing to privacy@customsonggifts.com.

Who we share your data with

We share personal data only with the processors and recipients below, each acting under a data processing agreement or their own privacy terms. We do not sell your personal data.

Your phone number is stored with your order in the order database on our own server and can be seen only by our team, including in the internal order notifications that our email provider (Amazon SES, or Resend as a fallback) sends to us. Apart from Vercel, which hosts the site and receives the order form, and GatewayAPI and Meta (WhatsApp), which deliver the reminder messages described above, it is not passed to any other recipient below, except that a SHA-256 hash of it is sent to Meta and TikTok to measure our advertising (see Meta and TikTok below). It is never sent to Google.

• Polar.sh, our payment provider and merchant of record, which receives your email address and order details and processes your payment.
• Amazon Web Services (Amazon SES), which sends our emails on our behalf, such as your order confirmation, the delivery email with your song, the links you request on the track-order page and reminders about an unfinished order. When Amazon SES is not available, Resend sends the same emails in its place.
• GatewayAPI (OnlineCity.IO), which sends our reminder SMS messages. It receives your phone number, the recipient's first name and the text of the message.
• Meta Platforms (WhatsApp Business Platform), which delivers our reminder WhatsApp messages when WhatsApp is available for your number. It receives your phone number, the recipient's first name and the text of the message, and handles them under the WhatsApp Business terms, not for advertising.
• Google (Gemini API), which writes the song lyrics, including the free preview, from the recipient's name and the answers you give in the order wizard.
• ElevenLabs, which receives the finished lyrics and the musical direction to record the song. It does not receive your email address.
• Vercel, which hosts the website and processes the technical data of every visit, such as your IP address and browser type.
• Our own server, which we rent and operate ourselves, and which stores the order database and the finished song files.
• Google Tag Manager, which loads our measurement tags, and Google Analytics, which helps us understand how the site is used. Both run on every visit.
• Microsoft Clarity, which makes session recordings and heatmaps (clicks, scrolling and mouse movement) so we can see where the site is hard to use. Microsoft acts as our processor for this analytics and usability purpose and sets its own cookies (_clck and _clsk). Personal details such as your email address, the recipient's name, the lyrics and your order details are masked in the recordings, and the song page is not recorded.
• Meta, through the Meta Pixel on the site and the Meta Conversions API from our server, used to measure our advertising on every visit. When you place, check out or pay for an order we send Meta the order value and the items ordered, a SHA-256 hash of your email address, of your phone number and of your country, your IP address, your browser's user agent, Meta's own cookie identifiers (_fbp and _fbc) and a random visitor ID that our site keeps in its own cookie (csg_vid), which the Meta Pixel also sends on every visit. When you pay, we also send a SHA-256 hash of the name and billing address you entered at checkout (first and last name, city, postcode, region where given, and country); your street address is never sent.
• TikTok, through the TikTok Pixel on the site and the TikTok Events API from our server, used to measure our advertising on every visit. When you place, check out or pay for an order we send TikTok the order value, currency and the items ordered, a SHA-256 hash of your email address and of your phone number, your IP address, your browser's user agent, the language of the site you used, TikTok's own cookie identifier (_ttp), our random visitor ID (csg_vid, which the TikTok Pixel also sends on every visit) and, if you arrived through a TikTok ad, its click identifier (ttclid). When you pay, we also send a SHA-256 hash of your first and last name and postcode from the checkout, and your billing country as its two-letter code, which is not hashed.

Cookies

We use three categories of cookies: necessary cookies, which keep the site working, analytics cookies, which help us understand how the site is used, and marketing cookies, which support advertising on Meta and TikTok. All three are set on every visit.

A short notice tells you about this on your first visit. You can block or delete cookies at any time in your browser settings, and you can object to our use of your data for advertising by writing to us at the address below.

How long we keep your data

We keep order records, including your phone number, and the delivered song for 24 months after Delivery, after which we delete or anonymise them so they can no longer identify you. Some records, such as accounting and tax records, are kept for longer where the law requires it, and we may keep a limited record of an order we refused under the content rules in our Terms, so that the same content is not submitted again.

If you unsubscribe from our reminders or stop our reminder messages, we keep your email address or phone number on a suppression list for as long as we send such reminders, so that we can respect your choice.

International transfers

Some of the processors listed above may process data outside your country, including outside the European Economic Area. Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, or an equivalent legal mechanism, to protect your data to the same standard as if it had stayed within the European Economic Area.

Your rights

Depending on where you live, you have some or all of the rights below over your personal data. To exercise any of them, email privacy@customsonggifts.com; we may ask you to verify your identity before we act on a request.

• Access: ask us for a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: ask us to delete your data, subject to any legal retention obligations.
• Restriction: ask us to limit how we use your data.
• Portability: ask us for your data in a structured, machine-readable format.
• Objection: object to our use of your data based on legitimate interest.
• Withdraw consent: withdraw any consent you gave us, at any time, without affecting processing carried out before you withdrew it.
• Complain: lodge a complaint with your local data protection supervisory authority.

Children

Our service is intended for adults. You must be 18 or older to place an order. We do not knowingly collect personal data from children; where Customer Content names a child recipient, it is provided by the adult customer, not by the child.

Keeping your data secure

We use technical and organisational measures, including encryption in transit, access controls, and regular review of who on our team can see order data, to protect personal data against loss, misuse, and unauthorised access. No method of transmission or storage is completely secure, but we work to keep your data safe and to limit access to what each processor needs to do its job.

Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect a new processor or a change in the law. The version in force is the one published at https://customsonggifts.com/privacy.

Contact us

Questions about this policy or your data can be sent to privacy@customsonggifts.com.

Last updated 1 October 2026.