Privacy Policy

1. Introduction

SelectedSongs ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy describes the information we collect, how we use it, the parties to whom it is disclosed, the methods of disclosure, and the security practices we have in place to safeguard your information. By using our Service, you acknowledge the data practices described in this policy. Where the law requires your consent, we ask for it separately (see Section 6).

Data Controller

SelectedSongs is the data controller responsible for your personal data. SelectedSongs is operated by REM Vision LLC, 11300 Rockville Pike, Suite 1001, Rockville, MD 20852, USA. For questions about how we handle your data, contact us at info@selected-songs.com.

EU/EEA Representative (GDPR Article 27)

As SelectedSongs is established outside the European Economic Area and the United Kingdom, Article 27 of the GDPR and of the UK GDPR require us to appoint a representative in the EU and in the UK. We have not yet appointed them, and we will update this page with their contact details once they are appointed. Until then, direct any data protection inquiry to info@selected-songs.com, and you may also contact your local supervisory authority.

2. Information We Collect

We collect the following categories of information:

Personal Information

• Contact Information: Email address for order confirmations, delivery, and customer support
• Payment Information: Processed securely through our payment processor; we do not store credit card numbers on our servers
• Names: Recipient names and your name (if provided) for song personalization
• Sign-In Information: The email address you use to sign in and the sign-in link emails we send you. We use no passwords and store none. Your account is simply the orders and Song Plans placed under your email address; we do not keep a separate profile. A sign-in cookie keeps you signed in on your browser (see Section 6). Providing your email address is required to place an order and to sign in

Song Plan (Subscription) Information

If you buy a Song Plan, we also keep the following:

• Billing Identifiers: The Stripe customer ID and subscription ID that link your plan to our payment processor
• Plan Details: Plan status (for example introductory period, active, past due, or cancelled), the dates of the current billing period, the number of songs remaining in the current cycle, the number of cycles paid, which version of our offer you signed up under, and the visit and advertising-attribution identifiers recorded when you signed up
• Billing Records: A record of each plan payment: amount, currency, date, and whether it was the introductory payment or a renewal payment. We do not store card numbers
• Cancellation Information: The date you cancelled or your plan ended. When you cancel in the billing portal you may be asked for a cancellation reason; any reason you give is collected and held by Stripe
• Billing Portal Information: Anything you enter in the Stripe billing portal, such as your name, billing address, or phone number, is held by Stripe. Changing your email address there does not change the email address we use for sign-in and plan emails
• Whether Providing Data Is Required: The information above is necessary to set up, bill, and manage a Song Plan. Without it we cannot provide the plan

Content Information

• Memories and Stories: Personal stories, memories, and details you share for song creation
• Sensitive / Special Category Information: Your stories may voluntarily include sensitive information such as health conditions, religious or philosophical beliefs, racial or ethnic origin, or other special category data (as defined by GDPR Article 9). By choosing to include such information in your stories, you ask us to process it, and we process it solely for the purpose of creating your personalized song. You may ask us to stop and to delete it at any time by contacting info@selected-songs.com, though this may affect our ability to complete your order. Please do not include sensitive information about other people, such as another person's health, religion, or ethnic origin, unless that person has agreed that you may share it
• Preferences: Genre, decade, voice, occasion, and style preferences
• Generated Content: Lyrics and audio files created for your order

Technical Information

• Device Information: Browser type, operating system, and device type
• Usage Data: Pages visited, time spent on site, and interaction patterns
• IP Address: For security, fraud prevention, and approximate geolocation purposes
• Referral Data: How you found us (UTM parameters, referrer URLs)

3. How We Use Your Information

We use the collected information for the following purposes:

• Service Delivery: To create and deliver your custom song
• Communication: To send order confirmations, delivery notifications, remake updates, and respond to inquiries. Sign-in links and Song Plan service emails (welcome, renewal, failed payment, cancellation, and any notices of changes to your plan that we send) are service messages that we send even if you opt out of promotional emails
• Payment Processing: To process transactions securely through our payment provider
• Sign-In: To verify your email address, send you sign-in links, and show you your orders and plans after you sign in
• Song Plan Administration: To set up and bill your plan, track the songs available in each cycle, process cancellations and failed payments, and keep billing records
• Service Improvement: To analyze usage patterns and improve our service
• Security: To prevent fraud, unauthorized access, and other malicious activities
• Legal Compliance: To comply with applicable laws and regulations
• No AI Training: We do not use your stories, memories, or personal submissions to train public AI models. Your content is processed solely to create your personalized song and is not used to improve or train third-party AI systems

Automated Processing and Decision-Making

Our Service uses automated processing, including artificial intelligence, to generate lyrics and music based on the information you provide. This automated processing is essential to deliver the Service and is performed under the legal basis of contract performance. The automated processing does not produce decisions with legal or similarly significant effects on you -- it generates creative content based on your inputs. You always have the right to request human review of any aspect of your order by contacting info@selected-songs.com.

Legal Bases for Processing (GDPR)

For users in the European Economic Area, we process your data based on:

• Contract Performance: Processing necessary to fulfill your order, to let you sign in and see your orders, and to provide and administer your Song Plan (including recurring billing and cancellation)
• Legitimate Interests: Improving our services, preventing fraud and abuse, establishing or defending legal claims such as payment disputes, and measuring which of our ads lead to purchases (the attribution cookies set by our attribution provider Insightics and the server-side Meta Conversions API events described in Section 6)
• Legal Obligation: Compliance with applicable laws, including keeping billing, tax, and accounting records for subscription and other payments
• Consent: Cookies and similar tools that are not strictly necessary (the Meta Pixel, TikTok Pixel, Microsoft Clarity, and the advertising and analytics storage of the Google Ads tag) for visitors in the EEA, the UK, Switzerland, and Quebec, based on your choice in our cookie banner; promotional emails, where the law requires your opt-in or where the law lets us contact existing customers about similar products with a way to opt out; and any sensitive information you choose to include in your stories. You can withdraw consent at any time. We do not use the email address you give to sign in or to manage a Song Plan for promotions on the basis of contract performance

4. Information Sharing and Disclosure

We share your information only with the parties listed in Section 5 and only as necessary to provide our Service and to measure and optimize our advertising. We do not sell your personal information to third parties in exchange for money. Our advertising technologies are described in Section 6, and how they are treated under California law is described in Section 11.

Legal Requirements

We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Third-Party Service Providers (Sub-Processors)

We share your information with the following third-party service providers to deliver our Service. Each provider is bound by a Data Processing Agreement (DPA) and is contractually obligated to protect your data in accordance with applicable data protection laws. These providers include:

• Payment Processing (Stripe, Inc.): Processes payments securely, including recurring Song Plan charges and the billing portal where you can update your card, view invoices, and cancel. We never store or have access to your full credit card number, and we never pass your card details to any other third party. Stripe is PCI-DSS Level 1 certified and participates in the EU-US Data Privacy Framework. Data processed: email, payment details, transaction amount; for Song Plan buyers also customer and subscription records, billing history, our order reference, plan type and offer version, language setting, and anything you enter in the billing portal (such as name, billing address, phone number, or a cancellation reason). For every checkout, we also attach to the Stripe record a traffic-source label, add-on flags (bundle, rush), and the Meta and TikTok advertising cookie identifiers (fbp, fbc, ttclid, _ttp) where present.
• Lyric Generation (Google LLC -- Gemini AI): Your song details (recipient name, relationship type, occasion, personal stories/memories, qualities, and dedication message) are processed to generate personalized lyrics. Google participates in the EU-US Data Privacy Framework. Data processed: song request details, recipient information, personal stories.
• Music Generation (Kie.ai / Suno): Generated lyrics and style preferences are processed to create original music and vocals. Data processed: lyrics, musical style, voice preference.
• Email Delivery (Twilio -- SendGrid): Sends sign-in links, order confirmations, song deliveries, Song Plan notices, and other transactional emails. We turn off link click-tracking in sign-in emails. Data processed: email address, order details, plan details, song links, sign-in links.
• File Storage (Vercel, Inc.): Stores generated songs and related media securely with encryption at rest and in transit. Data processed: audio files, images.
• Database Hosting (Neon, Inc.): Hosts our application database with encryption at rest and in transit. Data processed: all order, account, and subscription data.
• Application Hosting (Vercel, Inc.): Hosts our web application. Data processed: IP address, request logs.

We maintain up-to-date Data Processing Agreements (DPAs) with all sub-processors listed above. We conduct regular reviews of our sub-processors' data protection practices. If you would like a copy of our sub-processor list or any applicable DPA, contact info@selected-songs.com.

Advertising, Analytics, and Attribution Recipients

In addition, our website and servers send data to the following recipients to measure and optimize our advertising and to understand how the site is used. These recipients process the data under their own terms:

• Advertising Measurement (Meta Platforms, Inc.): The Meta Pixel runs in your browser (for visitors whose connection appears to come from the EEA, the UK, Switzerland, or Quebec, only after they click Accept in our cookie banner; see Section 6). When you complete a purchase, and each time a Song Plan renews, we send Meta a purchase event from our servers (the Conversions API). We send these server-side purchase events for all customers, whatever their cookie banner choice. It contains the purchase value and currency, a one-way hashed (SHA-256) version of your email address and, at sign-up, of your first name, a hashed identifier for your order or plan, and the Meta browser identifiers (fbp, fbc) where present. Data processed: hashed email, hashed name, purchase value, browser identifiers.
• Advertising (Google Ads): Our Google Ads tag measures conversions from Google advertising campaigns. For visitors whose connection appears to come from the EEA, the UK, Switzerland, or Quebec, it runs in Google Consent Mode with ad and analytics storage denied until they click Accept (see Section 6). Data processed: usage data, device information, IP address, advertising identifiers.
• Site Analytics (Microsoft Clarity): Records how visitors use our pages (clicks, scrolling, page views) and may include session recordings. For visitors whose connection appears to come from the EEA, the UK, Switzerland, or Quebec, it loads only after they click Accept in our cookie banner (see Section 6). Data processed: usage data, device information, IP address.
• Advertising Measurement (TikTok): The TikTok Pixel runs in your browser (for visitors whose connection appears to come from the EEA, the UK, Switzerland, or Quebec, only after they click Accept in our cookie banner; see Section 6). When you complete a purchase, and each time a Song Plan renews, we send TikTok a purchase event from our servers (the Events API). We send these server-side purchase events for all customers, whatever their cookie banner choice. It contains the purchase value and currency, a one-way hashed (SHA-256) version of your email address, a hashed identifier for your order or plan, and the TikTok browser identifiers (ttclid, _ttp) where present. Data processed: hashed email, purchase value, browser identifiers.
• Conversion Tracking (Insightics): For each purchase and each Song Plan renewal we send the visit identifier, advertising click identifier, purchase value, and traffic-source flag recorded when you arrived at our site to our conversion-tracking service, to attribute sales to advertising campaigns. The cookies behind this identifier are set for all visitors, as described in Section 6.

6. Cookies and Tracking Technologies

Cookie Banner and Your Choices

If your connection appears to come from the European Economic Area (EEA), the United Kingdom, Switzerland, or Quebec (Canada), we show a cookie banner with equally prominent Accept and Reject buttons. We store your choice in a first-party cookie named sm_consent for 6 months. You can change your choice at any time with the "Cookie choices" button (shown in the language you are browsing in) at the top of this Privacy Policy page. Because this depends on where your connection appears to come from, it may not match where you actually are.

For these visitors:

• The Meta Pixel, TikTok Pixel, and Microsoft Clarity load only after you click Accept.
• The Google Ads tag loads in Google Consent Mode with ad and analytics storage denied until you click Accept. While storage is denied, it does not set advertising cookies, but it may send cookieless measurement pings to Google.

Visitors elsewhere (for example the United States, Australia, the rest of Canada, and Latin America) do not see a banner. For them, these tools load when they visit our site. If you are one of these visitors and want to object to our use of these tools, contact info@selected-songs.com.

Types of Cookies We Use

Essential Cookies (Required)

• sm_oc: First-party, HttpOnly, Secure cookie, 90 days. Ties your browser to your order so that only you can use one-click purchases on your song page
• NEXT_LOCALE: First-party cookie, 1 year. Remembers your language and currency
• sm_consent: First-party cookie, 6 months. Stores your cookie banner choice so that we do not ask you again. It is strictly necessary for the banner to work
• Sign-in session cookie (sm_session): A first-party cookie that is set only after you click a valid sign-in link we email you, which is your request to sign in. It is HttpOnly and Secure, contains a signed copy of your email address so that we know which account you are signed in to, and lasts up to 30 days or until you sign out. It is used only to keep you signed in and, in our assessment, is necessary for that feature. It is not used for analytics or advertising
• __stripe_mid and __stripe_sid: Set by Stripe.js (first-party, 1 year and 30 minutes) only when the payment form on our order page opens, for fraud prevention and to process your payment. Stripe may also set cookies on its own domains

These cookies are necessary for the Service to function. You can block them in your browser, but if you block the sign-in cookie you will not be able to sign in or use your profile page, although you can still use the links in your emails to reach your song and plan pages and to cancel your Song Plan.

Experiment and Attribution Cookies (Not Strictly Necessary)

• abv: First-party, 90 days for visitors who arrive from an advertisement and session-only for others. Records which version of our pages and pricing you were shown
• sm_paid: First-party, session. Records that you arrived from an advertisement
• sm_first: First-party, 1 year. Records which advertising source brought you to us
• vId, dId, cId: Visit, device, and advertising-click identifiers used by our conversion-tracking service (see Section 5)

These cookies are set for all visitors, including visitors in the EEA, the UK, Switzerland, and Quebec, whatever their choice in the cookie banner. Our attribution provider, Insightics, uses them to attribute purchases to the ads that led to them. They are not controlled by the cookie banner.

Marketing and Advertising Technologies

• Meta Pixel (Facebook/Instagram): Measures conversions from Meta advertising and enables remarketing, and sets the Meta cookies _fbp and _fbc. For visitors in the EEA, the UK, Switzerland, and Quebec it loads only after you click Accept. For other visitors it loads when you visit our site.
• TikTok Pixel: Measures conversions from TikTok advertising and sets the TikTok cookie _ttp. We also keep the ttclid identifier that TikTok adds to the address of our site when you arrive from a TikTok ad in a first-party cookie named ttclid for 30 days. For visitors in the EEA, the UK, Switzerland, and Quebec it loads only after you click Accept. For other visitors it loads when you visit our site.
• Google Ads tag: Measures conversions from Google advertising campaigns. For visitors in the EEA, the UK, Switzerland, and Quebec it loads in Google Consent Mode with ad and analytics storage denied until you click Accept, and while denied it does not set advertising cookies but may send cookieless measurement pings to Google. For other visitors it loads when you visit our site.
• Microsoft Clarity: Records how visitors use our pages (clicks, scrolling, page views) to help us improve the Service. For visitors in the EEA, the UK, Switzerland, and Quebec it loads only after you click Accept. For other visitors it loads when you visit our site.
• Meta Conversions API (server-side): When you complete a purchase, and each time a Song Plan renews, we send Meta a purchase event from our servers, as described in Section 5. We send these events for all customers, and they are not controlled by the cookie banner.
• TikTok Events API (server-side): When you complete a purchase, and each time a Song Plan renews, we send TikTok a purchase event from our servers, as described in Section 5. We send these events for all customers, and they are not controlled by the cookie banner.

These cookies and tools are not strictly necessary for the Service. We do not currently respond to Global Privacy Control or Do Not Track signals.

How to Manage Cookies

You can block or delete cookies and trackers in your browser settings or with a tracker-blocking extension. Refusing essential cookies may prevent you from completing orders. To object to our use of your data for advertising, or to ask us to stop sending your data to advertising partners, contact info@selected-songs.com. We also use your browser's local storage to remember which advertising source brought you to us (the same information as the sm_first cookie).

Global Privacy Control (GPC) & Do Not Track

We do not currently honor Global Privacy Control (GPC) signals or "Do Not Track" browser signals. See Section 11 for how to opt out of "sharing" of personal information under California law.

7. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes described in this policy:

• Order Data: Retained for 7 years after your last transaction for legal, tax, and accounting compliance purposes, after which it is anonymized or deleted. During this period you may continue to access your purchase.
• Subscription and Billing Records: Plan records (status, billing periods, songs remaining, cycles paid, invoice records, and cancellation date) are retained for at least 7 years after your last billing transaction for tax, accounting, and legal compliance, and are reviewed for deletion or anonymization after that period. Stripe keeps payment and billing portal data under its own retention rules and legal obligations
• Sign-In Data: We do not keep a separate account record or a password. Sign-in links expire 30 minutes after we send them, and the sign-in cookie lasts up to 30 days or until you sign out. The orders and plans you see after signing in are kept as described in this section
• Generated Songs: Stored for as long as your account or order record is active. You may request deletion at any time by contacting info@selected-songs.com. Songs associated with inactive orders will be reviewed for deletion after 7 years.
• Personal Stories and User Content: Retained for the duration necessary to fulfill your order and any remake requests, then for up to 12 months for quality assurance purposes. After this period, personal story content is deleted from active systems (but may persist in encrypted backups for up to 90 additional days).
• Support Conversations: Retained for 3 years after resolution
• Technical Logs: Generally deleted after 90 days

You may request deletion of your data by contacting us at info@selected-songs.com. If you ask us to delete your data while you have an active Song Plan, we will cancel the plan as described in Section 8 of our Terms of Service before deleting your data, and we will tell you the date it ends. We may keep billing and tax records after a deletion request where the law requires us to, and where we need them to establish or defend legal claims.

8. Data Security

We implement comprehensive security measures to protect your information:

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS/SSL
• Secure Payment: Credit card information is processed by our payment provider and never touches our servers
• Database Security: Our database is hosted with encryption at rest and in transit
• Access Control: Only authorized personnel have access to user data, on a need-to-know basis
• Regular Audits: We regularly review and update our security practices
• Environment Variables: Sensitive API keys and credentials are stored securely as environment variables

While we implement industry-standard security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Portability: Request your data in a portable format
• Opt-out: Unsubscribe from promotional communications at any time (contact info@selected-songs.com)
• Lodge a Complaint: File a complaint with your local data protection authority or consumer protection agency

To exercise any of these rights, please contact us at info@selected-songs.com. See the jurisdiction-specific sections below (Sections 10-13) for response timelines and your local supervisory authority.

10. Your Rights Under GDPR (European Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following additional rights under the General Data Protection Regulation (GDPR):

Your GDPR Rights

• Right of Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to be Forgotten: Request deletion of your data
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time for consent-based processing
• Right to Lodge a Complaint: File a complaint with your local data protection authority

Data Protection Officer

While our current processing activities do not require the appointment of a Data Protection Officer under GDPR Article 37, we have designated a Data Protection contact to handle all privacy inquiries. You can reach our Data Protection contact at info@selected-songs.com.

How to Exercise Your Rights

Contact our Data Protection contact at info@selected-songs.com. We will respond within 30 days as required by GDPR. In exceptional circumstances, we may extend this period by an additional 60 days, in which case we will inform you of the extension and the reasons for the delay within the initial 30-day period.

Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) where required, particularly for processing activities that involve AI-generated content, large-scale processing of personal data, or the use of new technologies. Our DPIAs are reviewed and updated regularly.

11. Your Rights Under CCPA (California Users)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Your CCPA Rights

• Right to Know: Request disclosure of categories and specific pieces of personal information collected
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale or Sharing: We do not sell your personal information in exchange for money. Our advertising technologies may count as "sharing" (see below)
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

Categories of Information Collected (Past 12 Months)

• Identifiers: Email address, name
• Personal information (Cal. Civ. Code Section 1798.80): Name, address
• Commercial information: Purchase history, order details, Song Plan subscription and billing records
• Internet activity: Pages visited, interaction with our site
• Inferences: Preferences derived from the above

Sensitive Personal Information

We may collect sensitive personal information as defined by CPRA. You have the right to limit the use and disclosure of your sensitive personal information.

Do Not Sell or Share My Personal Information

We do not sell your personal information in exchange for money. We use the Meta Pixel, the Meta Conversions API, the TikTok Pixel, the TikTok Events API, and the Google Ads tag to measure and optimize advertising. This involves sharing identifiers and purchase data (such as a hashed email address, order value, and cookie identifiers) with Meta, TikTok, and Google and may count as "sharing" for cross-context behavioral advertising under California law. We do not currently offer an in-site opt-out control and do not currently honor Global Privacy Control signals. To opt out, email info@selected-songs.com.

How to Exercise Your Rights

Submit a request to info@selected-songs.com. We will verify your identity before processing requests. We will respond within 45 days of receiving your verifiable request. If we need more time (up to an additional 45 days), we will inform you in writing. You may designate an authorized agent to make requests on your behalf with proper written authorization.

12. Your Rights Under LGPD (Brazilian Users)

If you are located in Brazil, you have the following rights under the Lei Geral de Protecao de Dados (LGPD, Law 13.709/2018):

Your LGPD Rights

• Confirmation and Access: Confirm whether we process your data and access it
• Correction: Request correction of incomplete, inaccurate, or outdated data
• Anonymization, Blocking, or Deletion: Request anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in non-compliance with LGPD
• Data Portability: Request portability of your data to another service provider
• Deletion of Data Processed with Consent: Request deletion of data processed on the basis of your consent
• Information on Sharing: Obtain information about public and private entities with which we share your data
• Information on Consent: Obtain information about the possibility of not providing consent and the consequences of such refusal
• Withdrawal of Consent: Withdraw your consent at any time
• Opposition: Object to processing that does not comply with LGPD
• Review of Automated Decisions: Request review of decisions made solely on the basis of automated processing of personal data that affect your interests, including decisions intended to define your personal, professional, consumer, or credit profile

Legal Bases (LGPD)

We process your personal data under the following legal bases provided by LGPD:

• Contract Performance (Art. 7, V): Processing necessary to fulfill your order, let you sign in, and provide and administer your Song Plan
• Consent (Art. 7, I): For marketing communications and sensitive data
• Legitimate Interest (Art. 7, IX): For fraud prevention, service improvement, and security
• Legal or Regulatory Obligation (Art. 7, II): For tax compliance, billing records, and legal requirements

Encarregado (Data Protection Officer)

In accordance with LGPD Article 41, our designated Encarregado (Data Protection Officer) can be contacted at info@selected-songs.com. The Encarregado is responsible for receiving complaints from data subjects, providing guidance, and acting as a point of contact with the ANPD (Autoridade Nacional de Protecao de Dados).

How to Exercise Your Rights

Submit a request to info@selected-songs.com. We will respond within 15 days as required by LGPD. You also have the right to file a complaint with the ANPD (Autoridade Nacional de Protecao de Dados) at www.gov.br/anpd.

13. Your Rights in Mexico, Colombia, Argentina, Chile & Other Latin American Jurisdictions

Mexico (LFPDPPP)

If you are in Mexico, you have ARCO rights under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP):

• Acceso (Access): Request access to your personal data
• Rectificacion (Rectification): Request correction of inaccurate data
• Cancelacion (Cancellation): Request deletion of your data
• Oposicion (Opposition): Object to the processing of your data

To exercise your ARCO rights, submit a request to info@selected-songs.com. We will respond within 20 business days as required by LFPDPPP. You may also file complaints with the INAI (Instituto Nacional de Transparencia, Acceso a la Informacion y Proteccion de Datos Personales).

Colombia (Law 1581/2012)

If you are in Colombia, you have rights under the Personal Data Protection Law (Law 1581/2012), including the right to: access your data, update and correct it, request deletion when not required by legal obligation, request proof of consent, file complaints with the SIC (Superintendencia de Industria y Comercio), and revoke consent. We will respond to requests within 10 business days (extendable by 5 additional days). Contact info@selected-songs.com.

Argentina (Law 25.326)

If you are in Argentina, you have rights under the Personal Data Protection Law (Law 25.326), including the right to: access your data (free of charge, at intervals of no less than 6 months), rectify, update, or suppress your data. You may file complaints with the AAIP (Agencia de Acceso a la Informacion Publica). We will respond within 10 calendar days. Argentina has been granted an adequacy decision by the European Commission. Contact info@selected-songs.com.

Chile (Law 19.628)

If you are in Chile, you have rights under the Law on Protection of Private Life (Law 19.628), including the right to: access, modify, cancel, and block your personal data. You may file complaints with the SERNAC (Servicio Nacional del Consumidor) or the competent courts. Contact info@selected-songs.com.

Other Jurisdictions

If you are located in Venezuela, Puerto Rico, or any other jurisdiction with data protection legislation, you may exercise your applicable data protection rights by contacting info@selected-songs.com. We will process your request in accordance with the applicable data protection laws of your jurisdiction.

14. International Data Transfers

SelectedSongs is based in the United States. Your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate.

Transfer Mechanisms

For transfers from the EEA/UK/Switzerland to the United States, we rely on the following safeguards:

• EU-US Data Privacy Framework (DPF): Where applicable, we use sub-processors that are certified under the EU-US Data Privacy Framework (including the UK Extension and Swiss-US DPF), as recognized by the European Commission's adequacy decision of July 2023
• Standard Contractual Clauses (SCCs): For sub-processors not covered by the DPF, we use SCCs approved by the European Commission (and the UK International Data Transfer Agreement where applicable)
• Data Processing Agreements (DPAs): All service providers are bound by DPAs that include appropriate technical and organizational safeguards
• Adequacy Decisions: Where available, we rely on adequacy decisions issued by the European Commission for the recipient country

Your Consent

By using our Service, you acknowledge the transfer of your information to the United States and other jurisdictions that may have different data protection laws than your country of residence. Regardless of where your data is processed, we apply the same protections described in this Privacy Policy.

Brazil (LGPD Article 33)

If you are located in Brazil, your personal data is transferred to and processed in the United States, where we and our service providers operate. We make this transfer because it is necessary to perform your contract with us (LGPD Article 33, IX, with Article 7, V), and our service providers are bound by the data processing agreements described in this section. You can ask for information about these safeguards at info@selected-songs.com.

15. Data Breach Notification

In the event of a data breach that affects your personal information:

Notification Timeline

We will notify affected users within 72 hours of becoming aware of a breach that poses a risk to your rights and freedoms. We will also notify relevant supervisory authorities as required by law.

Notification Content

Our notification will include:

• Description of the nature of the breach
• Categories and approximate number of individuals affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact information for questions

How We Will Notify You

We will notify you via email to the address associated with your order, by a prominent notice on our website, and by other means as required by applicable law.

16. Children's Privacy

Our Service requires users to be at least 18 years of age (or the age of majority in your jurisdiction), as stated in our Terms of Service. The age thresholds below represent the regulatory floors under applicable children's privacy laws, below which heightened data protection requirements apply:

• United States: 13 years of age (in accordance with COPPA)
• European Union: 16 years of age (or the age set by your member state, which may be as low as 13 under GDPR Article 8)
• United Kingdom: 13 years of age (under UK GDPR)
• Brazil: 18 years of age, or 12 years of age with verifiable parental consent (under LGPD Article 14)
• All other jurisdictions: The age of digital consent in your country of residence, or 16 years of age if no specific age is defined

We do not knowingly collect personal information from children below the applicable age threshold. If you are a parent or guardian and believe we have collected information from a child below the applicable age in your jurisdiction, please contact us immediately at info@selected-songs.com and we will take steps to delete such information promptly.

17. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

18. Changes to This Policy

We reserve the right to modify this Privacy Policy at any time. We will provide notice of significant changes by updating the "Last updated" date.

19. Contact Us

If you have any questions about this Privacy Policy, our data practices, or would like to exercise your rights, please contact us:

• Privacy Inquiries: info@selected-songs.com
• General Support: info@selected-songs.com

We aim to respond to all inquiries within 30 days.