Privacybeleid

VIRALYSTER FZCO, the United Arab Emirates company identified on this page, operates Melocarta and is responsible for the personal information it processes to provide this service. This notice explains our website, ordering, AI-assisted production, delivery, customer support, email preferences, promotional email and optional website measurement practices.

You can contact us about privacy through our contact form, the published email or the company address below. We may ask for information reasonably needed to verify a request. Please do not send passwords, complete payment card details or identity documents unless we specifically explain why a secure verification step is necessary.

You provide information about yourself and sometimes a song recipient. When you enter a valid email address in the song brief or its edit form, we save that address and the page language automatically, before you continue to checkout or pay, so it is available for your song and order communications. When you continue with that email, or save it in the edit form, it is also added to Melocarta emails about your song and occasional updates from us, as the notice beside the email field explains. You can unsubscribe at any time, and an existing unsubscribe or suppression is preserved. Continuing from the email screen also saves your completed brief as an order awaiting payment before you choose secure payment. This does not create a payment or a paid order. Information entered in the brief is also saved in your browser to help you continue later.

• Order and creative information: email, names, relationship, occasion, selected style, personal story and memories, dedication, language and edition, pronunciation guidance, requested changes, generated lyrics, recordings and cover artwork.
• Personal gift notes: a note is no longer collected during creation of a new song order. If an optional note addition is offered after the song is ready, the buyer can choose to provide the note for display on the shared gift page. Production instructions are separate from that public note. Earlier orders may retain the dedication originally supplied.
• Transaction and service information: order references, amounts and currency, Stripe customer and payment identifiers, payment/refund status, selected options, accepted policy versions, acceptance time and acceptance method, production history, delivery status and support messages.
• Tips: if you leave a tip on a song page, we record the amount, currency, song page, page language, payment and refund status and the Stripe session and payment identifiers. Stripe's form collects the email address and payment details it needs. We do not copy that email address into our records, add it to our emails or link the tip to an order.
• Email preferences and subscription records: email address, preferred email language, subscription status, how the address was subscribed, including the notice shown, its source and timestamp, withdrawal and suppression status, and messages scheduled or sent. Private song feedback can include your rating, comment and the order it concerns.
• Technical information: browser requests, service logs and security information needed to operate the site. Abuse prevention uses hashed email or network identifiers rather than exposing those identifiers in public records.
• Optional measurement: subject to the cookie choices described below, acquisition source, medium, campaign, content and term, referring host, eligible public landing path, page categories, brief steps, the email step, checkout events and verified purchase package, currency, amount and a pseudonymous transaction identifier. Private song and order pages are represented only by a generic page category. We do not send names, email addresses, stories, lyrics, form contents, signed access tokens, private link identifiers or full referral URLs to analytics.
• Optional Meta advertising measurement, only with your advertising permission: eligible public page visits, brief completion, email sign-up in the song form, selected edition/cart activity, checkout initiation and Stripe-verified purchases; amount, currency, browser and advertising-click identifiers, browser user agent and a SHA-256 hash of the email entered in the song form or at checkout for matching. Hashing does not make an email anonymous. We do not share recipient names, stories, lyrics, private production details, support data, payment card data or signed/private link identifiers with Meta.
• Team information: staff identity, role, authentication and actions in the production workspace. Access is limited according to the staff role.

We use order information to prepare and fulfill your purchase, generate lyrics and music, process payment, deliver the selected recording, retrieve an order and respond to requests. We use tip records to process and reconcile optional tips and to handle refunds and disputes. We keep relevant records for accounting, disputes, security and legal obligations. Our team uses customer and order history to understand support requests and correct the production brief.

Where applicable data protection law requires a legal basis, we rely on performance of a contract or steps requested before a contract, compliance with legal obligations, and consent where required. Where the applicable law permits it, necessary and proportionate security, service administration and dispute handling may also rely on legitimate interests. Optional acquisition measurement follows the regional consent and opt-out choices in section 6 and is not a condition of purchase.

When you continue with your email in the song form, or save it in the edit form, we use it, your email language and relevant order status to send emails about your song, including reminders about an unfinished order (the first about one hour after the order is saved), song and gift ideas and occasional updates. You can unsubscribe at any time with the link in these emails or through your email preferences. If you have unsubscribed, or an address is suppressed after delivery problems, entering it again or buying later does not subscribe it again. We record your agreement to the Terms and this notice separately, when you continue to secure payment. We use private feedback to improve the service and respond to concerns; providing feedback does not give permission to publish it as a testimonial.

AI assists with creative output. It is not used here to make a solely automated decision about your legal rights or a similarly significant eligibility decision. Publication is managed by our team. We do not use your personal story or finished song as a customer testimonial or advertising example without separate permission.

We share the information needed for a provider's role. Providers can also process certain information for their own security, legal or account purposes under their own terms. We may disclose information to professional advisers, authorities where legally required, or parties handling a business transfer subject to appropriate confidentiality and applicable law.

Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Google mailbox data is used to provide the support inbox and related customer assistance. It is not sold, used for advertising or used to train generalized AI models. Authorized staff can access the support conversations they need for that work.

Meta Platforms receives optional advertising events through Meta Pixel and the Conversions API to measure advertising and match activity to Meta accounts. This processing may support advertising personalization within Meta. Explicit advertising permission through Allow all is required in every country, including where analytics uses a regional default. Meta processes received information under its own privacy policy (https://www.facebook.com/privacy/policy/).

AI providers have their own retention and data-use rules. Melocarta does not promise that every model operates with zero retention or that provider training is disabled for every request. Do not include confidential or sensitive information that is unnecessary for the song. Contact us before submitting material that requires special handling.

Google API Services User Data Policy

• Railway hosts the application, database and private object storage used for permanent recordings and covers. Authorized requests are checked by our application before media is served.
• Cloudflare provides the domain name service for our website and a network proxy in front of our hosting. Requests to our website, including information you enter in our forms, pass through Cloudflare's network, which processes the connection IP address and request details to deliver the site and protect it against attacks, and supplies the approximate country of the connection described in section 6.
• Stripe processes payments, including optional tips, and related fraud prevention. Payment details are entered in Stripe's form; Melocarta does not receive full card numbers or security codes. Stripe may collect device, transaction and fraud-prevention information through its payment services.
• OpenRouter routes creative requests to the selected underlying AI model provider. Relevant brief details, including recipient names and personal memories when supplied, can be included in the prompt.
• Kie.ai processes music-generation requests using the selected music service, including Suno models. Requests contain the approved lyrics, title and musical direction, which can themselves include personal details from your brief.
• Google Analytics measures visits, funnel progress and purchases according to the regional cookie choices described below. Google receives the limited measurement fields described above and processes connection and device information when the tag loads. Advertising personalization and Google signals are disabled in our tag configuration. Google Analytics may use first-party cookies, including _ga cookies, configured here to expire after up to 180 days and renewed by permitted activity. Analytics consent is separate from purchase and marketing email permission. Google processing and retention also depend on the Analytics property configuration; we do not claim that our 90-day internal cleanup deletes Google-held data.
• Google Workspace/Gmail provides our connected support mailbox. After an administrator authorizes the connection, the service reads incoming support email and stores relevant sender details, subject, dates, message identifiers and text in our support workspace. It sends staff replies through that mailbox using our approved support sender address, which may be a verified alias. Authorized staff can archive conversations, mark messages read or unread, move conversations to or from spam, and apply or remove existing Gmail labels. These actions change the corresponding Gmail conversation. Formatted email is retrieved on demand for a restricted HTML view; scripts are removed and external images are blocked unless a staff member chooses to load them. Staff may remember this image-loading choice for a sender address and reverse it later. Attachments are retrieved from Gmail on demand for staff viewing or download, subject to size and file-type limits. Loading external images can disclose a network address and viewing activity to the image host. This connection does not automatically submit inbox content to AI providers or use it for advertising.
• Plunk provides our automated service notifications and promotional email when those sending features are enabled. Promotional messages go to addresses that have not unsubscribed and were submitted in the song form (by continuing with them or saving them in the edit form) or subscribed in another way. Plunk may receive your address, preferred email language, subscription and suppression status, limited order or workflow identifiers and status, email content and the links needed for that message. We do not copy private stories, lyrics, production notes or Gmail conversations into marketing contact profiles. Support conversation replies use our separately connected Google Workspace mailbox. We process message acceptance, delivery, bounce and complaint status where available. When tracking is enabled in the email service, open or click information may also be processed. Emails about test checkouts, which are not real charges, are sent the same way and marked as test records.

Delivered customer songs and published studio songs appear in our public gallery, regardless of language. Visitors can discover song pages, see the displayed names, dedication, lyrics and artwork, and listen to or download the full recording. Song pages are not account-private. Information in the song can therefore be seen by people you have not personally sent the link to. To have a song removed from the gallery, email us at hello@melocarta.com.

The public song page does not display the customer email field or internal production notes. Personal information you include in the dedication or lyrics can still appear on that page. Your order-management and recovery links provide separate access to order information and should be kept private. If you share a song or download it to another platform, that platform and recipients handle their copies independently of Melocarta.

When including another person's story, use information you have permission to share and tell them about this notice where appropriate. Buyers must be adults. A song can be a gift for a child, but avoid unnecessary identifying details, health information and other sensitive information. Contact us if you believe a child has submitted information directly or if recipient information should be corrected or removed.

Some browser storage supports features you request. Your current song draft and checkout attempt are stored locally so you can continue the brief and retry checkout. The current draft has no automatic expiry; it is cleared when the matching completed checkout is recognized, when you start fresh, or when you remove it or clear site data in your browser. On a shared device, clear a draft you do not want another user to see.

Language preferences can use the NEXT_LOCALE cookie. Staff login uses the melocarta_session authentication cookie with a 14-day session duration. Customer access to My songs uses an emailed four-digit code valid for 10 minutes and the essential melocarta_library authentication cookie for up to 30 days. Signing out removes this browser’s customer access cookie. Access-code verification records use a keyed hash, limit incorrect attempts, and are eligible for scheduled deletion one day after expiry. The service email containing the code is processed through our notification provider and stored with our service email records. Stripe can use cookies or similar technologies needed for payment and fraud prevention. Blocking required storage can prevent these features from working.

When optional analytics is enabled, we use the approximate country of your connection to select the cookie experience. Cloudflare supplies this country with each request that passes through its network; for a request that reaches our hosting directly, our server looks the country up from the connection IP address in a local database. We do not send the address to a separate geolocation service or store it in our analytics records. For connections identified as United States, analytics can start without an initial consent banner, subject to your saved choices and Global Privacy Control. In other countries, or if the location cannot be determined reliably, analytics stays off until you accept. You can select Essential only at any time using Cookie settings. An explicit choice is remembered for up to 180 days; a regional default is not recorded as your consent. If allowed, the mc_acquisition cookie identifies a session and expires after 30 minutes of inactivity, renewed by eligible activity. The tracker respects the browser's Global Privacy Control signal.

We also use this approximate country, whether or not analytics is enabled, to choose the currency of the prices we show and charge. We do not store the address or the detected country for this purpose; the order records its currency and the prices it was quoted.

Meta advertising measurement remains off until you select Allow all in the cookie notice or Cookie settings. This optional button permits both analytics and Meta advertising measurement, as disclosed beside it; there are no preselected checkboxes. Your advertising choice and our signed mc_meta consent cookie last up to 180 days. Browser identifiers _fbp and, when present, _fbc last up to 90 days. If you arrive from a Meta ad, its click identifier is kept only in the page's memory and is stored in _fbc only after you select Allow all. Global Privacy Control prevents this collection. Essential only withdraws both analytics and Meta permission, removes our advertising cookies and cancels pending Meta events. A request already sent cannot be recalled. Previously given analytics or email permission never enables Meta measurement.

Use Cookie settings in the website footer or below the creation and song pages to change your optional analytics and advertising choices when those features are enabled. Declining is as available as allowing. Withdrawing permission stops future optional collection; it does not automatically remove earlier records or essential order records. You can request deletion through the contact form where applicable.

We retain order, payment, creative, support and delivery records for as long as needed to provide the purchased service, respond to requests, satisfy legal and accounting obligations and handle disputes. There is currently no single automatic deletion period for all customer records or stored songs. Retention depends on the record and purpose; you can ask us to review information we hold about you.

We retain subscription records and the limited suppression information needed to honor opt-outs. Unsubscribing stops promotional messages; it does not delete records needed for orders or support. You may ask us to review or delete information, subject to applicable obligations.

Our scheduled cleanup removes acquisition sessions older than 90 days and their associated funnel events. An attribution summary copied into an order remains part of the order record and is not removed by that analytics cleanup. Expired abuse-prevention records are eligible for cleanup one day after expiry. Browser-storage periods are described above.

Our scheduled cleanup deletes Meta event payloads after seven days and expired advertising consent sessions after 180 days. Checkout records retain the consent-session reference as evidence of the original choice. Withdrawal stops future dispatch and cancels pending events; it does not erase events already received by Meta. Provider retention and deletion are governed by its own policy and applicable rights.

A support-mailbox administrator can disconnect Google access from Settings and revoke the connection in their Google account. Disconnecting stops future mailbox access and removes the stored connection credential; it does not automatically erase support conversations already imported into Melocarta or messages held in Google Workspace. Imported messages follow our support-record retention and privacy-request process.

A deletion request is reviewed across the relevant order, support, media and provider records, subject to information we must lawfully retain. Removal from the active service may not immediately remove information in restricted backups, legal records or independent provider systems. We will explain any applicable limits. We cannot retrieve copies of a song already downloaded or shared by someone else.

Our company is in the United Arab Emirates. Our current Railway hosting includes European infrastructure. Cloudflare handles requests in its global network, usually at a location near the visitor, and payment, AI and email providers may process information in other countries. The currency of your order does not indicate where your information is stored. Applicable transfer requirements depend on the data, provider and jurisdiction.

We use access controls, staff roles, protected credentials and private object storage to reduce unauthorized access. Payment collection remains with Stripe. No online system or shared download link can be guaranteed completely secure. If an incident requires notice under applicable law, we will provide that notice.

Depending on the law that applies to you, you may have rights to access your information, correct it, request deletion, receive a portable copy, restrict processing, object to certain processing or withdraw consent. Withdrawal does not affect processing that was lawful before withdrawal. Some information may still be needed to complete your order or meet legal obligations.

Submit a privacy request through the contact form linked below and identify the email or order concerned. We will review the request, verify identity proportionately where needed, and respond within the period required by applicable law. If we cannot grant a request in full, we will explain the reason and any available next steps. You may also complain to a competent data protection authority where you have that right.

You can choose not to provide optional information, clear stored drafts on your device, keep order-management links private, and decline optional analytics. Essential order and payment information is needed to supply the service you purchase. Service emails are used for your transaction and support. Continuing with your email in the song form, or saving it in the edit form, also adds it to our promotional emails, which you can stop at any time.

You can stop promotional email using the unsubscribe link in a marketing message and change the available email preferences. Entering your email again, a purchase or a later website visit does not reverse an opt-out. Essential order and support messages may continue. Choosing a preferred email language does not change the language or other details of a purchased song.

We update this notice when our service, providers or data practices materially change. The version date appears on this page. Where required, we will provide additional notice or obtain consent before starting a materially different use. A new policy does not by itself give permission to use earlier information for a new purpose that requires your consent.