Privacy Policy

Who we are

Heart Note Studio is a South African sole-proprietor business operated by Jacqueline de Souza, who is responsible for your personal information. Contact: hello@heartnotestudio.co.za.

We follow South Africa's Protection of Personal Information Act (POPIA) and, where they apply to you, the UK and EU General Data Protection Regulation (GDPR).

What we collect

• Contact details: your name, email address and, if you choose, a WhatsApp number.
• Your story and song brief: the recipient's name, relationship, occasion, memories, personality details, special dates, musical preferences and anything else you choose to share.
• Reference photos you upload (optional, up to five).
• Order and payment records: package, price, discount or referral code, order number and payment status. Card details are handled by Paystack — we never see or store them.
• Messages you send us through your order page, contact form or email, plus revision requests and reviews you submit.
• Email sign-ups if you ask to receive gift ideas and offers.
• Website usage data through Google Analytics and the Meta Pixel, only where permitted by your cookie choices (see our Cookie Policy).

Information about the gift recipient is provided by you. Please only share what you are comfortable sharing and what the recipient would reasonably expect in a personal gift.

How we use it

• To write, produce and deliver your song, and to contact you about your order (performing our contract with you).
• To send order confirmations, questions about your brief and delivery notices.
• To send an abandoned-checkout reminder or marketing emails only if you ticked the relevant box. You can unsubscribe anytime.
• To keep financial records, prevent fraud and meet legal obligations.
• To understand website use and measure our advertising, only with your consent where the law requires it.

How songs are made and who sees your information

Your information is stored privately and accessed only by the studio operator. Order details are never public. Your private order page and any recipient gift page can be opened only by someone who has the unique link; please share them carefully.

To produce your song we use AI-assisted music tools. Where necessary, selected parts of your brief — such as lyrics, names, style and mood — are entered manually into third-party creative production services. We do not upload your reference photos or contact details to these services, and we share only what is needed to produce the song.

Service providers and international processing

• Lovable Cloud — website hosting, database and private file storage.
• Cloudflare — content delivery, security and approximate country detection for our cookie banner.
• Paystack — payment processing (charged in South African Rand).
• Resend — sending order and delivery emails.
• Google Analytics and Meta Pixel — usage and advertising measurement, consent-based. They receive page visits and, for paid orders, only the order number, value and currency — never your name, email, story, photos or recipient details.
• Google Fonts — website typefaces.
• AI music and creative production services — as described above.

Some of these providers process data outside South Africa, the UK or the EU (for example in the United States). Where that happens we rely on the providers' contractual and security safeguards for cross-border transfers.

How long we keep it

• Reference photos are automatically deleted 60 days after delivery. They are kept longer only while a revision is open, or where a dispute or legal obligation requires it.
• Finished songs, lyrics, artwork and gift files are kept so you can return to your order page and download them again.
• Order and payment records are kept as long as required for tax and accounting purposes.
• You can ask us to delete your story and other order details sooner, subject to these record-keeping obligations.

Your rights

You can ask to access, correct or delete your personal information, object to or restrict certain processing, withdraw consent (including marketing and cookies) and, where applicable, receive a copy of your data. Email hello@heartnotestudio.co.za and we will respond within one month. We may need to confirm your identity first.

You may also complain to South Africa's Information Regulator, or to your local data protection authority (such as the UK ICO or an EU supervisory authority).

Security

All storage is private, files are shared through expiring links, and access to order data is restricted to the studio operator. No system is completely secure, but we take reasonable steps to protect your information.