Privacy Policy

Welcome to SingMyWish (“we,” “us,” or “our”), operated at https://singmywish.com and app.singmywish.com. Your privacy is important to us.

This Privacy Policy explains what personal data SingMyWish collects, why we collect it, the legal basis for using it, who we share it with, how long we keep it, and the rights you have. It applies when you visit our website, use our web application, or otherwise interact with our services (together, the “Service”). It forms part of our Terms of Use. How we use cookies and similar technologies is explained in our separate Cookie Policy.

SingMyWish is an AI-powered service that generates personalised greetings, songs, images and similar content from the prompts and information you provide. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act. Where we serve users outside the EU, additional local rules (such as the California CCPA/CPRA) may also apply (see Section 16).

1. Who is responsible for your data

The controller responsible for your personal data is:

SigmaMobile OÜ, Harju maakond, Kesklinna linnaosa, Vesivärava tn 50-201, 10152, Tallinn, Estonia, a company registered in Estonia. General and privacy contact: hello@singmywish.com

2. What personal data we collect

The data we hold about you depends on how you use the Service. We collect the following categories:

Account and identity data. Your name or display name, email address, and login credentials, including where you sign in through a third-party provider (for example a social or Google/Apple login). We store passwords only in hashed form.

User input and prompt data. The text prompts, wishes, names, occasions, instructions and any other information you submit so we can generate content for you. Prompts may contain personal data about you or about other people (see Section 5).

Uploaded content. Any files you choose to upload (for example photos or reference images) where the Service offers that feature.

Generated content. The outputs we create from your input (for example custom songs, greeting messages, lyrics and images) which are associated with your account.

Payment data. Where the Service is paid: your plan, billing name, transaction amounts, dates, and status. Card details are entered directly with our payment provider; we do not store full card numbers or security codes.

Technical and usage data. IP address, browser type, device information, operating system, language settings, approximate location derived from IP, pages visited, features used, referral source, and diagnostic or crash logs.

Cookies and similar technologies. Data collected through cookies, local storage and similar tools (see our Cookie Policy).

Communications. The content of your support requests, feedback and other messages you send us.

3. Why we use your data, and on what legal basis

We only process personal data where the law allows it.

You may object at any time (see Section 10).

4. AI-generated content and automated processing

The core of the Service is automated: your prompt is processed by artificial-intelligence models that generate text, music and/or images for you.

AI model providers. To produce your content we use third-party AI providers as processors (for example providers of large-language, text-to-music, text-to-speech and image-generation models). These providers process your prompt and any uploaded content only to return the requested output, under a data-processing agreement. Our current providers are listed with our sub-processors — see Section 6.

Use of your content to train models. We do not use your prompts, uploads or generated content to train or fine-tune our own or third parties' AI models. Our AI providers process your content solely to generate your output and are contractually prohibited from using it to train their models. If we ever wish to use your content for model improvement, we will ask for your separate, opt-in consent first.

No decisions with legal or similar effect. Although generation is automated, it does not produce legal effects concerning you or similarly significantly affect you within the meaning of GDPR Art. 22. It only determines the creative content you are shown, which you can regenerate or discard. You can contact us about any output you consider inappropriate.

Content moderation and safety. We may automatically screen prompts and outputs to detect and block unlawful, harmful or abusive content and to enforce our terms, on the basis of our legitimate interests and legal obligations.

5. Content that mentions other people

Prompts for greetings and songs often mention someone other than you, for example a friend or family member the message is for. When you include another person's personal data in a prompt, you are responsible for having a lawful reason to do so, and you must not submit special-category data (such as health or religious information) or content about others that is unlawful, defamatory or infringing. We process such data only to generate the content you request and for the retention period in Section 8. If someone believes their data has been used in the Service, they can contact us at hello@singmywish.com.

6. Who we share your data with

We do not sell your personal data. We share it only with the categories of recipient below, each acting under a written data-processing agreement:

An up-to-date list of our sub-processors is available on request.

7. International transfers

Your data is primarily stored and processed within the EU/EEA. Some of our providers, in particular AI model and infrastructure providers, may process data in the United States or other countries outside the EEA. Where that happens, we rely on a European Commission adequacy, or on the Commission's Standard Contractual Clauses together with any supplementary measures required. You can request a copy of the safeguards we use by emailing hello@singmywish.com.

8. How long we keep your data

We keep personal data only for as long as necessary for the purposes above, then delete or anonymise it. Our standard periods are:

9. How we protect your data

We use TLS encryption in transit, encryption at rest for stored data, hashed passwords, role-based access controls limiting staff access to a need-to-know basis, logging and monitoring, and regular backups. Payment card data never touches our servers. No system is completely secure; if a personal-data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify the Estonian Data Protection Inspectorate within 72 hours and inform affected users where the law requires it.

10. Your rights

If you are in the EU/EEA, you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate or incomplete data;
• erase your data (“right to be forgotten”), subject to our legal retention duties;
• restrict processing in certain circumstances;
• data portability — receive your data in a structured, machine-readable format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, including for voice or marketing, without affecting processing already carried out;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects;
• lodge a complaint with a supervisory authority (see Section 15).

To exercise any right, email hello@singmywish.com. We respond within one month, extendable by two further months for complex requests (we will tell you if we need the extension). We may ask you to verify your identity.

11. Children

The Service is intended for adults. Under the Estonian Personal Data Protection Act, where we rely on consent to offer information-society services directly to a child, only children aged 13 or older can give that consent themselves; for a child under 13, consent must be given by the holder of parental responsibility. We do not knowingly collect personal data from children under 13 without such consent. If you believe a child has provided us data, contact hello@singmywish.com and we will delete it.

12. Marketing

We send marketing email only where you have consented, or where you are an existing customer and we are permitted to tell you about similar services. Every marketing email has an unsubscribe link that takes effect immediately. Unsubscribing does not stop essential service messages such as receipts and security notices, which are part of your contract with us.

13. Third-party links

The Service may link to third-party sites or platforms. This Policy does not apply to them; please review their own privacy notices before using them.

14. Changes to this Policy

We may update this Policy from time to time. The current version is always available on our website. Where a change is material, we will revise the “Last updated” date and notify you before it takes effect.

15. Contact and supervisory authority

Questions or requests: hello@singmywish.com

SigmaMobile OÜ, Harju maakond, Kesklinna linnaosa, Vesivärava tn 50-201, 10152, Tallinn, Estonia.

If you believe we have not handled your data lawfully, you can lodge a complaint with the Estonian supervisory authority:

Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)

• Tatari 39, 10134 Tallinn, Estonia
• Phone: +372 6828 712
• Email: info@aki.ee
• Web: www.aki.ee

If you are in another EU/EEA country, you may also complain to your local data protection authority.

16. Notice for California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request deletion of your personal information, to opt out of the “sale” or “sharing” of personal information (we do not sell personal information), and not to be discriminated against for exercising these rights. To make a request, contact hello@singmywish.com.