Privacy Policy

Who we are and how to reach us

The data controller for this service is Wansarit Kheawvimon, the operator of SongAsGift (“เพลงของขวัญ”), referred to in this policy as “we” or “us.”

Contact for privacy matters: support@songasgift.com

We operate from Thailand, under the Kingdom of Thailand, and are governed by the Personal Data Protection Act (PDPA). We also apply GDPR-aligned safeguards for customers located in Europe.

Service website: https://songasgift.com

This policy was last updated on 21 July 2026.

Data we collect

Recipient and creative details: the recipient's name, the story and memories you share, and the answers you give in the questionnaire so we can write the song.

Photos you choose to upload within the selected package limit for the music video (Lite accepts no photos, Standard up to 40, Premium up to 100). If the package does not use photos or you upload none, we produce a lyric video instead.

Your contact details, such as your email, to verify the order owner, provide support, and send the private status link or order-related notices.

Order metadata, such as the package you selected, any add-ons, order status, and related timestamps.

Payment-confirmation metadata from our payment processor. We never see or store your full card number.

Transfer-slip images and the transaction details visible on them, so we can match and verify payments and handle refunds or disputes.

Technical data needed for security, such as random access tokens and necessary activity logs.

When you submit photos or a story that include another person (for example, the gift recipient), you confirm that you have the right or consent to use that information for your order.

Purposes and legal bases

To create, quality-check, deliver, and support your order — legal basis: performance of our contract with you.

To moderate content and images for safety and to prevent unlawful use — legal basis: our legitimate interests and legal compliance.

To prevent fraud and keep our systems secure — legal basis: our legitimate interests.

To meet legal obligations, such as keeping accounting and tax records — legal basis: legal compliance.

To use your photos or story for advertising or promotion — only if you give separate, explicit consent, which you can withdraw at any time.

Storage and security

Photos, songs, and videos are held in private file storage and are never exposed as public URLs.

The database stores only the metadata we need; your story and contact details are encrypted at rest.

Access to drafts, order status, and gift links uses random tokens in HttpOnly cookies or time-limited links.

We review each order before delivery, which means only authorized access to your order content is used, and only as needed for that review.

We apply appropriate safeguards, but no system is ever fully secure, so we keep only what we need and delete it once it is no longer needed.

How long we keep data

Drafts that have not entered payment become due for deletion about 7 days after creation. Orders that enter Stripe Checkout or await payment confirmation from Stripe become due after about 30 days so there is time to reconcile and resolve payment issues.

Paid orders, including source photos and delivered files, become due for deletion about 30 days after payment is confirmed.

Deletion is carried out by our administrator, not automatically. We review and erase data that has come due at least every 30 days, so there may be a short period after the due date where data still exists until the next review.

If you would like your data erased sooner, contact us at support@songasgift.com and we will do it without waiting for the next review.

We keep some data longer only where the law requires it (for example, accounting records or fraud prevention), limiting it and minimizing identifiable information as far as we can.

Processors and sub-processors

We share data only as needed with the following service providers, under contracts and data-protection safeguards:

Infrastructure, CDN, private storage, and transactional email: Cloudflare

Payments (card and PromptPay when enabled): Stripe

AI model providers selected by the operator to assist with lyric drafting, photo analysis, and content safety; they receive only the order data needed for that step

Unlisted video delivery: YouTube/Google — only when your order receives a YouTube link. The video is not publicly searchable, but anyone with the link can watch it, and it is removed from YouTube when the order's data is erased

Core music generation and video rendering on GPU machines controlled by the operator

We do not sell your personal data, and we do not use your photos or story for advertising without separate consent.

International transfers

Some providers may process data on servers outside Thailand. Where data is transferred or accessed across borders, we do so under appropriate safeguards consistent with the Personal Data Protection Act (PDPA) and GDPR-aligned safeguards.

Core music generation and video rendering run on GPU machines controlled by the operator. Lyric drafting or photo analysis may use external AI model providers as disclosed above.

Your rights

Under the Personal Data Protection Act (PDPA), you have the right to:

Access and obtain a copy of your personal data.

Rectify data that is inaccurate or out of date.

Erase or destroy your data.

Restrict or suspend the use of your data.

Object to the collection, use, or disclosure of your data.

Withdraw consent you previously gave, at any time, without affecting processing carried out before the withdrawal.

Lodge a complaint with the relevant data-protection authority.

Exercising your rights

To exercise any of these rights, contact us at support@songasgift.com. We may ask for information to verify your identity before we act.

We will respond within the timeframe required by law. In some cases we may be unable to fulfill a request in full where it conflicts with a legal obligation or the rights of others, and we will explain why.

Children and age

This service is for adults. Minors must have a guardian's consent before using it.

We do not intentionally collect children's data. If you believe a minor's data has been submitted without appropriate consent, contact us so we can delete it.

We do not offer voice cloning.

Cookies

We use essential cookies only: your language preference, tokens that let you access your order, draft, and gift link, and a record of your consent acknowledgement.

We do not use advertising cookies or any third-party analytics or tracking.

See our Cookie Policy for more detail.

Changes to this policy

We may update this policy from time to time to reflect changes in our service or legal requirements. When we make a material change, we will update the last-updated date and notify you where appropriate.

This policy was last updated on 21 July 2026.

Contact us

If you have questions about this Privacy Policy or want to exercise your rights, contact Wansarit Kheawvimon at support@songasgift.com.