Polityka prywatności

CSM Studio ("we", "us", "our"), operating the brand CSM Studio, is the data controller for personal data processed through customsoulmade.com. This policy explains what we collect, why, with whom we share it, and the rights you have under the EU GDPR, the UK GDPR, and the California Consumer Privacy Act (CCPA / CPRA).

1. Who we are

CSM Studio, a Studio, registered at under filing .
Registered office: Majaka tn 26
Lasnamäe linnaosa
11412 Tallinn
Harju maakond
Estonia
Contact: contact@customsoulmade.com

2. What personal data we collect

• Account & contact data — name, email address, preferred language.
• Order & creation data — the story, occasion, character details, names and personal references you provide to have your song or film created; any reference photos you upload; delivery preferences.
• Payment data — processed by our payment providers (Stripe, PayPal). We receive a confirmation of payment and the last four digits of the card only; we never store full card details on our servers.
• Communications — messages you send us via the contact form, email, or webmail.
• Technical data — IP address, device type, browser, pages viewed, and cookie identifiers, collected for security, fraud prevention, and site improvement.

3. Why we process it (legal basis under GDPR)

• To perform your contract (Art. 6(1)(b) GDPR): creating and delivering your order, providing customer support, handling refunds.
• To comply with legal obligations (Art. 6(1)(c)): tax and accounting record-keeping; responding to lawful requests from authorities.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, service security, product improvement, aggregate analytics — always balanced against your rights.
• Consent (Art. 6(1)(a)): optional marketing emails and non-essential cookies. You can withdraw consent at any time.

4. Sub-processors we share data with

We use the following third parties strictly to deliver the service. Each is bound by a Data Processing Agreement and appropriate safeguards (SCCs or adequacy) for any transfer outside the EEA.

• Cloudflare, Inc. — hosting, DDoS protection, R2 object storage for order assets (USA / global).
• Contabo GmbH — dedicated server infrastructure (Germany, EU).
• Sendinblue SAS (Brevo) — transactional email delivery (France, EU).
• Google LLC (Gemini API) — text and image generation for the creative pipeline (USA).
• Erweima Technology (sunoapi.org) — song generation for order fulfillment (Singapore / USA).
• OpenAI, L.L.C. — voice-to-text transcription used in lyric alignment (USA).
• fal.ai, Inc. — video generation for the animated-film products (USA).
• Stripe, Inc. / Stripe Payments Europe Ltd. — payment processing (USA / Ireland).
• PayPal (Europe) S.à r.l. et Cie, S.C.A. — payment processing (Luxembourg).

5. International transfers

Our infrastructure is primarily hosted in the EU (Germany). Some sub-processors are located in the United States or other jurisdictions. Transfers rely on the European Commission’s Standard Contractual Clauses and, where applicable, adequacy decisions (e.g., EU–US Data Privacy Framework).

6. How long we keep your data

• Order records & invoices — 7 years (US and EU tax law).
• Uploaded reference photos and creative work-in-progress — 90 days after delivery, then deleted from our production systems. Final delivered files remain in your customer archive for 12 months, then only in your email history.
• Marketing consent & contact form messages — 24 months or until you unsubscribe / delete request.
• Technical & analytics logs — 12 months.

7. Your rights

Under the GDPR / UK GDPR you have the right to: access, rectification, erasure, restriction of processing, data portability, objection, and to withdraw consent at any time.

Under the CCPA / CPRA, California residents have the right to know what personal information we collect, to request deletion, to correct inaccurate information, to opt out of the sale or sharing of personal information, and to non-discrimination for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising.

To exercise any right, email contact@customsoulmade.com. We reply within 30 days.

8. Children

Our service is not directed at children under 13 (or 16 in the EU, per Member-State law). We do not knowingly collect personal data from minors. If you believe a child has provided us data, email contact@customsoulmade.com and we will delete it.

9. Cookies

See our separate Cookie Policy for details on the cookies we use and how to manage them.

10. Complaints

If you believe our processing violates the law, you may lodge a complaint with your local data protection authority. For EU users, a list of authorities is available at edpb.europa.eu. For California residents, the California Privacy Protection Agency (cppa.ca.gov).

11. Changes to this policy

We publish updates on this page and post the effective date at the top. Material changes will be announced by email to registered customers.