Privacy Policy

Send Love is operated by Synth Investments LLC, a California limited liability company. For any privacy-related question or request, contact us at contact@synthcreatives.com. For the purposes of EU and UK data-protection law (where applicable), we are the data controller for the personal data described below.

From you, when you place an order:

• Order details — recipient label, occasion, genre, your story, optional name pronunciation guide, optional vocal-gender preference, and your email address.
• Payment confirmation from Stripe — we do not see or store your card number, CVC, or full bank details. Stripe sends us a payment confirmation token and basic transaction metadata (amount, currency, country of card issuer).

Automatically, when you use the Site:

• Basic technical data — IP address, user agent, referring page, timestamps, and the pages you visit — collected by our hosting provider and used for security, fraud prevention, and aggregate analytics.
• If you contact support — your message contents and email reply thread.

We do not collect: card numbers, banking credentials, government IDs, biometric data, precise location data, or any "special category" data under GDPR unless you voluntarily include it in your story (we ask you not to).

We use only the strictly necessary cookies required to operate the Site (such as the Stripe Checkout session cookie and the Vercel hosting cookie). We do not use advertising cookies, behavioral-tracking cookies, or cross-site tracking pixels. If this changes in the future, we will update this policy and, where required, present a consent banner before any non-essential cookie is set.

We use the personal data above only for the following purposes:

• To create and deliver your personalized song (the contract you place with us).
• To send transactional emails about your order — confirmation, delivery, and up to one post-delivery review-request email.
• To prevent fraud, abuse, and unlawful use of the Site.
• To comply with our legal obligations (tax, accounting, regulatory requests).

We do not use your data for marketing, behavioral profiling, or targeted advertising, and we never sell or share your personal data for cross-context behavioral advertising.

To produce your song we send your story, occasion, genre, and other inputs to third-party AI services (see Section 7) which generate lyrics and audio from those inputs. We have selected providers that, as of the date of this policy, represent in their own published terms that they do not use customer inputs to train their public general-purpose models. We do not control the upstream providers and cannot guarantee they will never change those terms. If you do not want your story processed by a third-party AI service, do not place an order.

If you are located in the United Kingdom or European Economic Area, we process your personal data on the following legal bases under the UK GDPR and EU GDPR:

• Contract performance (Article 6(1)(b)) — to produce and deliver the song you ordered.
• Legitimate interests (Article 6(1)(f)) — for site security, fraud prevention, and product improvement, balanced against your interests.
• Legal obligation (Article 6(1)(c)) — for tax records and regulatory compliance.
• Consent (Article 6(1)(a)) — where we ever ask for it specifically (for example, an optional newsletter, which we currently do not offer). You can withdraw consent at any time without affecting prior processing.

We share data only with the service providers who help us run the Site. Each is bound by a written data-processing agreement (where required by applicable law) and is permitted to use your data only on our instructions and only for the purpose listed.

• Stripe — payment processing (Stripe, Inc., USA / Stripe Payments Europe Ltd, Ireland).
• Resend — transactional email delivery (Resend, Inc., USA).
• Supabase — database and private file storage (Supabase Inc., USA).
• Vercel — application hosting (Vercel Inc., USA).
• kie.ai — AI model API access for lyrics and music generation (NEXUSAI SERVICES LLC, USA), which re-distributes models from upstream providers including Suno.
• Slack — internal order-monitoring notifications (Slack Technologies, LLC, USA). We do not send your email, full name, or payment data to Slack.

We may also disclose data when required by law, in response to a lawful subpoena or court order, to investigate fraud or security incidents, to enforce our Terms, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you).

We are based in the United States and most of our processors are based in or transfer data to the United States. Where personal data of UK or EU residents is transferred outside the UK/EEA, we rely on the safeguards provided by our processors, which include the EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, and (where applicable) the EU–US, UK–US, and Swiss–US Data Privacy Frameworks. By placing an order from outside the U.S., you understand that your personal data will be transferred to and processed in the U.S.

• Order record + finished song: minimum 12 months from delivery, so we can re-deliver and support you. After that we may retain it longer for statistical or backup purposes, but no longer than reasonably necessary.
• Payment records: as long as required by applicable tax and accounting law (typically up to 7 years in the U.S.).
• Support correspondence: up to 2 years after the last reply.

You can ask us to delete your data sooner at any time — see Section 10.

Depending on where you live, you may have some or all of the following rights:

• Right to access the personal data we hold about you.
• Right to correction of inaccurate or incomplete data.
• Right to deletion ("right to be forgotten" under GDPR; "right to delete" under CCPA/CPRA).
• Right to portability — a copy of your data in a machine-readable format.
• Right to restrict or object to certain processing.
• Right to opt out of sale or sharing of personal data. We do not sell or share personal data for cross-context behavioral advertising. This disclosure is required by California law even when the answer is "no."
• Right to non-discrimination for exercising your privacy rights under California law.
• Right to lodge a complaint with your local data-protection authority (UK: Information Commissioner's Office; EU: your national supervisory authority).

To exercise any of these rights, email contact@synthcreatives.com from the email address associated with your order. We respond within 30 days (extendable to 90 in complex cases as permitted by law).

The Site is not directed to children. We do not knowingly collect personal data from anyone under 13 (or under 16 in the United Kingdom and European Economic Area). If you believe a child has provided us personal data, email contact@synthcreatives.com and we will delete it promptly.

We use industry-standard technical and organizational measures to protect your data, including TLS encryption in transit, encryption at rest in our hosting provider, and access controls on our administrative tools. No system is perfectly secure, and we cannot guarantee absolute protection of your data.

Some browsers send "Do Not Track" or Global Privacy Control signals. Because we do not engage in cross-site tracking or sale/share of personal data, our behavior is the same whether or not these signals are present.

We may update this policy from time to time. The updated version takes effect when posted with a new "Last updated" date above. If a change materially affects how we process the data of recent customers, we will notify those customers by email.

Privacy questions, data requests, or complaints — email contact@synthcreatives.com. Postal address available on request.