Loading...
Last updated: 2 September 2026
At GiftSong, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service to create and generate personalised songs.
GiftSong is the controller of the personal data described in this policy. If you have questions, or want to exercise any of your privacy rights, contact us at support@giftsong.ai.
You can create a GiftSong account using Sign in with Google. If you do, Google shares a limited set of information with us, and only after you approve it on Google's consent screen. We request the basic profile scopes only, which are email, profile and openid. We receive:
We never request access to Gmail, Google Drive, Contacts, Calendar, or any other Google service. We cannot read, change or delete anything in your Google account.
We use this information only to run features you can see:
We do not use Google user data to train, retrain or improve any generative AI or machine learning model. We do not sell it, we do not pass it to data brokers, and we do not use it to make credit decisions.
Your Google account email, name and profile picture are stored by Supabase, which hosts our database and handles authentication on our behalf. When you buy something, your email address is also passed to Stripe so that your receipt reaches you. We do not share Google user data with anyone else to run the service.
There is one further transfer you should know about. When you make a purchase, we send an irreversible SHA-256 hash of your account email address to Meta, so that the purchase can be matched to an advertisement you saw. This happens on our servers as part of completing your order, so the cookie banner does not control it, and the hash cannot be turned back into your email address. If your account was created with Sign in with Google, that hashed value is derived from your Google account email. You have the right to object to this: email support@giftsong.ai and we will stop it for your account.
Google user data travels over encrypted HTTPS connections and is stored encrypted at rest in our Supabase database. Access is governed by row level security, so no other account can read your data. Only a small number of staff can reach production systems, using individually issued credentials, and we keep a log of administrative actions. We never store your Google password, because you enter it on Google's own sign-in page and we never see it.
We keep your Google account data for as long as your GiftSong account exists. If you ask us to delete your account, we remove that data within 30 days, and it disappears from routine backups within a further 90 days. Records tied to a purchase are kept for 7 years, because tax and accounting law requires it.
To delete your account, email support@giftsong.ai from the address you signed up with, and we will confirm once it is done. You can also disconnect GiftSong from your Google account at any time at myaccount.google.com/permissions. Disconnecting stops future sign-ins, but it does not by itself delete the data we already hold, so email us as well if you want it erased.
GiftSong's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. developers.google.com/terms/api-services-user-data-policy
We do not sell your personal data. We share it with the service providers who help us run GiftSong, and only as far as each one needs it to do its job:
We may also disclose personal data where the law requires it, or where we need to establish or defend a legal claim. If GiftSong is ever sold or merged, your data may transfer to the new owner, who would remain bound by this policy.
We use cookies and similar technologies. Cookies that are strictly necessary to run the site, keep you signed in and protect checkout are always on, because the service cannot work without them. Analytics and advertising cookies load only after you accept them, and you can change your mind at any time using the Cookie Settings link in our footer.
Until you accept, Google Consent Mode keeps analytics and advertising storage switched off. We use Google Analytics and PostHog to understand how the product is used, and Google Ads, Meta and TikTok to measure whether our advertising is reaching people who would like a personalised song. Separately from these cookies, and as explained in section 3.3, a hashed version of your email address is sent to Meta when you make a purchase, so that the sale can be attributed to an advertisement.
To make your song, we send the details you write in your brief to the AI providers listed above. That usually includes the recipient's name, your relationship to them, and the memories, in-jokes and details you want woven into the lyrics. Please only include things you are comfortable sharing, and only write about someone else if you have their agreement.
These providers process your content only to produce your song, and we do not use your content to train our own AI models. Your Google account data is never sent to them. Because the lyrics and music are generated by a model, the result will not be identical for two people writing the same brief, and we cannot guarantee any particular outcome.
We use Supabase for our database, authentication and file storage, and Vercel to host the website. Your data is encrypted in transit using HTTPS and encrypted at rest. Access to your songs and account details is governed by row level security, so no other user can read them. Access to production systems is limited to a small number of staff using individually issued credentials, and administrative actions are logged. No system can be guaranteed perfectly secure, but we review our security regularly, and if a breach ever affects your personal data we will tell you and the relevant regulator as the law requires.
We use Stripe for payment processing. Your payment information is handled securely by Stripe and is not stored on our servers. We only store the necessary information to manage your subscription.
GiftSong is operated from the United Kingdom, and several of the service providers listed above are based in the United States or elsewhere. This means your personal data may be processed outside the country you live in. Where we transfer personal data out of the United Kingdom or the European Economic Area, we rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision covering the destination country, so that your data keeps an equivalent level of protection wherever it goes.
We keep your data only as long as we need it:
To delete your account and everything in it, email support@giftsong.ai from the address you signed up with. We will confirm once it is done, and in any case within 30 days. If you signed in with Google, see section 3.5 for how to disconnect GiftSong from your Google account as well.
You have the right to:
We process your data on four grounds: to perform our contract with you, when we create and deliver the song you ordered; with your consent, for marketing emails and for analytics and advertising cookies; for our legitimate interests, in keeping the service secure and improving it; and to meet a legal obligation, when we keep financial records.
To exercise any of these rights, email support@giftsong.ai and we will respond within one month. There is no charge. If you are not happy with our response, you can complain to the Information Commissioner's Office at ico.org.uk, or to the data protection authority in the country where you live.
GiftSong is not designed for children. You must be at least 13 years old to create an account, and if you are under 18 you should have a parent or guardian's permission before you buy anything. We do not knowingly collect data from children under 13. If you believe a child has given us their information, email support@giftsong.ai and we will delete it.
If you have any questions about this Privacy Policy or our data practices, please contact us at: support@giftsong.ai
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this page.