SongCraft Privacy

An order may collect contact details, order identifiers and status, package selection, story details and uploads for the song, support messages, delivery information, and minimal payment or refund references.

SongCraft uses that information to review requests, process orders, create and deliver the requested work, provide support, handle refunds or disputes, maintain security and audit evidence, and respond to privacy requests.

Customers should not send payment card numbers, passwords, API keys, private credentials, unrelated private files, or sensitive third-party material through support email or the song brief.

Payment processing is handled by Stripe. SongCraft retains only minimal payment, refund, and dispute references needed for records and support; it does not retain full payment-card data.

Support may use customer-safe identifiers such as checkout email, order slug, issue category, and approximate event time to investigate support, refund, cancellation, or delivery questions.

Plaintext delivery tokens are not retained. A delivery token expires after 30 days; hashed token metadata and delivery events may be retained for 180 days after expiry or revocation.

The minimal order and status ledger, and minimal Stripe references, are retained for seven years after closure. Contact data is minimized after 24 months unless a dispute or legal hold requires it.

Briefs and uploads are retained for 90 days after delivery, cancellation, or refund. Deliverables are retained for 90 days after delivery and 30 days after cancellation or refund. Support correspondence is retained for 24 months after ticket closure.

Application logs are retained for 30 rolling days. Audit and security logs are retained for 13 months; documented material-incident evidence may be held for up to three years. Encrypted backups age out within 35 rolling days and deletion tombstones must be replayed after a restore.

A documented legal hold records its owner, reason, scope, start time, and review date, and is reviewed at least every 90 days.

Send privacy requests to [email protected]. Support may forward a request. SongCraft acknowledges requests within two business days and targets completion within 30 calendar days.

To protect the customer, SongCraft verifies control of the checkout email with a one-time code plus the order slug. An approved export is a minimal encrypted JSON or ZIP package delivered by a single-use link that expires after seven days.

An approved deletion removes active briefs, uploads, deliverables, and unnecessary contact data. Legally required minimized transaction and audit records may be preserved. Backups age out within 35 days and a deletion tombstone is replayed after restore.

SongCraft retains a sanitized completion record for six years but never retains the export package as evidence.