Personal data

Privacy notice

This notice explains how personal data is used when you request a preview, buy a song or contact NuestraCanción.

Data we receive

We may receive your name and email, recipient name and relationship, chosen language and style, age supplied for a song, memories and dedication text, photos you choose to upload for the Emotion photo video, order/payment status and technical information needed to operate the site. Photos are stored with the order and shown only through its private gift page. Please avoid sensitive personal data and do not provide another person’s private information or photograph unless you have permission.

Why we use it and legal bases

• To create a requested preview and perform the order: steps requested before a contract and performance of the contract.
• To take payment, deliver the song, handle support and manage complaints: contract performance and legal obligations.
• To record the required contract and digital-content declarations: compliance with consumer law.
• To protect the service and prevent abuse: legitimate interests, balanced against your rights.
• Marketing emails are not sent unless a separate lawful basis and, where required, consent are obtained.

Service providers and transfers

Only data needed for the chosen workflow is shared with processors: hosting/database providers, OpenAI for lyric generation when enabled, Mureka or Google/Lyria for music generation when enabled, and Stripe for payment when enabled. These companies may process data in countries outside your country. The controller must ensure an applicable transfer mechanism and safeguards are in place before launch. Consult the providers’ privacy notices for their own processing.

Storage, photo retention and security

Uploaded photos are stored with the order in private application storage and are used only to create and display its Emotion gift video. Operational photo files are scheduled for deletion no later than 30 calendar days after final delivery. If an order is abandoned or not completed, its photos are scheduled for deletion no later than 30 days after the order was created. The customer may request earlier deletion at any time; mandatory legal obligations may require retaining limited order records, but not reusing photos for another purpose.

The provider must configure the daily scheduled cleanup task in the hosting environment to enforce this retention period. The task endpoint is POST /api/cron/purge-photos and must be called with the server-only CRON_SECRET. Encrypted backups may persist until their normal rotation and are not used for normal service. Order and song details are otherwise kept as needed to fulfil the order, support customers and meet accounting or legal duties. Private gift links can be shared by anyone who obtains them; do not put confidential material in a dedication.

Your rights

Subject to applicable law, you may request access, rectification, erasure, restriction, objection or portability and withdraw consent where processing relies on consent. Contact hola@nuestracancion.es. You may complain to your data protection supervisory authority; in Spain, the AEPD.

Cookies and contact

The service uses technically necessary cookies for functions such as a staff login session. No advertising or analytics cookies should be enabled without the required notice and consent. Privacy questions can be sent to hola@nuestracancion.es.

Read also: Terms and conditions · Legal notice