Effective since 04/29/26

Privacy Policy

How we collect, use, and protect your information

At myLoveSong, we take your privacy seriously. This Privacy Policy explains what information we collect when you use our service, how we use it, who we share it with, how long we keep it, and the rights you have over it. We've tried to write this in plain language. Where regulatory language is required (GDPR, CCPA, LGPD, and other regional privacy laws), we've included it in the sections below.

This Privacy Policy is part of our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service. If there is a conflict between this Privacy Policy and the Terms of Service on a privacy-related matter, this Privacy Policy controls.

This Privacy Policy applies to information we collect through the myLoveSong website (mylovesong.com), the custom love song production service, and all related products and functionality (together, the "Service"). The Service is operated by myLoveSong ("MLS," "we," "us," or "our"), the consumer-facing brand of MLS Studio, LLC, a Florida limited liability company. Note on terminology: "MLS Studio, LLC" (the operating entity, with comma and LLC suffix) is distinct from "MLS Studio" (the proprietary production environment, defined in our Terms of Service). This Privacy Policy uses "MLS" to refer collectively to the brand and the operating entity.

It covers:

Information you provide when you place an Order (your Intake Content — the details you submit through the order form).
Information we collect automatically when you use the Service.
Information we receive from third parties (such as payment processors and marketing partners).
Information you share with us through reviews, reaction videos, and other user-generated content.
How we use, share, and protect all of the above.

If you do not agree with this Privacy Policy, please do not use the Service.

Privacy at a Glance

Here's the short version of how we handle your information:

What we collect: The story details you submit (Intake Content), your contact and billing info, automatic technical data when you visit the site, and reaction-video content if you submit it.

What we use it for: Producing your Work; processing payment; sending you Order updates; supporting you when you contact us; improving the system through aggregate-pattern analysis (not your individual story).

Who we share it with: Service providers that help us run the Service (payment, hosting, production pipeline, analytics) under contractual safeguards. We do not sell your personal information.

How long we keep it: Your individual story details for 1 year after delivery; transaction records for 7 years (tax/legal); other categories per Section X. Aggregate patterns (de-identified) are kept indefinitely.

What we don't do: We don't sell your information. We don't publish your individual story. We don't use your individual story to train external generative AI models.

Your rights: You can access, correct, delete, or port your information; object to certain processing; withdraw consent; and complain to a privacy regulator. Specific rights vary by jurisdiction — see Sections XIII through XXII.

How to reach us: privacy@mylovesong.com

The detail is below.

2.1 Information You Provide

When you place an Order or interact with the Service, you provide us with the following types of information:

Contact information: your name, email address, and in some cases a phone number.
Billing information: your billing address and payment details. Payment card information is processed and stored by our payment processors, not by MLS — we receive only confirmation of payment and limited transaction metadata.
Intake Content: the information, stories, names, details, vibe selections, style preferences, voice preferences, and any other content you submit through our order form or otherwise provide to us in connection with an Order — including your story, the recipient's name, relationship details, vibe selection, style preference, and singer's voice preference. Intake Content typically includes information about another person (most commonly the loved one you are ordering the Work for).
Support communications: if you contact us at support@mylovesong.com, privacy@mylovesong.com, legal@mylovesong.com, or through any other support channel, we collect the content of your message and any information you share during the exchange.
Revision requests: when you submit a revision form for a delivered Work, we collect the content of your revision request.
User-generated content: if you submit a review, reaction video, testimonial, photo, or other content (whether through Judge.me, social media, direct message, our reaction-video reward program, or any other channel), we collect the content of that submission.
Sensitive personal information (conditional): Intake Content is free-form, and the details you submit may at times include information that qualifies as "sensitive personal information" under certain privacy laws — for example, references to religious beliefs, health, family relationships, or other personal categories. We process sensitive personal information only to the extent it appears in the details you submit for the purpose of producing your Work. We do not ask for it, and we do not process it for any other purpose.

2.2 Information We Collect Automatically

When you use the Service, we and our service providers automatically collect certain information about your device and your interactions with the Service, including:

Device and browser information: device type, operating system, browser type and version, screen size, and language preference.
IP address and approximate location: your IP address and the approximate geographic location derived from it.
Usage information: pages visited, time spent on pages, links clicked, Order flow interactions, and referring website.
Session-level behavior data: through heatmap and session-recording tools, we may capture data about how visitors interact with our pages — such as scroll depth, click patterns, field focus, navigation paths, and which sections receive attention. Session recordings may capture individual interaction patterns that we analyze for site-improvement purposes. We do not capture the text you type into order-form Intake Content fields, revision-request fields, payment fields, password fields, or other sensitive form fields; those fields are masked or excluded from session recordings before data is stored by our session-recording providers. Where required by applicable law, session-recording tools are subject to cookie consent (see Section IX).
Device fingerprinting (limited): certain analytics and fraud-prevention tools may combine several of the signals above (device type, browser, IP, screen size) into a device-level identifier to detect repeat visits and prevent fraudulent activity. This is not used for cross-site tracking beyond our Service.
Cookies, pixels, and similar tracking technologies: see Section IX for full details.

2.3 Information from Third Parties

We may receive limited information about you from third-party service providers, including:

Payment processors (such as Shopify Payments, PayPal, Klarna, and Affirm) — transaction confirmation, fraud-detection signals, limited payment-method information, and (for buy-now-pay-later providers) credit-decision outcomes related to your Order. We do not receive your full payment card number or other sensitive payment credentials; these remain with the payment processor.
Marketing and advertising platforms (such as Meta, TikTok, Google Ads, and similar platforms) — information about how you came to our site and how our ads performed.
Analytics providers (such as Google Analytics) — aggregated behavioral data about visitors to our site.

2.4 Whether Provision of Information Is Required

When you place an Order, certain categories of information are required to perform the contract: at minimum, your contact information (to deliver your Order and the Work), your payment information (to process your purchase), and Intake Content sufficient for MLS Studio to produce a Work. If you do not provide these, we cannot deliver the Service, and your Order will not be processed. Other categories — for example, sensitive personal information that may appear in your story — are not required by us; we accept whatever level of detail you choose to share. Marketing communications consent is optional and refusal does not affect your ability to use the Service.

2.5 Information About Third Parties Included in Your Intake Content

Intake Content typically includes personal information about another person — most commonly the recipient of your Work (the loved one for whom you are ordering the Work). MLS does not directly collect this information from the recipient and does not have a practical means of contacting them with notice. We rely on the warranty in our Terms of Service that you have the right to share information about third parties with us. Under GDPR Article 14(5)(b) and equivalent provisions of other privacy laws, providing direct notice to recipients would involve disproportionate effort because MLS does not have, and cannot reasonably obtain, the recipient's contact information. We therefore rely on this exception. We process recipient information only for the purpose of producing your Work and retain it on the same schedule as the rest of your Intake Content (Section X). If a recipient of a Work contacts us at privacy@mylovesong.com to exercise rights regarding their personal information, we will respond consistent with applicable law.

We use the information we collect for the following purposes:

3.1 To Produce and Deliver Your Work

We use the details you submit as the source material that MLS Studio builds your Work around. This is the primary purpose of our processing and is essential to delivering the Service you ordered.

3.2 To Process Payments and Prevent Fraud

We use your billing information to process your payment, issue refunds where applicable, and detect and prevent fraudulent transactions. We work with payment processors that are PCI-DSS compliant. For buy-now-pay-later transactions, our BNPL partners process credit decisions and repayment according to their own privacy policies.

3.3 To Communicate With You About Your Order

We use your email address (and, where provided, your phone number) to send you Order confirmations, production updates, delivery notifications, revision updates, refund confirmations, and other transactional communications related to Orders you place.

3.4 To Provide Customer Support

We use the information you share when contacting support to respond to your questions, resolve issues, and improve our support operations.

3.5 To Improve the Service

We continuously improve MLS Studio by analyzing aggregate patterns across many Orders — structural signals such as overall approval rates, the kinds of reasons revisions tend to be requested, and similar pattern-level indicators. This analysis operates on patterns across many Orders rather than on the content of any individual story. See Section VI for the full explanation of this and the protections that apply to your individual Intake Content.

3.6 To Send Marketing Communications (with Your Consent)

Where you have consented (or where our legitimate interests permit under applicable law), we may send you marketing emails and (where you have separately opted in) marketing text messages about new products, offers, and content. You can unsubscribe from marketing emails at any time using the unsubscribe link in any marketing email. You can stop receiving marketing text messages at any time by replying STOP to any marketing message. We'll never make you jump through hoops to leave the list. See Section XXIV for full details.

3.7 To Display Reviews and Showcase Customer Stories

When you submit a review, reaction video, or other user-generated content, we may display it on our website, social media, advertising, and other marketing surfaces, consistent with the rights you grant under our Terms of Service. See Section XI for how we handle this content.

3.8 To Comply with Legal Obligations

We may process your information to comply with applicable laws, respond to lawful requests from public authorities, enforce our Terms of Service, protect our rights, and protect the safety of our users and the public.

3.9 For Security, Fraud Prevention, and Legal Protection

We process your information as necessary to protect the security of the Service, to prevent, detect, and investigate fraud, to enforce our Terms of Service, and to protect the legal rights of MLS, our users, and the public. This includes logging access attempts, monitoring for abuse, and investigating suspected violations.

If you are in the European Union, the United Kingdom, or another jurisdiction with equivalent privacy legislation, we process your personal information on one or more of the following legal bases under Article 6 of the GDPR (and the UK GDPR equivalent):

Processing Activity	Legal Basis
Producing and delivering your Work	Contract performance (Art. 6(1)(b)) — processing is necessary to perform the contract you entered into when you placed your Order.
Processing payments and preventing fraud	Contract performance (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) — fraud prevention is our legitimate interest and yours.
Communicating with you about your Order	Contract performance (Art. 6(1)(b)).
Providing customer support	Contract performance (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)).
Improving the Service (aggregate pattern analysis)	Legitimate interests (Art. 6(1)(f)) — our interest in continuously improving the quality of the Service for future buyers, balanced against your rights. See Section VI for the protections that apply.
Sending marketing communications	Consent (Art. 6(1)(a)) where consent is required, or legitimate interests (Art. 6(1)(f)) where applicable law permits.
Displaying user-generated content	Consent (Art. 6(1)(a)) granted at the time of submission.
Security, fraud prevention, and legal protection	Legitimate interests (Art. 6(1)(f)) — our interest in maintaining Service integrity and preventing harm, balanced against your rights.
Complying with legal obligations	Legal obligation (Art. 6(1)(c)).
Protecting rights, property, and safety	Legitimate interests (Art. 6(1)(f)).

You can object to processing based on legitimate interests at any time by contacting privacy@mylovesong.com. Where we process your information based on consent, you can withdraw that consent at any time (withdrawal does not affect the lawfulness of processing before withdrawal).

Special Category Data (Article 9 GDPR)

The details you submit through the order form may, at your discretion, include information that GDPR classifies as "special category data" — for example, references to religious beliefs, health, or relationship and personal-life details that may relate to sexual orientation. We do not require you to provide any special category data, and we do not actively prompt for it. Where you choose to include such information in the details you submit, we process it on the basis of your explicit consent under Article 9(2)(a) GDPR, given when you submit the order form, for the sole purpose of producing your Work. You may withdraw consent at any time by contacting privacy@mylovesong.com (withdrawal does not affect the lawfulness of processing before withdrawal, and may affect our ability to deliver an Order already in production).

Producing your Work involves automated processing. MLS Studio — our proprietary production environment combining songwriting craft tradition (drawing on sources like Jimmy Webb's Tunesmith and Pat Pattison's Berklee songwriting pedagogy), music psychology research, and modern music production technology — processes the details you submit to produce the Work you ordered. MLS Studio includes artificial intelligence and machine-learning tools as part of its production pipeline. These tools — used in combination with the songwriting craft frameworks and music-psychology research described above, and designed and overseen by the Producer team — generate elements of the lyrical, melodic, and arrangement output of each Work. The system processes the details you submit by extracting the emotional core of the story you describe and applying production parameters to produce a Work built around that core. The system does not analyze, score, or rank you as an individual; it processes your inputs to produce creative content.

This automated processing is essential to deliver the Service and is carried out on the legal basis of contract performance (GDPR Article 6(1)(b)).

The automated processing does not produce decisions with legal or similarly significant effects on you. It produces creative content (a custom love song) based on the information you provide. It does not determine your access to credit, employment, housing, education, government services, healthcare, or any other legally or similarly significant outcome.

Your Rights in Relation to Automated Processing

Under Article 22 of the GDPR and equivalent provisions in other privacy laws, you have specific rights in relation to automated processing. Because this processing produces creative content and not a decision with legal or similarly significant effects on you (as described above), the full Article 22(3) protections for decisions that do have such effects do not apply. Nonetheless, we offer the following rights as a matter of policy:

Right to request re-production of your Work. If you are not satisfied with your delivered Work, you may request revisions or a refund (subject to the conditions in the Terms of Service). The revision system is the mechanism through which you request that the details you submitted be re-processed to produce a different result.
Right to contact us about the processing of your Order. If you have questions or concerns about how the details you submitted were processed to produce your Work, you may contact us at privacy@mylovesong.com and we will respond in accordance with applicable law.
Right to information about the processing. You have the right to receive meaningful information about the processing that produced your Work. This Privacy Policy, together with the Terms of Service, provides that information.
Right to opt out of profiling under US state privacy laws. Several US state privacy laws (including Virginia, Colorado, Connecticut, Texas, and Oregon) give residents the right to opt out of profiling in furtherance of decisions producing legal or similarly significant effects. The automated processing that produces your Work does not produce such decisions, but if you are a resident of a state with this right and you wish to opt out of any other profiling activity, you may contact privacy@mylovesong.com.

Your individual stories stay yours. The specific details of what you shared — the names, the moments, the relationship — are used to produce your Work. They are not used to train any third-party or public generative model, and they are not sold, shared, or published.

What We Do with Aggregate Patterns

To continuously improve the quality of MLS Studio over time, we review aggregate patterns across many Orders — structural signals such as:

Overall approval rates (how often Works are approved on the first delivery).
The kinds of reasons buyers request revisions (for example, whether a revision was requested for pronunciation, for pacing, for a lyric line, or for the overall mood).
Ratings or feedback buyers provide about their Works.

This analysis operates on patterns across many Orders, not on the content of any individual story. It helps us understand where MLS Studio is working well and where it can be refined — so that future buyers receive better Works.

What We Do Not Do

To be specific about what this improvement process does not include:

We do not publish your individual Intake Content anywhere.
We do not sell, share, or license your individual Intake Content to any third party.
We do not use your individual Intake Content to train any external or public generative model.
We do not share your individual story with other buyers, in marketing, or in any public-facing context.

The pattern analysis we perform operates internally and is directed entirely at improving MLS Studio. Individual stories are not the unit of analysis; aggregate structural outcomes are. You can object to this pattern analysis at any time by contacting privacy@mylovesong.com; we will honor the objection and exclude your future Orders from aggregate analysis.

Legal Basis

Where you are in the European Union, United Kingdom, or another GDPR-equivalent jurisdiction, this aggregate-pattern improvement activity is carried out on the basis of our legitimate interests in improving the Service (GDPR Article 6(1)(f)), balanced against your rights. You can object to this processing at any time by contacting privacy@mylovesong.com.

The contractual license you grant under Terms of Service Section XIV addresses MLS's intellectual-property authority to use creative content within Intake Content for aggregate-pattern analysis. The legitimate-interests legal basis under GDPR Article 6(1)(f) addresses the separate question of MLS's authority under privacy law to process the personal data within Intake Content for that purpose. Both authorities apply concurrently; the right to object described above operates against the GDPR legal basis and is honored regardless of the contractual license.

We do not sell your personal information. We share your information only in the following circumstances.

7.1 With Service Providers That Operate Components of the Service

We share information with third-party service providers that help us operate the Service. These include the following categories of providers:

E-commerce and hosting: our e-commerce platform provider (currently Shopify), including built-in tools such as Shopify Forms, Shopify Flow, and Shopify Messaging.
Payment processing: Shopify Payments, PayPal, and any other payment processors offered at checkout.
Buy-now-pay-later providers: providers such as Klarna and Affirm that allow you to pay for your Order in installments. These providers have their own privacy policies, may make credit decisions based on the information you provide them, and may share repayment information with credit bureaus where required by law or their own policies.
Production pipeline providers: third-party providers that operate components of MLS Studio's production pipeline. These providers process the details you submit solely for the purpose of producing your Work. We contractually require these providers to process the details you submit solely to produce your Work, to maintain appropriate safeguards, and to handle your information consistent with this Privacy Policy. Your stories are not used to train their public generative models.
Email and SMS marketing platforms: our email and SMS marketing service provider (currently Klaviyo or an equivalent platform) and marketing-automation tools used for transactional and marketing communications.
Reviews and customer-content platforms: our review and customer-content platform (currently Judge.me or an equivalent platform), which collects and displays reviews and ratings you submit.
Post-purchase upsell tools: providers such as AfterSell that present and process post-purchase offers (such as the Duet Edition or additional Enhancements) using the same payment method you used for your initial Order.
Analytics providers: Google Analytics and similar analytics services.
Session-recording and heatmap tools: providers such as Microsoft Clarity, Hotjar, or equivalent session-recording platforms that capture behavioral data (scroll, click, and interaction patterns) subject to the masking and consent gating described in Section 2.2 and Section IX. Sensitive form fields are automatically masked. These providers process interaction data as our service provider/processor.
Advertising platforms: Meta, TikTok, Google Ads, and similar platforms that help us reach potential buyers.
Customer support tools: helpdesk and support-management platforms (such as Gorgias or an equivalent).

Internal-recipient flow — Producer team tip messages. When you submit a tip and a tip message through the customer-facing tip mechanism described in Terms of Service Section VII, the tip message is routed to the Producer team as an internal recipient. The Producer team is not a third-party service provider; the routing is an internal communication flow within MLS's organizational structure. Tip messages are retained as Producer-team operational records.

Vendor Flexibility

We work with the providers above to deliver the Service and may add, remove, or replace providers over time as our operational needs evolve. When we make a material change to the categories of providers we work with — particularly when a change affects how your personal information is processed — we will update this Privacy Policy and notify you per Section XXVI (Changes to This Privacy Policy).

We contractually require all service providers to process your information only for the purposes we authorize, to maintain appropriate safeguards, and to comply with applicable privacy laws.

Complete Current List of Processors

A complete, current list of the specific service providers we use — including identity, purpose, and data handling role — is available upon request at privacy@mylovesong.com.

7.2 For Legal Reasons

We may share your information when we believe in good faith that sharing is necessary to:

Comply with applicable law, regulation, legal process, or governmental request.
Enforce our Terms of Service or investigate potential violations.
Detect, prevent, or address fraud, security, or technical issues.
Protect the rights, property, or safety of MLS, our users, or the public.

7.3 In Connection with a Business Transaction

If MLS is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business or assets, your information may be transferred as part of that transaction. We will notify you (by email or a prominent notice on the Service) of any such transfer and of any resulting changes to this Privacy Policy.

7.4 With Your Consent

We may share your information for other purposes if you explicitly consent to the sharing.

MLS is based in the United States. When you use the Service from outside the United States, your information will be transferred to, stored in, and processed in the United States and other countries where our service providers operate. These countries may have privacy laws that are different from (and may provide less protection than) the laws of your country of residence.

Safeguards for International Transfers

Where we transfer your personal information from the European Economic Area, United Kingdom, Switzerland, or another jurisdiction with equivalent privacy legislation to a country not recognized as providing an adequate level of protection, we rely on one or more of the following legal mechanisms:

Standard Contractual Clauses (SCCs) adopted by the European Commission (or the equivalent UK IDTA for UK transfers).
EU-US Data Privacy Framework (DPF) reliance — where one of our service providers participates in the DPF, we may rely on their certification as the transfer safeguard for personal data we transfer to that provider.
Other appropriate safeguards as permitted under applicable law.

You may contact privacy@mylovesong.com to request a copy of the safeguards we have in place for a specific transfer.

Transfer Impact Assessments

For transfers to jurisdictions not deemed adequate under applicable privacy law, we will conduct, and document, a Transfer Impact Assessment (TIA) as part of our vendor onboarding process to evaluate whether the safeguards provide an essentially equivalent level of protection, consistent with the standard set forth in Schrems II and subsequent guidance. You may request summary information about our TIA for a specific transfer at privacy@mylovesong.com.

Transfers Subject to Brazilian Law (LGPD)

For transfers of personal data subject to Brazilian law (LGPD) outside Brazil, we rely on the transfer mechanisms permitted under LGPD Articles 33–36, including standard contractual clauses adopted by the Autoridade Nacional de Proteção de Dados (ANPD) where applicable, or other safeguards permitted under ANPD guidance.

We use cookies, pixels, and similar tracking technologies to operate the Service, remember your preferences, analyze usage, and deliver relevant marketing.

Types of Cookies and Tracking Technologies We Use

Category	Purpose	Examples
Strictly necessary	Required for the Service to function (such as maintaining your Order session and processing checkout). Cannot be disabled.	Shopify session cookies, cart cookies.
Analytics	Help us understand how visitors use the Service so we can improve it.	Google Analytics, Shopify analytics.
Behavioral analytics (heatmaps and session recordings)	Help us see at an aggregate level which areas of the page receive attention, where visitors get confused, and how to improve the Service. Intake Content, revision text, payment fields, password fields, and other sensitive form fields are masked or excluded.	Microsoft Clarity, Hotjar, or equivalent.
Marketing	Help us measure the performance of our advertising and show relevant ads to people likely to be interested in MLS.	Meta Pixel, TikTok Pixel, Google Ads conversion tags.
Functional	Remember your preferences (such as language or region).	Preference cookies.

Managing Cookies

You can control most cookies through your browser settings. For analytics and marketing cookies specifically, you can opt out through:

Browser settings: most browsers let you block or delete cookies.
Google Analytics: Google's opt-out browser add-on at https://tools.google.com/dlpage/gaoptout.
Meta: Meta's ad preferences at https://www.facebook.com/ads/preferences/.
Network-level opt-outs: the Digital Advertising Alliance at https://www.aboutads.info/choices/ and the Network Advertising Initiative at https://optout.networkadvertising.org/.

If you are in a jurisdiction that requires cookie consent (such as the EU, UK, or certain US states), we use a consent management platform that controls when non-essential cookies and tracking technologies are loaded. The first time you visit the Service, you will be presented with a cookie consent banner that allows you to accept, reject, or customize your choices for analytics, behavioral analytics, and marketing categories — with reject and customize options presented at equal prominence to accept. Strictly necessary cookies do not require consent and load on every visit. Where your jurisdiction requires opt-in consent before non-essential cookies are placed (such as the EU, UK, certain US states, and certain Latin American jurisdictions), non-essential cookies will not load until you affirmatively consent. Where opt-out is the standard (such as most other US states), you may withdraw consent at any time by adjusting your preferences through the banner or your browser settings.

Global Privacy Control (GPC) and Universal Opt-Out Mechanisms

Where your browser sends a Global Privacy Control (GPC) signal or a comparable universal opt-out mechanism (UOOM), we treat that signal as a valid request to opt out of the sale or sharing of your personal information for cross-context behavioral advertising under the CCPA and equivalent state laws. We also honor opt-out preference signals required by applicable law (including the "Universal Opt-Out Mechanism" under Colorado, Connecticut, Texas, and other state privacy laws).

We keep your information only for as long as we need it for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Specific Retention Periods

Data Category	Retention Period
Intake Content (individual)	Retained for 1 year after Order delivery and final approval (or automatic approval) to support re-download requests, late revision requests, reorder cross-referencing, customer support inquiries about a delivered Order, fraud and abuse investigations, and dispute resolution under these Terms. After 1 year, individual Intake Content is deleted or anonymized, except as required by law, for fraud prevention, or to enforce our Terms of Service in an open matter. Aggregate patterns derived from Intake Content before deletion are retained as described above.
Order and transaction records	Retained for 7 years for tax, accounting, and legal compliance purposes.
Aggregate pattern data (de-identified)	Retained indefinitely. This data does not identify individual buyers or their stories.
Support communications	Retained for 3 years after the last contact, unless a longer period is required to resolve an open matter.
Marketing preferences	Retained until you withdraw consent or unsubscribe, plus a reasonable period to honor your opt-out.
User-generated content (reviews, reaction videos, testimonials)	Retained for as long as we use the content for marketing, advertising, or brand storytelling, consistent with the rights you grant under our Terms of Service. You may withdraw consent for future uses by contacting privacy@mylovesong.com.
Cookies and tracking data	Retention varies by cookie type — session cookies expire when you close your browser; persistent cookies typically expire within 30 days to 2 years depending on purpose.

When retention periods expire, we delete or anonymize your information.

When you submit a review through Judge.me or a reaction video, testimonial, photo, or other content through any other channel — including social media, direct message, or our reaction-video reward program — you grant MLS the rights described in our Terms of Service to use that content for marketing, advertising, social media, and brand-storytelling purposes.

How We Use This Content

User-generated content may appear on our website, in our advertising, on our social media accounts, in email marketing, in product imagery, and in any other media now known or later developed. Reviews submitted through Judge.me are typically displayed on the relevant product page on our website.

Privacy of Recipients in Reaction Videos

Reaction videos often include the recipient of the song (for example, the loved one whose reaction is captured). When you submit a reaction video, you represent that you have obtained the recipient's consent to share that content with us and to permit us to use it as described in our Terms of Service. If you have not obtained consent and we use the content based on your submission, you remain responsible for that representation under Sections XIV and XVI of our Terms of Service.

Notice to Featured Third Parties

When you submit a reaction video or other content featuring another person (most commonly the recipient of your Work), our expectation is that you have obtained their consent before capturing and sharing the content. As a secondary safeguard, if we repost user-generated content prominently in our advertising or marketing and we become aware that a third party featured in that content objects to its use, we will work in good faith to stop using the specific content. This is a practical mechanism; it does not relieve you of your obligation under Sections XIV and XVI of our Terms of Service to obtain any consent required by applicable law before sharing content featuring other people.

Withdrawing Consent

You may withdraw consent for future uses of your user-generated content at any time by contacting privacy@mylovesong.com. Uses already in market at the time of withdrawal — including ads, social posts, or other content already distributed — may continue, since we cannot reliably recall content that has already been published. We will not initiate new uses of your content after consent is withdrawn.

Third Parties Featured in Your Content

If you appear in a reaction video that someone else submitted (for example, you are the recipient of a song and the buyer recorded your reaction), you may contact privacy@mylovesong.com to request that we stop using content featuring you. We will work in good faith to honor reasonable requests.

We implement reasonable administrative, technical, and physical safeguards designed to protect your information from unauthorized access, use, alteration, and disclosure. These safeguards include:

Encryption in transit (TLS/HTTPS) for all data exchanged between your device and the Service.
Encryption at rest for sensitive data stored by our service providers.
Access controls limiting who within our organization and our service providers can access your information.
Regular security reviews of our systems and of the providers we work with.
PCI-DSS compliance (through Shopify and our payment processors) for payment card data.

No system of electronic transmission or storage is ever completely secure. We cannot guarantee absolute security, but we work continuously to reduce risk and to comply with applicable legal standards (including the "reasonable safeguards" standard under the New York SHIELD Act and equivalent state data-security laws).

Data Breach Notification

If we experience a security incident that compromises your personal information, we will notify you and the relevant authorities as required by applicable law. Where law permits a specific notification window, we commit to notifying you within 72 hours of becoming aware of a breach that is reasonably likely to result in unauthorized access to your sensitive personal information, financial information, or to result in a high risk to your rights and freedoms (including identity theft, financial loss, or reputational harm), except where a shorter period is required by law or where notification would compromise an ongoing investigation. Where applicable law (such as GDPR Article 34 or US state breach-notification laws) requires notification on a different standard or timeline, the applicable-law standard prevails.

You have rights regarding your personal information. The specific rights available to you depend on your jurisdiction. This Section describes rights that are generally available; Sections XIV through XXII describe jurisdiction-specific rights.

General Rights

Subject to applicable law, you have the right to:

Access — request a copy of the personal information we hold about you.
Correction — request that we correct inaccurate or incomplete information.
Deletion — request that we delete your personal information, subject to legal retention requirements.
Portability — request a copy of your information in a structured, machine-readable format.
Objection — object to our processing of your information on the basis of legitimate interests.
Restriction — request that we restrict the processing of your information in certain circumstances.
Withdrawal of consent — where we rely on your consent, withdraw it at any time.
Unsubscribe from marketing — opt out of marketing communications at any time.
Complaint to a supervisory authority — lodge a complaint with the privacy regulator in your jurisdiction.

How to Exercise Your Rights

To exercise any of these rights, you have at least two methods available: (1) email privacy@mylovesong.com, or (2) send a written request by postal mail to the mailing address listed in Section XXVII. We will respond within the timeframe required by applicable law (generally 45 calendar days under CCPA, one month under GDPR, with permitted extensions). We may need to verify your identity before fulfilling your request; our verification process is proportionate to the sensitivity of the data and the request, and we will not require more information than necessary. We will not discriminate against you for exercising your rights.

Erasure Requests During an Active Order

If you exercise the right to erasure (or equivalent right under your jurisdiction's privacy law) for Intake Content related to an Order that is in production but not yet delivered, MLS treats the request as an instruction to cancel the Order. Production is halted, the Intake Content is deleted in accordance with applicable law (excluding any portions we are required or permitted to retain — for example, Order metadata for tax or fraud-prevention purposes), and a refund is issued for the Order. If the Work has already been delivered to your Preview Page, erasure does not retroactively affect a Work you have approved or for which the refund eligibility window has closed; in that case, MLS will delete the underlying Intake Content but you retain the delivered Work under the license in Terms of Service Section XIII. Erasure of the underlying Intake Content extinguishes any future revision rights for the delivered Work, since revisions require the Intake Content to remain available.

This Section XIV, together with Sections II and III of this Privacy Policy, serves as the notice at collection required by Cal. Civ. Code § 1798.100(a) for California consumers.

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) gives you specific rights regarding your personal information.

Categories of Personal Information We Collect

In the preceding 12 months, we have collected the following categories of personal information about California consumers:

Identifiers (name, email, IP address, account identifiers).
Commercial information (Orders, purchase history).
Internet/network activity (browsing and interaction data on the Service, including session-level behavior data captured by our heatmap tools).
Geolocation (approximate location derived from IP address).
Professional/commercial information, where provided (for commercial license buyers).
Inferences (inferences drawn from the above categories).
Sensitive personal information may be included within Intake Content you voluntarily submit. The CCPA defines specific categories of "sensitive personal information" at Cal. Civ. Code § 1798.140(ae), and the categories most likely to appear in Intake Content (entirely at your discretion) are: religious or philosophical beliefs; health information; and information concerning sex life or sexual orientation. We do not actively prompt for any sensitive personal information. Where you choose to include it, we use it only for the purpose of producing your Work. The aggregate-pattern analysis described in Section VI operates on structural metadata about Orders (approval rates, categorical revision reasons, ratings) rather than on the substantive content of any individual story; sensitive personal information is not separately analyzed, sold, shared, retained beyond the Section X retention period, or used to train external generative models. To the extent any structural categorization of a revision reason reflects an underlying sensitive-personal-information element of your Intake Content, that categorization is incidental to the same purpose for which the SPI was collected (producing your Work). Because we use sensitive personal information only for the purpose for which it is collected, the right to "limit use of sensitive personal information" under § 1798.121 generally does not apply to our processing; we have provided it as a right in any event.

Purposes for Collection

We collect the above categories for the purposes described in Section III.

Retention

Each category of personal information is retained for the period described in Section X (Data Retention) of this Privacy Policy. The length of retention varies by category, ranging from 1 year (individual Intake Content) to 7 years (transaction records for tax and legal compliance) to indefinite (de-identified aggregate pattern data). Sensitive personal information that appears in your Intake Content is retained on the same 1-year schedule as the rest of your Intake Content.

Sources of Personal Information

We collect personal information about California consumers from the following categories of sources: (1) directly from you, when you place an Order, submit a revision, contact support, or otherwise interact with the Service (Section 2.1); (2) automatically, when you use the Service, through cookies and similar technologies (Section 2.2); and (3) from third parties, including payment processors, marketing and advertising platforms, and analytics providers (Section 2.3).

Categories Disclosed and With Whom

In the preceding 12 months, we have disclosed the categories above to the service provider categories listed in Section 7.1.

Sale and Sharing of Personal Information

We do not sell your personal information for monetary consideration. The CCPA, however, defines "sale" and "sharing" broadly, in ways that include certain uses of advertising cookies and pixels (such as Meta Pixel, TikTok Pixel, and Google Ads tags) where personal information is disclosed to a third party for cross-context behavioral advertising. To the extent any of our advertising-cookie or pixel activity qualifies as a "sale" or "sharing" under the CCPA, you have the right to opt out at any time. You may exercise that right through the "Your Privacy Choices" link in our website footer, by adjusting your cookie preferences through the consent banner, or by enabling a Global Privacy Control signal in your browser, which we honor.

Your CCPA Rights

You have the right to:

Know what personal information we collect, use, disclose, and sell/share.
Access the specific pieces and categories of personal information we have collected about you in the preceding 12 months.
Delete your personal information, subject to exceptions in the CCPA.
Correct inaccurate personal information.
Opt out of sale/sharing of your personal information, including opt-out of cross-context behavioral advertising.
Limit use of sensitive personal information where we use it for purposes beyond what is necessary to provide the Service.
Non-discrimination for exercising your CCPA rights.

How to Exercise CCPA Rights

Use the methods described in Section XIII (email or postal mail), or use the "Your Privacy Choices" link maintained in our website footer. California residents have the right to designate an authorized agent to make a request on their behalf; we will require verification of the agent's authorization and may request direct confirmation from you.

Complaint to the California Privacy Protection Agency

If you believe we have not honored your CCPA rights, you may file a complaint with the California Privacy Protection Agency (CPPA) at https://cppa.ca.gov/ or with the California Attorney General at https://oag.ca.gov/privacy.

Financial Incentive Notice (CCPA)

Our Reaction-Video Reward Program offers in-store credit in exchange for the submission of reaction-video content that may contain personal information about you and the recipient of your Work. This is a "financial incentive" under California Civil Code § 1798.125(b). The material terms of the program, including the current credit amount and qualifying-submission criteria, are displayed at the point of offer and on our website. We have determined that the value of the credit is reasonably related to the value of the personal information you provide, based on the marketing utility of authentic reaction-video content. You may revoke your participation in the financial incentive at any time by emailing privacy@mylovesong.com; revocation does not affect uses already in market.

If you are a resident of a US state with a comprehensive consumer privacy law — including, as of the Effective Date of this Privacy Policy, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Tennessee, Minnesota, Maryland, New Hampshire, New Jersey, Nebraska, Indiana, Kentucky, Rhode Island, and Florida — your state's law gives you rights that are similar in substance to the California rights described in Section XIV, including (depending on the state):

The right to know and access the personal information we have collected about you.
The right to correct inaccurate personal information.
The right to delete personal information.
The right to data portability.
The right to opt out of targeted advertising, the sale of personal information, and profiling in furtherance of decisions that produce legal or similarly significant effects.
The right to opt-in consent before we process sensitive personal information (in states that require it).
The right to non-discrimination for exercising privacy rights.
The right to appeal a denial of a privacy request (in states that require an appeal mechanism).

Nevada (NRS 603A.300–360)

If you are a Nevada resident, you have the right under NRS 603A.300–360 to direct MLS not to sell your "covered information" to a third party for monetary consideration. As stated in Section XIV, MLS does not sell personal information for monetary consideration. To the extent any of our processing nevertheless qualifies as a sale under Nevada law, you may exercise your opt-out right by emailing privacy@mylovesong.com.

How to Exercise State Privacy Rights

Contact privacy@mylovesong.com. Specify your state of residence and the right you wish to exercise. We will respond within the timeframe required by your state's law (generally 45 days, with a one-time 45-day extension permitted in most states for complex requests).

Universal Opt-Out Mechanisms

We honor the Global Privacy Control (GPC) signal where your browser sends it, treating it as a valid opt-out of sale, sharing, and targeted advertising under the laws of your state.

How to Appeal a Denial

If we deny your request to exercise a privacy right under your state's law, you may appeal that decision by emailing privacy@mylovesong.com with the subject line "Privacy Rights Appeal" and a brief explanation of why you believe our denial was incorrect. We will respond to your appeal within the timeframe required by your state's law (generally 60 days). If your appeal is denied, you may contact your state's Attorney General to submit a complaint.

Texas Specifically

The Texas Data Privacy and Security Act (TDPSA) applies to businesses processing the personal information of Texas residents regardless of business size. If you are a Texas resident, your TDPSA rights are described above and are exercisable by contacting privacy@mylovesong.com.

If you are a resident of Washington State, the My Health My Data Act (MHMDA) gives you specific rights regarding "consumer health data" — broadly defined to include any information that identifies a consumer's past, present, or future physical or mental health status, including inferences derived from non-health data.

Because Intake Content you submit may include details that, taken together, could be classified as consumer health data under MHMDA's broad definition (for example, references to a loved one's mental or physical health that you choose to share in your story), MLS treats such information as subject to MHMDA where you are a Washington resident.

Categories of Consumer Health Data Collected and Purpose

The categories of consumer health data MLS may collect are limited to references that you voluntarily include in your Intake Content (the order-form details describing the recipient and the story behind the Work). We collect this data solely for the purpose of producing the Work you ordered. We do not collect biometric data, precise location data tied to healthcare facilities, or any other category of consumer health data outside of what you choose to include in your Intake Content.

Sources of Consumer Health Data

The only source of consumer health data is direct submission by you through the Intake Content you provide when placing an Order. We do not purchase, license, or otherwise obtain consumer health data from data brokers, marketing platforms, healthcare providers, or any other third-party sources.

Categories of Consumer Health Data Shared

We do not share consumer health data with any third party for purposes of advertising, profiling, or sale. The only sharing of consumer health data occurs in the limited operational contexts necessary to produce and deliver your Work — for example, processing through MLS Studio's production pipeline as described in Section V. To the extent any such operational processing involves a service provider acting on our behalf, that service provider is contractually bound to use the data only for the purpose of producing your Work.

Third Parties With Whom Consumer Health Data Is Shared

We do not share consumer health data with third parties or affiliates for any purpose other than the operational production of your Work. Specifically, we do not share consumer health data with marketing or advertising platforms, data brokers, analytics providers (beyond aggregated, de-identified usage data), or any other category of third party.

Your MHMDA Rights

Right to confirm whether MLS is processing your consumer health data and to access that data.
Right to delete your consumer health data.
Right to withdraw consent at any time.
Right to non-discrimination for exercising MHMDA rights.

Consent and Authorization

Where you submit Intake Content that includes consumer health data, we treat your submission of the order form as your affirmative consent to collect that data for the purpose of producing your Work. We do not share consumer health data with third parties for any purpose that requires "authorization" under MHMDA without obtaining a separate authorization from you.

Geofencing

We do not engage in geofencing around in-person healthcare facilities.

How to Exercise MHMDA Rights

Contact privacy@mylovesong.com.

Parallel Regimes

Residents of Nevada (under SB 370), Connecticut (under CTDPA amendments via 2023 SB 3), and other states with consumer-health-data laws may exercise comparable rights through the same channel.

If you are in the European Economic Area or Switzerland, the General Data Protection Regulation (GDPR) gives you specific rights. These rights are summarized in Section XIII and include the right to access, rectify, erase, restrict processing of, and port your personal information, as well as the right to object to processing and the right to withdraw consent.

Data Controller

For purposes of the GDPR, the data controller of your personal information is MLS Studio, LLC, a Florida limited liability company operating the myLoveSong brand.

Data Protection Officer / Representative

MLS does not currently appoint a Data Protection Officer, as we are not required to do so under Article 37 of the GDPR. If this changes, we will update this Privacy Policy. Our designated privacy contact is privacy@mylovesong.com.

EU Representative (Article 27 GDPR)

Because MLS is established outside the European Union but offers services to data subjects in the EU, our EU representative under Article 27 GDPR is `[EU REPRESENTATIVE — TO BE DESIGNATED]`. Once designated, the representative's name, address, and contact information will appear here. EU data subjects with privacy questions in the interim may contact us directly at privacy@mylovesong.com; we will route inquiries appropriately and respond within the GDPR's one-month timeframe.

Complaint to a Supervisory Authority

You have the right to lodge a complaint with your local data protection supervisory authority. A list of EU national data protection authorities is available at https://edpb.europa.eu/about-edpb/board/members_en.

Response Timeframe

We will respond to requests under the GDPR within one month of receipt, as required by Article 12(3). This period may be extended by up to two further months where necessary, taking into account the complexity and number of requests.

If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 give you rights substantially equivalent to those described in Section XVII. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk/.

UK Representative (Article 27 UK GDPR)

Because MLS is established outside the United Kingdom but offers services to data subjects in the UK, our UK representative under Article 27 UK GDPR is `[UK REPRESENTATIVE — TO BE DESIGNATED]`. Once designated, the representative's name, address, and contact information will appear here. UK data subjects with privacy questions in the interim may contact us directly at privacy@mylovesong.com; we will route inquiries appropriately and respond within the UK GDPR's one-month timeframe.

PIPEDA (Federal — All Provinces)

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) gives you rights including:

The right to access the personal information we hold about you.
The right to correction of inaccurate or incomplete information.
The right to withdraw consent for the collection, use, or disclosure of your personal information (subject to legal or contractual restrictions).
The right to complain to the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/.

Our designated privacy contact for PIPEDA inquiries is privacy@mylovesong.com.

Quebec — Law 25 (Act respecting the protection of personal information in the private sector)

If you are a resident of Quebec, Quebec Law 25 gives you additional rights, including:

The right to access, correct, and withdraw consent for the processing of your personal information.
The right to data portability.
The right to deindexation (the right to have a hyperlink to your personal information ceased or stopped from being indexed).
The right to be informed of automated decision-making that is based exclusively on automated processing and produces legal or similarly significant effects.

The automated processing that produces your Work does not produce decisions with legal or similarly significant effects on you (see Section V).

Person in Charge of Personal Information Protection (Law 25 § 3.1): Our designated person in charge of the protection of personal information for purposes of Quebec Law 25 is the Privacy Officer of MLS Studio, LLC, contactable at privacy@mylovesong.com. Quebec residents may also contact the Commission d'accès à l'information du Québec (CAI) at cai.gouv.qc.ca.

Response Timeframe (Quebec)

We will respond to access, correction, and other rights requests under Quebec Law 25 within 30 days of receipt, as required by the Act. Where a request is complex or requires extended processing, we will inform you of the extension and the reason for it within the original 30-day window.

Internal Review

If you disagree with our response to a Law 25 request, you may request internal review by emailing privacy@mylovesong.com with the subject line "Quebec Law 25 — Review Request" and a brief explanation. Our Person in Charge of Personal Information Protection will review the original decision and respond within 30 days. If you remain unsatisfied after internal review, you may file a complaint with the Commission d'accès à l'information du Québec (CAI) at https://www.cai.gouv.qc.ca/.

Complaint to the Quebec regulator: You may file a complaint with the Commission d'accès à l'information du Québec (CAI) at https://www.cai.gouv.qc.ca/.

Cross-Border Transfer Notice: Your personal information will be transferred to and processed in the United States and other jurisdictions where our service providers operate. Before transferring personal information outside Quebec, we will conduct a Privacy Impact Assessment as required by Law 25 to confirm appropriate safeguards are in place. See Section VIII for our international transfer mechanisms.

If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD, Lei nº 13.709/2018) gives you rights similar to those described in Section XVII, including:

The right to confirmation of the existence of processing.
The right of access to your personal data.
The right to correction of incomplete, inaccurate, or out-of-date data.
The right to anonymization, blocking, or deletion of unnecessary or excessive data.
The right to portability of your data.
The right to deletion of personal data processed on the basis of consent.
The right to information about public and private entities with which we have shared your data.
The right to information about the possibility of refusing consent and the consequences of such refusal.
The right to revoke consent.

We will respond to requests under the LGPD within 15 days for confirmation of existence and access (Article 19 § 1), and as soon as practicable for other requests, in accordance with applicable Brazilian law and ANPD guidance. Our Encarregado de Dados (Data Protection Officer) for purposes of LGPD Article 41 is `[ENCARREGADO — TO BE DESIGNATED]`, contactable at privacy@mylovesong.com.

You may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at https://www.gov.br/anpd/.

Mexico (LFPDPPP and ARCO Rights)

If you are in Mexico, the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) gives you ARCO rights: the rights to Access, Rectification, Cancellation, and Opposition to the processing of your personal data. We will respond to ARCO requests within 20 business days of receipt. Our Mexican data protection contact is privacy@mylovesong.com.

Colombia (Ley 1581 de 2012)

If you are in Colombia, Ley 1581 de 2012 gives you rights including access, rectification, updating, and deletion of your personal information. We will respond to requests within 10 business days of receipt.

Argentina (Ley 25.326)

If you are in Argentina, Ley 25.326 (Personal Data Protection Law) gives you rights including access, rectification, updating, and deletion. We will respond to requests within 10 calendar days of receipt for access requests and within 5 business days for rectification/deletion.

Chile (Ley 19.628)

If you are in Chile, Ley 19.628 gives you rights including access, rectification, cancellation, and modification of your personal data.

Other Latin American Jurisdictions

If you are in another Latin American jurisdiction with applicable privacy legislation, we will honor your statutory rights in accordance with applicable local law. Contact privacy@mylovesong.com.

Australia (Privacy Act 1988)

If you are in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) give you rights including:

The right to access your personal information.
The right to correction of inaccurate, out-of-date, incomplete, or misleading information.
The right to make a complaint to the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au/ if you believe we have mishandled your personal information.
The right to be notified of eligible data breaches under the Notifiable Data Breaches scheme.

Where required, we will respond to access and correction requests within a reasonable period (generally 30 days).

New Zealand (Privacy Act 2020)

If you are in New Zealand, the Privacy Act 2020 gives you rights substantially equivalent to those described above for Australia, including the right to access, correction, and complaint to the Office of the Privacy Commissioner at https://www.privacy.org.nz/.

How to Exercise Australia and New Zealand Privacy Rights

Contact privacy@mylovesong.com.

The Service is not directed to children under 18, and we do not knowingly collect personal information from anyone under 18. If you are under 18, do not use the Service.

If you are a parent or guardian and you believe your child under 18 has provided us with personal information, or has placed an Order using your payment method without your knowledge or authorization, please contact privacy@mylovesong.com. We will (a) take steps to delete the child's personal information; (b) where the child placed an Order without authorization, cancel the Order and issue a refund to the original payment method; and (c) where any Work was delivered, terminate any license granted under that Order.

Because the Service is restricted to users 18 and older across all jurisdictions, we do not knowingly collect personal information from individuals below the locally applicable age of consent — including those under 13 in the United States (COPPA), under 16 (or the applicable national age) in EU countries (GDPR Article 8), or under the locally applicable age elsewhere.

Transactional Communications (Always Sent)

When you place an Order, we send transactional emails (and, where you have provided a phone number for transactional communications, transactional text messages) related to your Order — Order confirmations, production updates, delivery notifications, revision updates, refund confirmations, and similar communications. You cannot opt out of transactional communications while you have an active Order, because they are necessary to deliver the Service.

Marketing Emails (Opt-Out Anytime)

We may send marketing emails about new products, offers, content, or MLS news. You can opt out at any time by:

Clicking the unsubscribe link at the bottom of any marketing email.
Contacting privacy@mylovesong.com with an unsubscribe request.
Adjusting your preferences in your email provider settings where available.

Where your jurisdiction requires opt-in consent before we send marketing emails (such as most of the EU and parts of Latin America), we will obtain that consent before sending. We'll never make you jump through hoops to leave the list.

Marketing Text Messages (SMS) — Separate Opt-In Required

Where we offer SMS marketing, separate explicit opt-in consent is required. This means you will be asked to actively opt in to receive marketing text messages — typically by checking a box, replying YES to a verification message, or completing a similar affirmative step. We do not send marketing text messages based on your email opt-in alone.

When you opt in to SMS marketing:

Message and data rates may apply, depending on your mobile carrier and plan.
Message frequency varies based on your engagement.
You may stop receiving marketing text messages at any time by replying STOP to any marketing message.
You may get help by replying HELP to any message or by contacting support@mylovesong.com.
We comply with applicable laws governing SMS marketing — including the US Telephone Consumer Protection Act (TCPA) and its prior express written consent standard for marketing SMS, the Canadian Anti-Spam Legislation (CASL), the UK Privacy and Electronic Communications Regulations (PECR), and the EU ePrivacy framework. Where opt-in consent is required by your jurisdiction, we will obtain that consent before sending any marketing text message.

What we don't do with SMS opt-ins. We do not sell, rent, or share your mobile phone number or the fact that you opted in to SMS marketing with any third party for that third party's independent marketing purposes. Your opt-in stays between you and us.

Some browsers offer a "Do Not Track" (DNT) signal. Because the DNT specification was not finalized as a standard and there is no industry or legal consensus on how to interpret DNT signals, we do not currently respond to DNT signals. We honor the Global Privacy Control (GPC) signal instead, as described below.

We honor the Global Privacy Control (GPC) signal where your browser sends it, treating it as a valid opt-out of sale/sharing under the CCPA and equivalent laws.

We may update this Privacy Policy from time to time. When we do, we will post the updated Privacy Policy on our website with a new "Effective Date" date at the top.

For material changes — including without limitation changes to the categories of personal information we collect, the purposes for which we process it, the categories of third-party providers we share it with, your rights and how to exercise them, our retention periods, our international transfer mechanisms, or any other change a reasonable consumer would consider material to their privacy or use of the Service — we will also notify you by email at the address associated with your most recent Order and will provide at least 30 days' notice before the changes take effect, except where a faster change is required by law.

For non-material changes to this Privacy Policy (such as typographical corrections, contact-information updates, or clarifications that do not affect your rights or how we handle your personal information), your continued use of the Service after the effective date of the updated Policy constitutes acceptance of the updated Policy. For material changes — those identified in the preceding paragraph and any other change a reasonable consumer would consider material to their privacy or use of the Service — MLS will provide notice and a 30-day window as described above. During the notice window, you may exercise any of the rights described in Sections XIII through XXII (including the right to delete your personal information) and contact privacy@mylovesong.com to discuss any concerns. If you do not agree to an updated Policy, you may stop using the Service and contact privacy@mylovesong.com to address any pending matters.

EU and UK consumers — privacy update opt-out right. If you are an EU or UK consumer and a material change to this Privacy Policy is unfavorable to you, in addition to the rights described in Sections XIII through XXII, you have the right to terminate your relationship with MLS without penalty by contacting privacy@mylovesong.com. To exercise this right, send notice within 30 days after the change takes effect; termination takes effect upon MLS's receipt of your notice and triggers handling of your personal information consistent with Section XXV (Termination) of our Terms of Service and the retention provisions of Section X of this Privacy Policy. Where applicable consumer protection or data-protection law gives you a stronger right (such as automatic erasure or a longer notice window), that right prevails.

For any questions, concerns, or requests related to this Privacy Policy or our handling of your personal information, please contact us:

Privacy and Data Protection: privacy@mylovesong.com
General Support: support@mylovesong.com
Legal and Terms: legal@mylovesong.com
Phone: (786) 777-9487
Legal Entity: MLS Studio, LLC (Florida)
Mailing Address: 1791 Blount Rd, Ste 810, Pompano Beach, FL 33069

We will respond to inquiries in accordance with applicable law and our internal service standards.

For our terms of service, see our Terms of Service.

If you still have questions about this Privacy Policy or how we handle your information, please contact us: