MusicForYou
Version operator-approved-v2-2026-08-25

Privacy notice

Last updated: 25 August 2026.

Controller

The controller is Stéphane François Xavier Lavergé, a self-employed person in Spain operating MusicForYou, NIE Z3520169R, Carrer d'Amàlia Soler, 16, 2, 08720 Vilafranca del Penedès, Barcelona, Spain. Privacy contact: stef-cloud@proton.me.

Data and sources

MusicForYou processes contact details supplied by users (name, email and optional telephone), language, questionnaire answers, memories, recipient, musical preferences, lyrics, change requests, generated files, orders, consent records and support information. Detailed payment data is handled by Stripe; MusicForYou keeps only necessary references, status and amounts.

Data may come directly from the person, from a Meta lead form or from someone preparing a gift. Users must not provide unnecessary sensitive or intimate information about another person.

Purposes and legal bases

  • preparing the preview and creating, invoicing and delivering the song: pre-contractual steps and performance of the contract;
  • payments, invoices, accounting and statutory records: contract and legal obligation;
  • link security, abuse prevention, incident handling and legal claims: legitimate interest in protecting the service;
  • support and data-rights requests: contract and legal obligation;
  • marketing messages: consent, withdrawable at any time;
  • minimised performance measurement and advertising-spend synchronisation: legitimate interest, with browser DNT/GPC respected;
  • advertising conversions using hashed identifiers: only when enabled and supported by a documented legal basis.

Only on public presentation pages, MusicForYou uses Umami for strictly necessary anonymous audience measurement: page paths without query strings or fragments, referring site, browser, operating system, device type, screen size, language, country or approximate area, and visit duration. The server uses the IP address transiently to create an anonymous session identifier that changes every month, but does not store the IP address. No cookies, advertising profiles, cross-site tracking, session recordings or heatmaps are used. Do Not Track and Global Privacy Control signals disable this measurement. This setup therefore does not require a cookie consent banner; users may nevertheless object through those browser settings or by contacting us.

Information required to create and deliver the song is mandatory. MusicForYou does not make solely automated decisions producing legal effects for the customer.

Recipients and international transfers

Access is limited to authorised people and necessary providers, depending on enabled functions: OVHcloud (hosting), OpenRouter and selected model providers (lyrics), APIFrame (music-generation gateway for Suno and Google Lyria), ElevenLabs Music (called directly), Brevo (email and consented marketing), Stripe (payments) and Meta (advertising, leads and measurement). To produce the three interpretations, APIFrame and Suno or Google Lyria, or ElevenLabs Music directly, receive the approved lyrics, title and necessary music directions, without customer contact details. Only data necessary for each task is disclosed.

APIFrame states that request logs and hosted results may be retained for up to 90 days. MusicForYou immediately downloads validated files to its private storage and never delivers a temporary provider URL to the customer.

Umami is open-source software self-hosted by MusicForYou on OVHcloud infrastructure. Audience data is not sent to Umami's publisher or reused for any other purpose.

Some providers or sub-processors may handle data outside the EEA. MusicForYou relies on the transfer safeguards announced by those providers, such as adequacy decisions or standard contractual clauses, and minimises transferred data.

Retention

  • raw technical measurement events: 72 hours;
  • anonymous Umami audience data: no more than 13 months;
  • verification links: 24 hours; privacy-request links: 72 hours;
  • unpaid projects, prospects and pre-contractual exchanges: no more than 3 years after the last activity;
  • paid-song content and gift page: as needed for delivery and support, no more than 3 years after the last activity unless the customer asks to retain or erase it earlier;
  • contracts, consent evidence, invoices and payment records: the applicable statutory period, which may be up to 6 years;
  • marketing data: until consent is withdrawn or, without interaction, no more than 3 years;
  • backups: limited rotation followed by secure overwriting under the operating cycle.

Security

Stories, lyrics, change requests and access secrets are encrypted or pseudonymised as appropriate. Links are random, private and revocable. Technical logs must not contain stories or lyrics in plain text. Administrative access is named, restricted and protected.

Rights

Data subjects may request access, rectification, erasure, restriction, objection and portability, and withdraw consent without retroactive effect. A verified email workflow supports export and erasure. Requests may also be sent to stef-cloud@proton.me.

A complaint may be lodged with the Spanish Data Protection Agency at aepd.es or the competent authority in the country of residence.

Children, third parties and changes

The service is not intended for children acting alone. A customer describing another person must limit data to what is reasonably necessary and respect that person's rights. The version accepted at checkout is retained with its consent fingerprint. Material changes are notified when required by law.

Status

This version was approved on 25 August 2026 by the MusicForYou operator for the pilot launch after reviewing the information published by APIFrame and the music providers. It had not been reviewed by a legal professional as of that date and may be updated later without retroactively changing retained consent records.