Privacy Policy
Effective Date: July 30, 2026
This Privacy Policy explains how My Grace Songs (“Company”, “we”, “us”, or “our”) collects, uses, discloses, stores, and otherwise processes Personal Information when you access or use our website, purchase our products, or use our personalized digital services.
This Privacy Policy should be read together with our Terms of Service, PURL Terms, and other operating rules and policies published on https://www.mygracesongs.com.
The PURL Terms govern the creation, operation, access, sharing, use, and licensing of personalized content, including User Content, personalized songs, PURLs, Grace Vaults, and related digital assets. Where applicable, the PURL Terms control the rights and responsibilities relating to personalized products and content.
This Privacy Policy explains privacy-related processing only and does not grant any additional rights to use User Content beyond those provided in the PURL Terms.
Where GDPR, UK GDPR, or similar data protection laws apply, the Company acts as the data controller for Personal Information processed through the Services.
The Company determines the purposes and means of processing Personal Information necessary to provide personalized products, operate PURLs and Grace Vaults, process payments, maintain security, provide customer support, comply with legal obligations, and operate the Services.
1. Definitions
For purposes of this Privacy Policy:
“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an identifiable individual.
Capitalized terms used but not defined in this Privacy Policy have the meanings provided in the Terms of Service or PURL Terms.
2. Personal Information We Process
We collect and process Personal Information necessary to provide, operate, secure, and improve the Services and comply with applicable legal obligations. The purposes and legal bases for processing depend on the nature of the information, the processing activity, and applicable law. Depending on jurisdiction and circumstances, the same category of Personal Information may be processed under different lawful bases.
Depending on how you interact with us, we may process the following categories of Personal Information:
2.1 Account and Contact Information
This may include:
  • name;
  • email address;
  • phone number;
  • account details;
  • customer support communications.
2.2 Order and Transaction Information
This may include:
  • purchase details;
  • billing information;
  • payment information;
  • transaction history;
  • order identifiers;
  • personalization preferences;
  • PURL identifiers;
  • Grace Vault identifiers.
Payment information may be processed directly by payment service providers. We may not directly store complete payment card details.
2.3 User Content and Personalization Information
To create personalized products, we may process:
  • names;
  • relationship information;
  • personal stories;
  • messages;
  • dedications;
  • lyrics;
  • photographs;
  • audio recordings;
  • videos;
  • voice recordings;
  • other materials submitted by customers.
User Content may include information relating to customers, Recipients, family members, friends, children, deceased persons, or other individuals. Where User Content contains Personal Information relating to another individual, including a Recipient, such information may be provided indirectly by the customer purchasing or requesting the personalized product. Where required by applicable law, the Company may provide applicable privacy information to individuals whose Personal Information is processed indirectly through customer submissions.
2.4 Other Information
We may collect and process other Personal Information that you provide to us, that is generated through your use of the Services, or that is necessary for us to operate, secure, maintain, and improve our Services.
This may include information relating to:
  • communications with us;
  • preferences and settings;
  • technical and usage information;
  • information necessary to verify requests, prevent fraud, comply with legal obligations, or enforce our agreements; and
  • other information reasonably necessary for the purposes described in this Privacy Policy.
We only collect and process Personal Information that is reasonably necessary for the purposes described in this Privacy Policy and as permitted by applicable law.
3. PURL Creation, Hosting, and Grace Vault Operation
To provide personalized digital products, we may collect and process Personal Information to:
  • create and configure PURLs;
  • generate personalized songs;
  • host and maintain PURLs;
  • operate Grace Vaults;
  • store and display personalized content;
  • enable playback, downloads, and sharing;
  • provide customer support;
  • maintain service functionality and security.
PURLs are generally designed as private-by-link webpages. A PURL is not intended to be indexed by search engines, but it is not a confidential communication system.
Anyone who obtains an Access Link, Access Token, or other access method may potentially access the associated PURL or Grace Vault, subject to applicable technical access controls implemented by the Company. Customers are responsible for controlling and sharing access methods provided to them.
4. How We Use Personal Information
We may use Personal Information for the following purposes:
Service Delivery
Including:
  • creating personalized songs;
  • generating personalized digital products;
  • creating and operating PURLs;
  • operating Grace Vaults;
  • delivering purchased products;
  • enabling downloads and playback;
  • maintaining customer accounts.
Customer Support
Including:
  • responding to inquiries;
  • troubleshooting issues;
  • managing requests;
  • maintaining support records.
Security and Fraud Prevention
Including:
  • detecting unauthorized activity;
  • preventing abuse;
  • protecting accounts and services;
  • investigating suspicious transactions.
Business Operations
Including:
  • maintaining records;
  • improving services;
  • analyzing product performance;
  • managing vendors;
  • complying with legal obligations.
Legal Compliance
Including:
  • responding to lawful requests;
  • enforcing agreements;
  • protecting rights and safety;
  • maintaining required records.
5. Legal Bases for Processing
Where required by applicable law, including the laws of the European Economic Area (“EEA”), United Kingdom, or similar jurisdictions, we process Personal Information based on one or more lawful bases.
These may include:
Contract Performance
Processing necessary to provide requested services, including:
  • creating personalized products;
  • hosting PURLs;
  • operating Grace Vaults;
  • delivering digital content.
Consent
Where required, we rely on consent for processing activities such as:
  • certain sensitive personal information processing;
  • certain cookies and tracking technologies;
  • optional communications.
Legitimate Interests
Where permitted, we may process Personal Information for legitimate business purposes, including:
  • security;
  • fraud prevention;
  • service improvement;
  • customer support;
  • business administration.
Legal Obligations
Processing necessary to comply with:
  • tax obligations;
  • accounting requirements;
  • legal requests;
  • regulatory obligations.
6. Recipient Personal Information
Customers may submit information relating to Recipients or other individuals as part of personalized products.
This may include names, stories, messages, images, audio, video, relationship information, and other identifying information submitted by customers.
Customers are responsible for ensuring they have the necessary rights, permissions, and authority required by applicable law before submitting information relating to another person.
The Company processes Recipient information only for purposes connected with:
  • creating personalized products;
  • operating PURLs and Grace Vaults;
  • delivering requested services;
  • maintaining security;
  • complying with legal obligations.
We do not use Recipient information for marketing purposes unless separately authorized in accordance with the PURL Terms.
7. Sensitive Personal Information
Where sensitive personal information is submitted, we process it only as necessary to:
  • create and deliver requested personalized products;
  • operate PURLs and Grace Vaults;
  • provide customer support;
  • maintain security;
  • comply with legal obligations.
Where GDPR applies, processing of special-category Personal Information requires both:
(a) a lawful basis under Article 6 GDPR; and
(b) an applicable condition under Article 9 GDPR.
Depending on the circumstances and the nature of the processing, applicable Article 9 conditions may include explicit consent or another condition permitted under Article 9 GDPR.
8. Children and Minor Information
Our services are not directed to children under the age of 13, and we do not knowingly collect Personal Information directly from children under 13.
Users may submit information relating to children or minors as part of personalized products, including:
  • names;
  • photographs;
  • videos;
  • audio recordings;
  • stories;
  • messages;
  • other personal information.
By submitting information relating to a child or minor, you represent and warrant that:
  • you are the parent or legal guardian of the child; or
  • you have obtained appropriate permission from the child’s parent or legal guardian; and
  • the submission and processing of such information is lawful.
We may refuse, restrict, remove, or disable content involving children or minors where we believe it creates legal, privacy, safety, security, or reputational risk.
If you believe information relating to a child has been submitted improperly, contact us using the privacy contact details provided in this Privacy Policy.
9. Deceased Person and Memorial Content
Customers may submit information relating to deceased persons for memorial, tribute, remembrance, or similar personalized products.
Such information may include:
  • names;
  • photographs;
  • stories;
  • recordings;
  • memorial messages;
  • other related content.
We process deceased-person content only as necessary to:
  • create requested personalized products;
  • operate PURLs and Grace Vaults;
  • provide requested services;
  • maintain security and operational records.
Customers are responsible for ensuring they have appropriate authority to submit memorial content and that such content does not unlawfully infringe the rights, privacy, reputation, or interests of others. This may include considering applicable rights and interests of family members, estates, representatives, or other affected persons. 
We may refuse, modify, restrict, remove, or disable memorial content where we believe it creates legal, privacy, family, safety, or reputational risks.
10. AI Tools, Music Providers, and Technology Providers
To create personalized songs and related digital products, we may use third-party technology providers, including:
  • artificial intelligence providers;
  • music generation providers;
  • audio processing providers;
  • digital content processing providers.
These providers may process User Content, including:
  • text;
  • lyrics;
  • stories;
  • images;
  • audio;
  • video;
  • voice recordings;
  • other submitted materials.
User Content submitted through the Services will not be used to train general-purpose AI models or music-generation models unless the customer separately provides express consent.
11. Service Providers and Third-Party Processing
We may use third-party service providers to operate, maintain, secure, and improve our Services. Depending on applicable law and the nature of the services provided, these providers may act as service providers, processors, or subprocessors. We require appropriate contractual protections governing confidentiality, security, and permitted processing activities.
These providers may include:
  • cloud hosting providers;
  • storage providers;
  • database providers;
  • payment processors;
  • email delivery providers;
  • customer support providers;
  • analytics providers;
  • fraud prevention providers;
  • security providers;
  • AI providers;
  • music generation providers;
  • audio processing providers.
Service providers may process Personal Information for purposes including:
  • hosting PURLs;
  • operating Grace Vaults;
  • storing User Content;
  • generating personalized songs;
  • processing payments;
  • delivering communications;
  • providing customer support;
  • maintaining security.
We do not authorize service providers to use User Content or personalized content for independent marketing or advertising purposes. We do not use User Content, Recipient information, personalized songs, PURLs, Grace Vault content, or 
Deliverables for our own advertising, promotional materials, testimonials, or marketing purposes unless you provide separate affirmative consent.
12. International Data Transfers
Because we operate internationally and use service providers located in different countries, Personal Information may be transferred to, stored in, or processed outside your country of residence.
Where Personal Information is transferred internationally, we rely on legally recognized transfer mechanisms applicable to the specific transfer, including where applicable:
  • European Commission Standard Contractual Clauses (“SCCs”);
  • United Kingdom International Data Transfer Agreement (“IDTA”) or UK Addendum where applicable;
  • adequacy decisions;
  • other legally recognized safeguards.
The specific transfer mechanism depends on the location of the service provider, recipient country, and applicable legal requirements.
13. Analytics and PURL Usage Events
We may collect and process technical and usage information relating to our website, PURLs, and Grace Vaults.
This may include:
  • page views;
  • PURL views;
  • song play events;
  • playback duration;
  • completion events;
  • downloads;
  • sharing events;
  • lyrics views;
  • button clicks;
  • device information;
  • browser information;
  • operating system information;
  • IP-derived information;
  • approximate location information;
  • technical logs.
We use this information to:
  • operate and improve our Services;
  • measure product performance;
  • understand user interactions;
  • maintain security;
  • prevent abuse;
  • troubleshoot technical issues;
  • improve customer experience.
14. Cookies and Similar Technologies
We use cookies and similar technologies, including:
  • cookies;
  • pixels;
  • web beacons;
  • tags;
  • local storage technologies;
  • similar tracking technologies.
These technologies may be used to:
  • operate our website;
  • maintain secure sessions;
  • remember preferences;
  • analyze usage;
  • measure performance;
  • understand interactions with personalized digital experiences.
Cookies may collect information including:
  • device information;
  • browser information;
  • pages viewed;
  • PURL visits;
  • play events;
  • downloads;
  • sharing events;
  • interaction events.
Where required by applicable law, including applicable EU and UK Privacy requirements, we obtain prior consent before placing or using non-essential cookies or similar tracking technologies. Essential cookies necessary for website operation, security, authentication, payment processing, or requested functionality may be used where permitted by law. Additional information regarding cookie preferences and applicable technologies may be provided through available cookie preference controls or other privacy notices. 
15. Retention of Personal Information
We retain Personal Information according to the nature of the information and the purpose for which it was collected.
General retention periods include:
  • Account information: retained while the account remains active and for a reasonable period afterward for legal, security, and business purposes.
  • Order and payment records: retained for periods required by tax, accounting, payment processor, fraud prevention, and legal obligations.
  • User Content and submitted materials: retained during production and delivery and afterward only as reasonably necessary for service operation, dispute resolution, security, backups, and legal obligations.
  • Songs, Deliverables, PURLs, and Grace Vault information: retained during applicable access periods and afterward only as reasonably necessary for backups, legal compliance, security, and dispute resolution.
  • Customer support records: retained for reasonable periods necessary for customer service, quality control, dispute resolution, and legal obligations.
  • Analytics and technical records: retained for the period reasonably necessary for security, service improvement, analytics purposes, and legal obligations, subject to applicable provider retention periods.
  • Backups: retained according to backup cycles and deleted through normal system processes.
16. Removal, Deletion, and Content Requests
You may request removal, correction, restriction, or deletion of Personal Information by contacting us using the privacy contact information provided below.
We will review requests in accordance with:
  • applicable privacy laws;
  • verification requirements;
  • contractual obligations;
  • operational limitations;
  • security requirements;
  • fraud prevention procedures;
  • legal obligations.
Requests relating to PURLs, Grace Vaults, personalized songs, or User Content may require verification that the requester has appropriate authority.
If Personal Information or personalized content is removed, we may disable, restrict, remove, or modify access to related:
  • PURLs;
  • Grace Vaults;
  • downloads;
  • digital assets;
  • delivery features.
Deletion may not immediately remove information from:
  • backups;
  • legal records;
  • transaction records;
  • security logs;
  • third-party systems outside our reasonable control.
17. Your Privacy Rights
Depending on your location and applicable law, you may have rights relating to your Personal Information.
These rights may include:
  • access to Personal Information;
  • correction of inaccurate Personal Information;
  • deletion of Personal Information;
  • restriction of processing;
  • objection to certain processing;
  • portability of Personal Information;
  • withdrawal of consent where processing is based on consent.
We do not discriminate against individuals for exercising privacy rights available under applicable law. To protect Personal Information, we may require verification of identity before completing a request. If we deny a request, we will provide an explanation where required by applicable law.
The availability and scope of privacy rights depend on your jurisdiction, applicable exemptions, verification requirements, and the Company’s legal obligations. 
California Privacy Rights
If you are a California resident, you may have rights under applicable California privacy laws, including the California Consumer Privacy Act, as amended (“CCPA/CPRA”), including the right to:
  • request access to or deletion of Personal Information;
  • request correction of inaccurate Personal Information;
  • request information about the categories of Personal Information collected, used, disclosed, or sold (as applicable);
  • opt out of the sale or sharing of Personal Information for cross-context behavioral advertising; and
  • limit certain uses or disclosures of Sensitive Personal Information where required by applicable law.
The Company does not sell Personal Information and does not share Personal Information for cross-context behavioral advertising. The Company does not use Sensitive Personal Information for purposes requiring a right to limit under the CCPA/CPRA unless permitted by applicable law.
To exercise applicable California privacy rights, contact us using the privacy contact information provided in this Privacy Policy. We may require verification of your identity and authority before completing a request. Authorized agents may submit requests where permitted by law.
If we deny a request, you may appeal our decision by contacting us using the same privacy contact information. We will respond to appeals within the timeframe required by applicable law.
18. European Economic Area and United Kingdom Privacy Rights
If you are located in the EEA or UK, you may have additional rights under GDPR or UK GDPR, including rights of access, correction, deletion, restriction, portability, objection, withdrawal of consent where applicable, and the right to lodge a complaint with a supervisory authority.
The Company does not use solely automated decision-making producing legal or similarly significant effects on individuals unless permitted by applicable law and appropriate safeguards are implemented. Where legally required, the Company will designate an applicable European Union representative and/or United Kingdom representative. Representative details will be provided as required by applicable law. 
19. Security of Personal Information
We implement reasonable administrative, technical, and organizational safeguards designed to protect Personal Information against:
  • unauthorized access;
  • unauthorized disclosure;
  • alteration;
  • misuse;
  • loss.
Security measures may include:
  • access controls;
  • authentication measures;
  • encryption technologies;
  • vendor security requirements;
  • monitoring systems;
  • internal security procedures.
20. Third-Party Websites and Services
Our Services may contain links to third-party websites, applications, or services.
Third-party services are governed by their own privacy policies and practices. We encourage you to review those policies before providing Personal Information directly to third parties.
21. Global Privacy Control
Where required by applicable law, we recognize legally valid Global Privacy Control (“GPC”) signals as requests to opt out of applicable sale or sharing activities.
Because we do not sell Personal Information or share Personal Information for cross-context behavioral advertising, GPC requests generally do not require additional action beyond our existing privacy practices.
22. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect:
  • changes to our Services;
  • changes in processing practices;
  • operational changes;
  • legal or regulatory requirements.
Updated versions will be posted on our website with the updated effective date.
Your continued use of the Services after an updated Privacy Policy becomes effective indicates acceptance of the updated policy where permitted by applicable law.
23. Contact Us
If you have questions, privacy requests, or complaints regarding this Privacy Policy or our processing of Personal Information, contact us:
When submitting a privacy request, please include sufficient information for us to identify:
  • your request;
  • the relevant account or order;
  • the information involved.
We will respond within the time required by applicable privacy laws.
If you are not satisfied with our response, you may contact the relevant data protection authority or supervisory authority where applicable.