Privacy Policy | Musikeando

Musikeando values the privacy and security of its users’ data. This Privacy Policy describes how we collect, use, store and protect personal information, in accordance with Brazil’s General Data Protection Law (LGPD, Law no. 13.709/2018) and other applicable legislation.

1. Data we collect

We collect different kinds of personal data depending on how you interact with the platform:

1.1. Data you provide

Registration: name, email address, password (stored encrypted), date of birth (optional) and city (optional).
Social sign-in: if you register with Google, we collect the name, email address and profile picture the provider supplies.
Song creation: information about the occasion, the name of the person being celebrated, your relationship, the personal story and the musical preferences you provide during the creation process.
Contact: name, email address and the content of messages sent through the contact form.

1.2. Data collected automatically

Browsing data: IP address, browser type, operating system, pages visited, time spent and referral source.
Cookies and similar technologies: we use cookies to keep your session active, remember preferences and improve the experience.
Usage data: interactions with the platform, songs created, previews generated and downloads made.

2. How we use your data

The personal data we collect is used for the following purposes:

Providing the service: creating and delivering personalized songs as requested.
Account management: authentication, credit management, order history and customer support.
Payment processing: enabling secure financial transactions through Stripe.
Communication: sending order confirmations, service updates, news and promotions (with consent).
Service improvement: analysing usage patterns to improve the platform, song quality and the user experience.
Security: preventing fraud, abuse and unauthorised activity.
Legal obligations: meeting regulatory and tax requirements.

3. Lawful basis for processing (LGPD)

The processing of your personal data is based on the following lawful bases set out in Brazil’s LGPD:

Performance of a contract (art. 7, V): to provide the services you contracted (creating and delivering personalized songs).
Consent (art. 7, I): to send marketing communications and to use non-essential cookies.
Legitimate interest (art. 7, IX): to improve services, secure the platform and prevent fraud.
Compliance with a legal obligation (art. 7, II): to meet tax and regulatory requirements.

4. Cookies and tracking technologies

Musikeando uses the following types of cookies:

Essential cookies: required for the platform to work, for authentication and for security. These cannot be disabled.
Performance cookies: collect anonymous information about how people use the platform, allowing continuous improvement.
Functionality cookies: remember your preferences to personalise the experience.

You can manage your cookie preferences through your browser settings. Disabling essential cookies may prevent the platform from working properly.

5. Sharing with third parties

Musikeando may share personal data with the following partners and service providers, solely for the purposes described in this policy:

Stripe: payment processing. Stripe has its own privacy policy and is certified PCI DSS Level 1, the highest security level for payment processing. Your card details are processed directly by Stripe and never stored on our servers.
Authentication providers: Google (for social sign-in), which processes data under its own privacy policy.
Analytics services: to understand how the platform is used and improve the experience. Data collected is anonymised wherever possible.
Infrastructure providers: hosting and cloud storage services that may process data on servers located outside Brazil, with appropriate safeguards.
Email service: Resend, for transactional emails and communications.

We do not sell, rent or trade our users’ personal data to third parties for marketing purposes.

6. Data retention and storage

Personal data is stored for as long as necessary to fulfil the purposes for which it was collected, according to the following periods:

Account data: kept while the account is active. Following a deletion request, data is removed within 30 days, except where there is a legal obligation to retain it.
Transaction data: kept for 5 (five) years to meet tax and accounting obligations.
Songs and created content: kept for at least 12 months after purchase to allow downloads. After that period, files may be removed from our servers.
Browsing and analytics data: kept for 26 months in anonymised form.

7. Your rights (LGPD)

Under Brazil’s LGPD you have the following rights over your personal data:

Confirmation and access: confirm whether your data is being processed and obtain a copy of the personal data we hold.
Correction: request the correction of incomplete, inaccurate or out-of-date data.
Anonymisation, blocking or erasure: request the anonymisation, blocking or erasure of unnecessary data or data processed in breach of the LGPD.
Portability: request the transfer of your data to another service provider.
Erasure: request the deletion of personal data processed on the basis of consent.
Information about sharing: find out which public and private entities your data is shared with.
Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.
Objection: object to processing based on legitimate interest where it does not comply with the LGPD.

To exercise any of these rights, contact us at [email protected]. We will respond within 15 (fifteen) working days, as provided by the LGPD.

8. Data security

Musikeando applies technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or destruction, including:

Encryption of data in transit (HTTPS/TLS) and at rest.
Passwords stored with a secure cryptographic hash (bcrypt).
Access to personal data restricted to authorised staff only.
Payment processing through Stripe (PCI DSS Level 1).
Continuous monitoring for vulnerabilities and threats.
Regular backups and disaster recovery plans.

9. International data transfers

Some of our service providers may be located outside Brazil. In those cases we ensure that the international transfer of data is carried out with appropriate safeguards, as provided by the LGPD (art. 33), including:

Transfer to countries with an adequate level of data protection.
Specific contractual clauses guaranteeing the protection of the data.
Adoption of internationally recognised security standards.

10. Minors

Musikeando does not knowingly collect personal data from anyone under 18 without the consent of a parent or legal guardian. If we identify that a minor’s data has been collected without proper consent, we will delete it immediately.

11. Changes to this policy

This Privacy Policy may be updated from time to time to reflect changes in our practices or legal obligations. Significant changes will be communicated by email or by notice on the platform. We recommend reviewing this policy periodically.

12. Contact and Data Protection Officer (DPO)

For questions about privacy and data protection, contact our Data Protection Officer:

Email: [email protected]
Contact page: musikeando.com/contact

If you are not satisfied with our response, you can lodge a complaint with Brazil’s National Data Protection Authority (ANPD) at www.gov.br/anpd.