Privacy Policy

What We Collect

Dearlume processes the information needed to create, save, purchase, and share a Song Gift:

1. Account data — such as your name, email address, authentication records, and support messages.
2. Gift content — names, relationships, stories, instructions, lyrics edits, optional photos, and generated media.
3. Service and device data — such as browser type, basic request logs, errors, and limited product events used to operate and improve the service.
4. Payment records — order identifiers, amount, currency, status, and provider responses. PayPal processes payment credentials; Dearlume does not store full card or bank credentials.

How We Use Data

We use this data to provide the gift workflow, call generation providers, store and deliver media, process payments and refunds, recover interrupted orders, prevent abuse, answer support requests, and maintain the service.

We do not sell personal information. We do not use names or story text for advertising. If product analytics are enabled, they must exclude story content, recipient names, generated lyrics, payment credentials, and gift share tokens.

Service Providers

To deliver the product, relevant data may be processed by infrastructure, authentication, storage, AI-generation, content-safety, music-catalog search, and payment providers. When you use the optional song-reference search, Dearlume sends only that search phrase to Apple or, when Apple is unavailable, Deezer; your gift story is not included. Before an AI text request is sent for generation, Dearlume sends the provider-bound text to Waffo Prompt Sift for a safety decision. AI generation providers then receive the text and media inputs needed for the requested function. Those providers process data under their own terms and privacy policies.

Dearlume may retain submitted gift content and provider-bound prompts in gift and AI-task records as needed to operate and troubleshoot the workflow. The separate moderation audit table stores decision metadata—such as stage, action, reason code, matched category identifiers, request identifier, status, and timing—but not the scanned prompt or generated text.

Gift Links

Published gift pages are unlisted and include instructions asking search engines not to index them. This is not access control. Gift links are not password-protected, and anyone with a link may view the published gift. Do not place information in a gift that you or the recipient would not want shared with a link holder.

Retention and Your Choices

We retain account, order, support, and gift records while needed to provide the service, resolve disputes, prevent fraud, and meet legal obligations. Signed-in users can review their saved gifts and update profile information available in account settings.

To request access, correction, deletion, or an available copy of your personal data, submit a ticket through Settings → Support Tickets. We will verify the request and respond subject to applicable law and records we must retain. Deleting data may make a gift or its share link unavailable.

Security

Dearlume's production endpoints and Prompt Sift are intended to use encrypted network transport, and the service applies access controls. Administrators can configure custom third-party AI base URLs; Dearlume does not currently enforce HTTPS for every custom base URL, so only trusted HTTPS endpoints should be configured. The service supports encrypted storage for configured provider credentials when the production CONFIG_ENCRYPTION_KEY is present and kept stable; without that key, database configuration values may be stored in plaintext. No Internet service can guarantee absolute security. Protect your account credentials and share gift links carefully.

Changes to This Policy

We may update this Policy as the product or applicable requirements change. The date above shows the latest revision.

Contact Us

You can contact us at support@dearlumegifts.com, or use Settings → Support Tickets when signed in. Do not include passwords or full payment credentials in a support request.