Privacy Policy

1. Introduction

1.1 Custom Songs For Life ("we," "us," or "our") is committed to protecting and respecting the privacy of every person who visits our website or purchases our services. This Privacy Policy explains how we collect, use, store, share, and protect your personal information.

1.2 This policy applies to all visitors to our website at www.customsongsforlife.com and all Customers who place orders for our custom song creation services. Custom Songs For Life, located at Potomac, Maryland, United States of America, is the Data Controller for the purposes of the GDPR and UK GDPR. For privacy-related inquiries, contact: [email protected].

1.3 By using our Site or placing an order, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any aspect of this policy, you should discontinue use of the Site.

2. Information We Collect

2.1 Personal Information You Provide to Us

We collect personal information that you voluntarily provide when using the Site or placing an order, including:

• Identity information: Your full name;
• Contact information: Your email address and billing address;
• Payment details: Credit/debit card information or PayPal account details. Note: payment details are processed entirely by our third-party payment processors (e.g., Stripe, PayPal) and are not stored by Custom Songs For Life; and
• Order and creative brief information: Details about the occasion, personal stories, names of individuals the song is about, musical preferences, and any other information you submit as part of your order.

2.2 Information Collected Automatically

When you visit our Site, certain technical information is collected automatically through cookies and analytics tools, including:

• IP address and approximate geographic location;
• Browser type and version;
• Device type and operating system;
• Pages visited and time spent on the Site;
• Referring URLs (the website that directed you to our Site); and
• Other standard web analytics data.

3. How We Use Your Information

3.1 We use the personal information we collect for the following purposes:

• To process and fulfill your order, including creating your custom song based on the information you provide;
• To communicate with you about your order status, including confirmation emails, production updates, and delivery notifications;
• To deliver your completed song files via email;
• To respond to customer service inquiries and support requests;
• To send transactional emails related to your order (e.g., receipts, revision confirmations);
• To improve the Site and our services based on usage patterns and customer feedback;
• To comply with applicable legal obligations, including tax and accounting requirements; and
• To send occasional marketing communications, such as promotional offers or newsletters, where you have provided consent or where we have a legitimate interest in doing so. You may opt out at any time via the unsubscribe link in any marketing email.

4. Legal Basis for Processing (GDPR)

4.1 For users located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases:

5. How We Share Your Information

5.1 We do not sell, rent, or trade your personal information to any third parties for their own marketing purposes.

5.2 We may share your information with the following trusted third-party service providers, strictly as necessary to operate our business and fulfill your order:

• Payment processors (e.g., Stripe, PayPal) — to securely process your payment transactions;
• Email delivery providers — to send transactional and marketing emails on our behalf;
• Analytics providers (e.g., Google Analytics) — to help us understand how visitors use the Site; and
• Legal or regulatory authorities — where required by law, court order, or government authority.

5.3 All third-party service providers are contractually required to handle your data securely, to use it only for the purposes for which it is shared, and to comply with applicable data protection laws.

6. Cookies & Tracking Technologies

6.1 Our Site uses cookies and similar tracking technologies to enhance your experience and collect analytical data. The types of cookies we use include:

• Essential cookies: Necessary for the Site to function properly (e.g., session management, shopping cart). These cannot be disabled without affecting Site functionality.
• Analytics cookies: Used to collect aggregated, anonymized data about how visitors interact with the Site (e.g., Google Analytics).
• Marketing cookies: Used to deliver relevant advertisements and track the effectiveness of marketing campaigns (only used where you have provided consent).

6.2 You may control or disable cookies through your browser settings at any time. Instructions for managing cookies can typically be found in your browser's help section. Please note that disabling certain cookies may affect the functionality of the Site.

6.3 Where required by law, we will seek your consent before placing non-essential cookies on your device.

7. Data Retention

7.1 We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law:

• Order and transaction data (including creative briefs and delivered files): Retained for 7 years from the date of the order, for US tax and legal compliance purposes, or as required by applicable law.
• Marketing data (email addresses for marketing communications): Retained until you opt out of communications, or for 2 years of inactivity, whichever comes first.
• Support correspondence: Retained for 2 years from the date of the last interaction.
• Technical/analytics data: Retained for up to 26 months (Google Analytics standard); anonymized data may be retained for longer for aggregate trend analysis.

7.2 You may request the deletion of your personal data at any time, subject to our right to retain data where required by law or for the defense of legal claims. Upon expiry of the applicable retention period, data will be securely deleted or anonymized.

8. Data Security

8.1 We take the security of your personal data seriously and implement industry-standard technical and organizational measures to protect it against unauthorized access, loss, alteration, or disclosure. These measures include:

• SSL/TLS encryption for all data transmitted via the Site;
• Access controls limiting data access to authorized personnel only; and
• Secure, password-protected systems for storing order and customer data.

8.2 However, no method of electronic transmission or storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

8.3 Maryland Breach Notification (MPIPA). In the event of a security breach involving Maryland residents' personal information, Custom Songs For Life will provide notification to affected individuals without unreasonable delay and no later than 45 days after discovery of the breach, as required by the Maryland Personal Information Protection Act (Md. Code, Com. Law § 14-3504). Notification will be provided by email to the address on file. If the breach affects more than 175,000 Maryland residents or more than 10,000 Maryland payment card records, we will also notify major consumer reporting agencies as required by law. We will additionally notify the Maryland Attorney General of any qualifying breach affecting Maryland residents.

8.4 GDPR/UK GDPR Breach Notification. For EU/EEA and UK customers, in the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (per GDPR Art. 33 and UK GDPR Art. 33). Where the breach is likely to result in a high risk to you, we will notify you directly without undue delay (per GDPR Art. 34).

8.5 Employee Access Controls. Access to customer personal data is restricted to authorized personnel on a strict need-to-know basis. All staff with access to personal data are bound by confidentiality obligations and receive regular data protection training.

9. Your Rights

9.1 Rights for EU/EEA Users (GDPR)

If you are located in the European Union or European Economic Area, you have the following rights with respect to your personal data:

• Right of Access: To request a copy of the personal data we hold about you;
• Right to Rectification: To request correction of inaccurate or incomplete data;
• Right to Erasure ("Right to be Forgotten"): To request deletion of your data, subject to certain legal conditions;
• Right to Data Portability: To receive your data in a structured, commonly used, machine-readable format;
• Right to Object: To object to the processing of your data for direct marketing or where processing is based on legitimate interests; and
• Right to Restriction: To request that we restrict processing of your data in certain circumstances.

9.2 Rights for UK Customers (UK GDPR / Data Protection Act 2018)

UK customers have the same rights as EU/EEA customers listed above (access, rectification, erasure, portability, objection, restriction, and not to be subject to solely automated decision-making). The UK supervisory authority is the Information Commissioner's Office (ICO) — ico.org.uk. You may lodge a complaint with the ICO if you believe your data protection rights have been violated.

9.3 Maryland Residents (MODPA — Maryland Online Data Privacy Act)

Maryland residents have the following rights under the Maryland Online Data Privacy Act (MODPA), Md. Code, Com. Law § 14-4601 et seq. (effective October 1, 2025):

• Right to Access: Confirm whether we process your personal data and obtain a copy of it.
• Right to Correction: Request correction of inaccurate personal data we hold about you.
• Right to Deletion: Request deletion of personal data you have provided or that we have collected about you, subject to legal retention obligations.
• Right to Data Portability: Receive a portable copy of your personal data in a format that allows transfer to another controller.
• Right to Opt Out: Opt out of (a) the sale of personal data; (b) targeted advertising using your personal data; and (c) profiling that produces legal or similarly significant effects. Note: Custom Songs For Life does NOT sell personal data or use it for targeted advertising or profiling.
• Non-Discrimination: We will not discriminate against you for exercising any of the above rights.
• Right to Appeal: If we decline to act on your request, you may appeal by emailing [email protected] with subject line "MODPA Appeal." We will respond within 60 days. If your appeal is denied, you may contact the Maryland Attorney General's office at oag.state.md.us.

To exercise any MODPA right, email [email protected] with subject line "Maryland Privacy Rights Request" and include your full name, email address used at checkout, and specific request. We will respond within 45 days (extendable by 45 additional days with notice).

9.4 Rights for California Residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: The categories and specific pieces of personal information we have collected about you;
• Right to Delete: To request deletion of personal information we have collected, subject to certain exceptions;
• Right to Correct: To request correction of inaccurate personal information we hold about you;
• Right to Opt Out of Sale or Sharing: We do not sell personal information. No action is required to exercise this right; and
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

9.5 Do Not Sell or Share My Personal Information

Custom Songs For Life does NOT sell, rent, or share personal information with third parties for monetary consideration or for cross-context behavioral advertising, as defined under the CCPA/CPRA and equivalent state privacy laws. We share personal data only with service providers acting on our behalf under binding data processing agreements. To opt out of any future data sharing for advertising purposes, email [email protected] with subject line "Do Not Sell My Information."

9.6 Virginia, Colorado, Connecticut, Texas & Other US State Residents

We honor opt-out of targeted advertising, sale of personal data (not applicable — we do not sell), and profiling rights as required by applicable state privacy laws including the Virginia CDPA, Colorado CPA, Connecticut CTDPA, and Texas TDPSA. Submit requests to [email protected].

9.7 Canadian Residents (PIPEDA / Quebec Law 25)

Canadian residents have the right to access and correct personal information we hold, and to withdraw consent to processing. Quebec residents have enhanced rights under Law 25 (Act to modernize legislative provisions as regards the protection of personal information). Privacy officer contact: [email protected].

9.8 Australian Residents (Privacy Act 1988 / APPs)

Australian residents have the right to access and correct personal information held about them under the Privacy Act 1988 and the Australian Privacy Principles (APPs). If your concern is not resolved after contacting us, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9.9 Automated Decision-Making

Custom Songs For Life does not use automated decision-making or profiling processes that produce legal or similarly significant effects on customers, as defined under GDPR Article 22. Our order fulfillment process is human-managed.

9.10 How to Exercise Your Rights

To exercise any of the rights listed above, please email [email protected] with subject line "Privacy Rights Request", including your full name, email address, country of residence, and specific request. We will acknowledge your request within 72 hours and provide a full response within 30 days (or the shorter timeframe required by applicable law). Identity verification may be required before processing your request. Authorized agent requests accepted with written authorization signed by the customer.

10. Children's Privacy

10.1 Our services are not directed to, and are not intended for use by, children under the age of 13 years. We do not knowingly collect personal information from children under 13.

10.2 If you are a parent or guardian and you believe that your child has provided us with personal information without your consent, please contact us immediately at [email protected]. We will take prompt steps to delete such information from our records.

11. Third-Party Links

11.1 Our Site may contain links to third-party websites, services, or platforms. These links are provided for your convenience and informational purposes only. Custom Songs For Life has no control over the content, privacy practices, or policies of any third-party sites.

11.2 We strongly encourage you to review the privacy policies of any third-party websites you visit. Custom Songs For Life is not responsible for the privacy practices of any third party.

12. International Data Transfers

12.1 Custom Songs For Life is operated from the United States. If you are accessing our Site or placing an order from outside the United States, please be aware that your personal information may be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your country.

12.2 Where we transfer personal data from the EEA or UK to the United States or other third countries, we implement appropriate safeguards to ensure that your data receives an adequate level of protection, including reliance on standard contractual clauses where required.

13. Changes to This Privacy Policy

13.1 We reserve the right to update or amend this Privacy Policy at any time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will update the "Last Updated" date at the top of this policy.

13.2 Where changes are significant, we will notify you by email (if you are a registered customer) or by posting a prominent notice on the Site. We encourage you to review this policy periodically to stay informed about how we protect your information.

14. Contact

14.1 If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy team:

Custom Songs For Life · Global Legal Policies · Effective September 26, 2026 · © 2026 Custom Songs For Life. All rights reserved. · Potomac, Maryland, USA