Privacy Policy

1. Controller

Rainbow Soundworks, sole proprietorship, proprietor Alexander Maecke, Neuetorstraße 7, 31785 Hameln, Germany. Email: support@songdeal24.eu.

2. Hosting and server logs

When the site is accessed, technically necessary connection data such as IP address, time, requested resource, referrer, browser identifier and error status may be processed to deliver the site securely and prevent misuse. The legal basis is Article 6(1)(f) GDPR.

The application is hosted on Cloudflare Workers; order and production data is stored in Cloudflare D1, and audio files are kept in a non-public R2 bucket with EU jurisdiction.

3. Order processing

To perform the contract, we process name, email address, song recipient, occasion, music style, personal details and memories, inside references and exclusions, order number, language and domain, payment status, extras and delivery status. The legal basis is Article 6(1)(b) GDPR.

4. Stripe

If Stripe is selected, transaction and contact data required for payment, authentication and fraud prevention is transferred to Stripe. Card and bank data is not stored in the Songdeal24 database. Stripe’s privacy policy is available at stripe.com/privacy.

5. PayPal

If PayPal is selected, payment data is transferred to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Songdeal24 receives the payment status, transaction reference and, where supplied, payer name, but stores no card or bank details. PayPal’s privacy statement is available at paypal.com/de/legalhub/paypal/privacy-full.

6. Email communication

We process email, order and delivery information for order confirmations, operator notifications, delivery, withdrawal confirmations and retries. Delivery status, time, message ID and errors are logged. The legal bases are Article 6(1)(b), (c) and (f) GDPR.

Transactional email is sent through STRATO. Credentials are processed exclusively as protected Cloudflare secrets.

7. Database, audio files and evidence

Orders, internal production notes, MP3 and optional WAV files, delivery logs, versioned consent evidence and withdrawal records are stored. Production data is restricted to the protected admin area.

Creative briefing data and delivered MP3/WAV files are retained for 60 days after actual delivery and are then automatically anonymised or deleted from audio storage. Technical redelivery is possible during that period but is not guaranteed afterwards. Payment, contract, invoice, consent, delivery and withdrawal evidence is retained only as long as necessary for performance, legal duties or legal claims.

8. AI-assisted tools

Technical or AI-assisted tools may be used to perform the contract. External production providers receive only the minimum derived material required, such as lyrics and a style description. Email, payment data, full order history and unnecessary sensitive data are not disclosed.

9. Cookies and local storage

Songdeal24 uses only technically necessary cookies or sessions, particularly for the protected admin login and CSRF protection of the electronic withdrawal function. No analytics, marketing or tracking services are integrated. There is no newsletter and order data is not used for advertising.

10. Electronic withdrawal function

For an electronic withdrawal, we process order number, name, email, withdrawal declaration, optional comment, language, domain, receipt time, reduced or hashed security attributes and email status. This is necessary to comply with legal duties, process the withdrawal and prove receipt under Article 6(1)(b) and (c) GDPR.

11. Data subject rights

Subject to the GDPR, individuals may request access, correction, erasure, restriction, portability and object to processing. Consent may be withdrawn for the future without affecting prior lawful processing.

You may complain to a competent data protection authority. Requests can be sent to support@songdeal24.eu.