Privacy Policy

1. Data We Collect

We collect the following personal data:

• Email address — provided when requesting a commission or making a purchase. Used for order receipts and commission status.
• Payment information — processed by Stripe. We never see or store your card details.
• Song requests — the songs you request for analysis (song name, artist).
• IP address — used for rate limiting to prevent abuse. Not stored long-term.

2. How We Use Your Data

• Process and deliver your orders
• Send order confirmation and download links
• Enforce fair use limits (free craft caps)
• Improve our service

We do not sell, rent, or share your personal data with third parties for marketing purposes.

Lawful bases (GDPR Art. 6). We process your email and order details to perform our contract with you — delivering the artwork you requested and providing related support — under Article 6(1)(b) (performance of a contract). We process first-party, cookieless usage analytics under Article 6(1)(f) (legitimate interest) to understand and improve how the site is used; this does not involve tracking cookies or third-party profiling (see Section 4).

3. Third-Party Processors

We use the following services to operate:

• Stripe — our payment processor and a recipient of payment data. Stripe acts partly on our instructions and partly as an independent controller for its own payments and regulatory-compliance purposes (PCI DSS compliant).
• Supabase — database and authentication (EU region)
• Vercel — website hosting
• Cloudinary — image delivery and optimization
• OpenAI — AI content crafting
• Resend — transactional email delivery (order confirmations, commission updates)
• Pinterest — when enabled, we publish our own Song Anatomy infographics to our own Pinterest business account via the Pinterest API. We share no user data with Pinterest and store only our own OAuth tokens (encrypted) and the IDs of pins we create.

International transfers. Some of our processors are US-based — Stripe, Cloudinary, Vercel, and Resend. Where personal data is transferred outside the EU/EEA, these providers operate under standard safeguards such as the European Commission’s Standard Contractual Clauses.

4. Cookies

We use only functional cookies required for the site to operate (Supabase session management). We do not use tracking cookies, analytics cookies, or advertising cookies.

5. Data Retention

Order records and commission data are retained for tax and legal compliance purposes. Email addresses associated with free crafts are retained to enforce usage limits.

6. Your Rights (GDPR)

If you are an EU/EEA resident, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data (right to be forgotten)
• Object to processing
• Data portability

To exercise any of these rights, email hello@songanatomy.art. We will respond within 30 days.

7. Data Security

All data is transmitted over HTTPS. Payment processing is handled entirely by Stripe using their hosted checkout page. Database access is restricted to server-side operations with row-level security policies.

8. Contact

Data controller: Song Anatomy. For privacy inquiries, email hello@songanatomy.art.