Privacy Policy

1. Data controller

SARE DIGITAL, S.L. (NIF B26554501), Calle Cruz Roja, 13, 26230 Casalarreina, La Rioja, Spain. Registered with the Commercial Registry of La Rioja, volume 837, folio 23, sheet LO-17950, entry 2, dated 3 April 2018. Service: Mussical.com. Corporate website: https://saredigital.ai. Contact: info@saredigital.ai; telephone +34 941 87 00 10.

2. Personal data processed

Depending on the service used, we process: name, email address and/or telephone number; billing details; order identifiers, dates, amounts and status; purchase history; musical preferences, instructions, lyrics and other materials provided; songs and associated files; IP address, technical logs and security data; marketing preferences, consent, objection and campaign interactions where measurement is lawful. We do not deliberately request special-category data: please avoid including sensitive information about yourself or others in your instructions.

3. Order management and delivery

We use contact details to confirm orders, process purchases, create and deliver songs, and communicate generation status, incidents, download availability and support. We may use email, SMS or another channel provided where appropriate and necessary. These are operational, not advertising, messages. Legal basis: performance of a contract (art. 6.1.b RGPD).

4. Invoicing and legal obligations

We process the data essential for payments, invoicing and compliance with tax, accounting and administrative obligations. Legal basis: compliance with a legal obligation (art. 6.1.c RGPD).

5. Purchase follow-up and customer support

We may contact you to check delivery, resolve incidents, handle complaints and provide support. Where necessary, the basis will be performance of the contract. Satisfaction surveys that are not necessary to perform the contract may be based on legitimate interests following an assessment that respects the user's rights. If a message is promotional, the following section applies.

6. Promotions, discounts and campaigns

We may communicate Mussical news, discounts, campaigns and offers by email, SMS or equivalent electronic means only where there is a legal basis and the LSSI is complied with. For existing customers, Art. 21.2 LSSI permits communications about similar own products or services to those contracted for if the data were obtained lawfully and a simple, free way to object was offered when the data were collected and in each message; processing may be based on legitimate interests following a balancing assessment. For people with no prior contractual relationship, campaigns outside that exception or other cases requiring it, we will request prior, free, specific and unambiguous consent. A purchase does not require acceptance of advertising. Unsubscribing and withdrawing consent will be free and will not affect operational messages.

7. Personalisation of offers

We may use purchase history and musical preferences to offer related products, subject to a valid legal basis, sufficient information and the right to object. Before introducing advanced profiling, its risks will be assessed and this policy will be updated. No decisions producing legal effects or similarly significant effects will be based solely on automated processing outside the cases permitted by law.

8. Security, fraud and improvement

We may process technical logs to protect accounts, prevent fraud, investigate incidents and secure the platform (legitimate interest or legal obligation, as applicable). Where possible, service improvement will use aggregated or anonymised data. Non-essential analytics or advertising cookies will require consent where applicable.

9. Artificial intelligence

Instructions, lyrics and preferences may be processed by technology providers in order to generate songs. Mussical will verify their terms, safeguards and data-processing agreements where applicable. Users' personal data will not be used to train third-party models for those providers' own purposes without a valid legal basis and the required information. If training for purposes other than providing the service is contemplated, its lawfulness will be assessed in advance, information will be provided and consent will be obtained where necessary.

10. Recipients

Data may be accessed by hosting, AI, payment, email and SMS, customer-management, security and advisory providers, to the extent necessary and under the applicable legal arrangement. Data may also be disclosed to authorities where required by law. We will not sell personal-data databases or transfer data to third parties for their own campaigns without a valid legal basis and the required information or consent. The actual provider list must be identified and kept up to date.

11. International transfers

If providers outside the European Economic Area receive or access data, the safeguards in Chapter V of the GDPR will apply: an adequacy decision, standard contractual clauses or other legally permitted mechanisms, as appropriate. Information about the applicable safeguards may be requested.

12. Retention

Order data will be retained during the contractual relationship and for liability periods; tax and accounting data, for the statutory periods; marketing data, while a legal basis exists and no objection or withdrawal is exercised, subject to applicable limits; instructions and songs, for the period needed to provide the service and the storage period communicated; and security logs, for proportionate periods. They will then be deleted, anonymised or blocked where appropriate. The minimum information needed to respect advertising opt-outs will be retained. Specific periods must be set before publication according to the actual systems and obligations.

13. Data subject rights

You may request access, rectification, erasure, restriction, objection and portability where applicable; withdraw consent at any time without affecting earlier processing; and exercise your rights regarding automated decisions. Write to info@saredigital.ai or to Calle Cruz Roja, 13, 26230 Casalarreina, La Rioja. Proportionate identity verification may be required. We will respond within the statutory time limits. You may lodge a complaint with the Spanish Data Protection Agency: https://www.aepd.es.

14. Marketing objections

You may use the unsubscribe link in each email, the free mechanism stated in SMS or other messages, or write to info@saredigital.ai. Objection is free and will not prevent strictly necessary notices about orders, invoices, incidents or legal obligations.

15. Security measures

Appropriate technical and organisational measures will be applied in view of the risk, with access limited to staff and providers who need to process the data.

16. Cookies

Necessary cookies may be used for sessions, security and operation. Non-essential analytics and advertising cookies will require consent where applicable. The Cookie Policy will detail purposes, providers, duration, and configuration and withdrawal mechanisms.

Only if you accept in the cookie notice do we use Google Analytics and Google Ads (Google Ireland Limited) and the Meta pixel (Meta Platforms Ireland Limited) to measure visits and the performance of our ads. If you have accepted and complete a purchase, our server also sends Meta the order number, amount, your email address pseudonymised using a hash function (SHA-256), its cookie identifiers, your browser and your IP address, to attribute the purchase to the ad. If you reject cookies, nothing is sent. You can withdraw consent at any time under “Configure cookies” at the bottom of the website.

17. Minors

The service is not specifically directed at minors. Where processing requires authorisation from legal representatives, it will be requested in accordance with applicable law.

18. Changes and contact

Changes will be published with an update date. If they substantially affect processing, users will be informed and new consent will be requested where applicable. Contact: SARE DIGITAL, S.L., info@saredigital.ai, +34 941 87 00 10, Calle Cruz Roja, 13, 26230 Casalarreina, La Rioja, Spain.