Privacy Policy – YourSongBox

Last Updated: 14 September 2026

CVPK Digital Studio LLC ("Company", "we", "our", or "us") operates www.yoursongbox.com and provides the YourSongBox platform ("Service").

This Privacy Policy explains how we collect, use, store, and protect personal data when you use our Service.

If you do not agree with this Policy, please do not use our Service.

1. Information We Collect

We collect only the data necessary to operate and deliver your personalized song.

1.1 Contact Information

• Email address (to send your song and updates)

1.2 Song Personalization Data

• Names of sender and recipient (optional)
• Personal messages and stories you submit
• Occasion type and preferences
• AI-generated lyrics and audio files

1.3 Payment Information

• Payment details (processed securely by Stripe)
• We do not store full credit card numbers or financial data on our servers.

1.4 Technical Information

• IP address, browser type, device type, and usage timestamps
• Anonymous logs for debugging and performance improvement

1.5 Communications

• Emails or messages sent to us via support or feedback channels

2. How We Use Information

We use your data to:

• Generate and deliver your personalized song via email or download
• Improve our AI models and song generation quality
• Process payments and fulfill purchases
• Provide customer support and respond to inquiries
• Ensure compliance with applicable laws and our Terms of Service

We do not use your personal messages for marketing or resale.

3. Legal Basis for Processing (GDPR)

If you are located in the EU or EEA, we process your data under the following lawful bases:

• Contractual necessity – to deliver your personalized song.
• Legitimate interest – to improve the Service, ensure security, and prevent misuse.
• Consent – when you submit your information for song creation.
• Legal obligation – for accounting and regulatory compliance.

You may withdraw consent at any time by contacting legal@cvpkdigitalstudio.com.

4. Sharing of Information

We share data only with trusted third-party providers required to operate the Service:

We do not sell or rent personal data to advertisers or third parties.

5. Data Retention

• Song files (audio and video) and the personalization data used to create them are retained for as long as we provide the Service, so your songs remain available to you.
• Payment data is retained for up to 7 years for legal and accounting obligations.
• AI-generated content may be anonymized for service improvement.

You can request early deletion at any time by emailing legal@cvpkdigitalstudio.com.

6. Data Location and Transfers

All data is stored and primarily processed in Sweden (EU).

Some processing (AI model inference or email delivery) may occur in the United States.

For transfers outside the EU/EEA, we rely on EU Standard Contractual Clauses (SCCs) to ensure adequate protection.

7. Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encrypted data transmission (HTTPS / TLS 1.3)
• Secure database access controls
• Periodic security audits
• Principle of least privilege for all internal access

No system is 100% secure, but we continuously review and update our protections.

8. Your Rights (GDPR / CCPA)

Depending on your jurisdiction, you have the right to:

• Access the personal data we hold about you
• Request correction or deletion of your data
• Withdraw consent for processing
• Object to certain processing (e.g., marketing)
• Request a copy of your data in portable format (data portability)
• File a complaint with your local supervisory authority

Requests can be sent to legal@cvpkdigitalstudio.com.

We will respond within 30 days.

9. Cookies and Tracking

We use cookies and similar technology for three things: keeping you signed in, seeing how visitors use the site, and measuring whether our ads work.

9.1 Essential Cookies

These keep you logged in and remember basic settings. The Service does not work properly without them.

9.2 Analytics and Session Replay

We use PostHog to count how far people get through making a song, Contentsquare to see how visitors move through the site, and Sentry to catch errors. Contentsquare and Sentry can record on-screen activity such as clicks, taps and scrolling. PostHog does not: it records only counts, page names and how long a step took, never what you typed. PostHog stores this in the European Union.

On the website and in the app, error reports carry a random id that is created on your device and stays there, so we can tell whether one error hit many people or hit the same person several times. It is not your account and it is not linked to your account, we never sell it or share it with anyone, and it is not used for advertising. It goes to Sentry and nowhere else. Signing out deletes it, and the next error report gets a fresh one.

9.3 Advertising

We run ads through Meta (Facebook and Instagram), TikTok and Google Ads, and use Google Analytics to see which pages bring people in. These set cookies and similar identifiers so we can measure which ads lead to a purchase.

9.4 Your Choice

If you are in the European Union, the European Economic Area or the United Kingdom, we ask for your consent before the analytics, session replay or advertising tools above load. You will see a banner with Accept and Decline options. Declining does not stop you from creating, buying or downloading your song. Your choice is saved on your device and applies to later visits; you can change it any time below.

Some information about completed purchases is sent directly from our servers to these advertising partners for measurement, and this happens whether or not you accept the banner. The banner controls what runs in your browser.

If your browser sends a Global Privacy Control signal, we treat that the same way as a decline and skip the banner, since you have already told us your preference.

Outside those regions, the tools above may load by default, in line with local law. You can opt out below at any time; a tool already running when you do will stop by your next visit.

9.5 The Mobile App

The YourSongBox iOS and Android app does not include Contentsquare, Meta, TikTok or Google Ads, so it does not show the banner described above.

The app does send us product analytics through PostHog. We count which screens you reach and how far you get through making a song, so we can fix the steps where people get stuck. Screen names, counts and how long a step took. Never what you typed, and never your story or your lyrics. Nothing is saved on your phone to do this. If you are signed in, these events carry your account ID, so that one person moving from the website to the app is not counted as two people. If you are not signed in, they carry no identifier that outlives the time the app is open.

You can turn this off in Settings, under Usage analytics. It is on until you do. This is not tracking in the sense Apple uses the word: we do not combine what you do here with data from other companies, we do not use it for advertising, and we do not touch your device's advertising identifier.

The app also uses Sentry to help us find and fix crashes, which can record on-screen activity. Unlike on the website, that is not behind a consent choice, since the app has no banner to attach one to.

We do not sell your personal data.

10. Children's Privacy

YourSongBox is not directed at individuals under 18 years of age.

We do not knowingly collect data from minors.

11. Changes to this Policy

We may update this Privacy Policy periodically.

Material changes will be communicated via email or on our website, with an updated "Last Updated" date.

12. Contact Information

Data Controller:

CVPK Digital Studio LLC

3164 21st St #1098, Astoria, NY 11106, United States

Email: legal@cvpkdigitalstudio.com

Data Storage Location: Sweden (EU)