Privacy Policy
This notice explains what we do with your personal data when you use Cantarova, how long we keep it, and the rights you have over it.
Last updated: 28 juillet 2026
This document is currently available in English only. If anything in it is unclear, email us and we will explain it in your language.
1. Who is responsible for your data
The data controller for the personal data described in this notice is:
NOVALY GROUP LTD
trading as Cantarova
- Company number:
- 16823691
- Registered in:
- England and Wales
If you have any question about this notice or want to exercise a right, email us and we will handle it ourselves — there is no ticket queue to get lost in.
2. What we collect
We collect only what the service needs to work:
| Data | Where it comes from |
|---|---|
| Your email address | You, in the wizard or at sign-in |
| The story, names, and relationship details you write for the song | You, in the wizard |
| Your song choices: genre, style, voice, language, occasion | You, in the wizard |
| Order and payment records, including the amount and currency | Created when you buy |
| Your name, if you give us one when reviewing or signing in | You, or Google if you use Google sign-in |
| A one-way hashed form of your IP address | Automatically, to stop abuse of the free previews |
| Basic technical data: browser, device type, pages visited | Automatically |
The story you write often contains personal data about someone else — the person the song is for. Please share only what you would be comfortable with them knowing you shared, and see our Acceptable Use Policy for what is off-limits. We do not need, and ask you not to give us, health information, religious or political beliefs, or any other special-category data.
We never receive or store your full card number. Stripe handles the payment and tells us only whether it succeeded, the amount, and the country used for tax.
3. Why we use it, and on what legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Generate your lyrics, previews, song, cover, and PDF | It is the service you asked for | Performance of a contract |
| Send your delivery email, receipt, and sign-in links | You cannot receive your order otherwise | Performance of a contract |
| Keep your order in your account so you can download it again | The access we promised you when you bought | Performance of a contract |
| Check submitted content against our content rules | To keep the service lawful and safe | Legal obligation and legitimate interests |
| Rate-limit free previews using hashed IPs | To stop abuse that would make free previews impossible to offer | Legitimate interests |
| Keep transaction records | UK tax and accounting law requires it | Legal obligation |
| Measure advertising and website performance | To understand what works and keep the site fast | Consent, for anything non-essential |
| Send marketing email | Only if you actively opted in | Consent, withdrawable at any time |
4. Automated processing and AI
Your story and the names you provide are sent to third-party AI providers so that lyrics, music, and cover art can be generated. This is automated: no human at Cantarova reads your story as part of the normal production process, though we may look at an order if you contact support about it or if it is flagged by our content checks.
This automated processing produces a song. It does not produce any decision that has a legal or similarly significant effect on you, so the rules on automated decision-making in Article 22 UK GDPR do not apply.
6. Sending data outside the UK and EEA
Several of the providers above are based in the United States or process data globally. Where personal data leaves the UK or the EEA, we rely on the UK International Data Transfer Addendum, the European Commission's Standard Contractual Clauses, or an adequacy decision, depending on the provider and destination.
You can ask us for details of the safeguard applying to a particular transfer.
7. How long we keep things
We keep different things for different periods, because some are legally required and some are not:
| What | How long | Why |
|---|---|---|
| Order and payment records | 6 years after the order | Required by UK tax and accounting law — we cannot delete these earlier even at your request |
| Your song, lyrics, cover, PDF, and gift page | For as long as your account exists | This is the lifetime access you paid for |
| The free-text story you submitted | 90 days after delivery | It is the most personal thing you give us and is not needed once the song exists |
| Hashed IP addresses used for rate limiting | 30 days | Long enough to stop abuse, short enough to be proportionate |
| Draft orders that never resulted in a purchase | 30 days | No reason to keep an abandoned draft |
| Support messages | 2 years after the conversation ends | So we can pick up a returning problem where we left off |
If you ask us to delete your account, we delete your songs, files, gift pages, and story text, and we keep only the minimum transaction record that tax law obliges us to keep.
8. Your rights
You have the right to:
- Get a copy of the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data deleted, subject to the tax-record exception above.
- Object to, or ask us to restrict, processing based on our legitimate interests.
- Receive your data in a portable format.
- Withdraw any consent you have given, at any time, without affecting what was done before you withdrew it.
Email us to exercise any of these. We will respond within one month, and we will not charge you or ask you to justify the request.
If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk). If you live in the EU, you can complain to your national data-protection authority instead.
9. Security
Your audio files are held in private storage and are never publicly readable. Downloads are served through short-lived signed links generated at the moment you click, and those links expire within minutes.
A gift page link is deliberately shareable, so treat it like a key: anyone who has the link can play the song on that page. Tell us if a link has gone somewhere you did not intend and we will disable it.
We use passwordless sign-in, so there is no password of yours for us to leak.
10. Children
Cantarova is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, tell us and we will delete it.
11. Changes to this notice
If we make a significant change we will say so on this page and update the date shown at the top. Where the change requires your consent, we will ask for it rather than assume it.