Privacy and cookies
This shop is run by Vico Development B.V., Walserij 4, 2211 SJ Noordwijkerhout, the Netherlands. We are the controller, under the General Data Protection Regulation (EU) 2016/679 (GDPR), of the personal data you give us here. Questions or requests about your data can be sent to info@santamelody.com.
What data we use, why, and our lawful basis
Your order
For an order we use your name, your e-mail address, your telephone number if you give it, and what you ordered and paid. We need this to deliver your order, keep you informed and keep our accounts (Article 6(1)(b) and (c) GDPR). Without it we cannot complete your order. Your payment details are processed by Mollie; we do not see them.
E-mails
If you enter your e-mail address at checkout and do not complete your order, we send you no more than three reminders about your basket. After a purchase we ask you once for a review. We do this on the basis of our legitimate interest in completing orders and hearing your feedback (Article 6(1)(f) GDPR). If you sign up for the discount, we send you a few e-mails with the code and information about the products, on the basis of your consent (Article 6(1)(a) GDPR), which you can withdraw at any time. Every e-mail that is not an order confirmation contains an unsubscribe link.
Your preview
If you ask for a preview, we use your answers and your e-mail address to make it and send it to you (Article 6(1)(b) GDPR). We use Claude (Anthropic) for the text of the preview, which receives only your answers, not your e-mail address. We keep the preview for 30 days, or for as long as it belongs to your order. If you do not order afterwards, we send you no more than three reminders about your preview, based on our legitimate interest in completing an order you started (Article 6(1)(f) GDPR). Every reminder has an unsubscribe link.
Your song
After you order, we create the full song automatically (Article 6(1)(b) GDPR). Claude (Anthropic) writes the lyrics, Lyria (Google) composes and sings it, and Gemini (Google) analyses the recording. These services receive your answers, such as names and what you told us about the person, but not your e-mail or postal address. They do not use this data for their own products. Google keeps it for at most 55 days to detect abuse.
Visiting the website
When you visit the shop, our technical providers process your IP address and technical information about your device and browser, so that the pages can be delivered and kept secure (Article 6(1)(f) GDPR).
Who we share data with
Only with providers we need to run the shop: Mollie (payments), Brevo (sending e-mail), Supabase and Lovable (the technology the shop runs on), Anthropic and Google (writing and singing the song), Meta and Google (measuring advertising and visits). We have agreements with each of them to protect your data.
We are based in the Netherlands, so your data is processed in the European Economic Area. Some of our providers, in particular Supabase, Meta and Google, and Anthropic, also process data in the United States. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU standard contractual clauses.
Cookies and measurement
We use cookies to remember your basket and your cookie choice; these are strictly necessary. We also use the Meta pixel and Google Analytics to measure how visitors find and use the shop and which adverts work. A hashed (unrecognisable) version of your e-mail address may be sent so that a purchase can be linked to an advert. The Meta pixel and Google Analytics only load if you accept them in the cookie banner (Article 5(3) of the ePrivacy Directive 2002/58/EC, Article 6(1)(a) GDPR); you can withdraw your consent at any time by deleting this shop's cookies in your browser. Reporting a purchase through the Conversions API is based on our legitimate interest in measuring our advertising (Article 6(1)(f) GDPR). For collecting data through the Meta pixel and sending it to Meta, we are joint controllers with Meta Platforms Ireland Ltd.
We record ourselves which steps a visit goes through (pages viewed, progress through the questions, checkout) and which advert you came from, without your e-mail address, name or IP address and without cookies, so we can improve the shop. We keep this data for 13 months (Article 6(1)(f) GDPR).
How long we keep data
We keep order data for seven years, because Dutch tax law requires this for our accounts. We keep data for e-mails until you unsubscribe, and after that only for as long as we need to respect your unsubscribe request.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict its use, to data portability, and to withdraw your consent at any time. You also have the right to object to our use of your data based on legitimate interests, and you can object to direct marketing at any time, using the unsubscribe link in every e-mail or by e-mailing info@santamelody.com.
We do not make decisions based solely on automated processing within the meaning of Article 22 GDPR. If you are unhappy with how we handle your data, you can complain to the Data Protection Commission in Ireland (dataprotection.ie), or to our lead authority, the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Last updated: 29 October 2026