PRIVACY POLICY

Last Updated: October 7, 2026

This Privacy Policy explains how Melory collects, uses, stores, discloses and otherwise processes personal information when you visit getmelory.com, place an order, interact with our advertising, contact us, or otherwise use our services.

We take the protection of personal information seriously and process personal data in accordance with applicable privacy and data protection laws, including, where applicable, the EU General Data Protection Regulation (“GDPR”), German data protection law and applicable United States state privacy laws.

1. WHO WE ARE

The controller responsible for the processing of personal data through this website is:

Melory
Heinrich-Seliger-Straße 5
60528 Frankfurt am Main
Germany

Website: https://getmelory.com
Email: support@getmelory.com

For purposes of the GDPR, we are the “controller” of personal information where we determine the purposes and means of processing.

2. INFORMATION WE COLLECT

Depending on how you interact with Melory, we may collect the following categories of information.

2.1 Contact Information

This may include:

• name;

• email address;

• telephone number;

• billing address;

• shipping address, where applicable;

• country or region.

2.2 Order and Transaction Information

When you place an order, we may process information such as:

• order number;

• products or services purchased;

• selected delivery option;

• order date;

• transaction amount;

• currency;

• payment status;

• discount or promotional code;

• refund information;

• customer support history.

Payment card details are generally processed directly by our payment service providers. We do not normally receive or store complete payment card numbers ourselves.

2.3 Personalization Information

Because Melory creates personalized songs, we may collect information that you voluntarily provide in connection with your order.

This may include:

• recipient's name;

• relationship to the recipient;

• occasion;

• preferred language;

• music genre or style preferences;

• preferred vocal characteristics;

• memories and experiences;

• descriptions of relationships;

• personal messages;

• information about important moments;

• details about what makes the recipient special;

• words, phrases or details to include or avoid;

• requested tone or mood;

• musical references;

• pronunciation information;

• other information voluntarily entered into our personalization form.

Some of this information may relate to another person rather than to the customer placing the order.

Please only provide information that you are lawfully permitted to provide.

Because personalization fields are free-form, we ask that you avoid submitting highly sensitive information unless it is genuinely necessary for the product you are requesting.

3. INFORMATION ABOUT OTHER PEOPLE

Our personalized products often involve information about another person, such as a spouse, partner, parent, friend or family member.

If you provide us with personal information about another person, you represent that you are permitted to provide that information to us for the purpose of creating the personalized product.

Please do not submit highly sensitive information about another person unless you have an appropriate legal basis or permission to do so.

We process information about recipients primarily for the purpose of creating and delivering the personalized product requested by the customer.

4. AUTOMATICALLY COLLECTED INFORMATION

When you visit our website, certain technical information may be collected automatically.

This may include:

• IP address;

• date and time of access;

• browser type;

• browser version;

• operating system;

• device information;

• referring website;

• pages visited;

• time spent on pages;

• interactions with the website;

• approximate geographic information;

• cookie identifiers;

• advertising identifiers;

• conversion information.

We use this information to operate the website, maintain security, understand how visitors use our website, improve our services and measure advertising performance.

Where required by applicable law, non-essential tracking technologies are used only after you have provided the required consent.

5. SERVER LOG FILES AND WEBSITE SECURITY

Our website and infrastructure may automatically collect server log information necessary to deliver our website and maintain its security and stability.

For users subject to the GDPR, such processing may be based on our legitimate interests under Article 6(1)(f) GDPR in:

• maintaining website functionality;

• detecting abuse;

• preventing fraud;

• maintaining network and information security;

• diagnosing technical problems.

Our website uses SSL/TLS encryption to help protect confidential information transmitted between your browser and our website.

6. SHOPIFY

Our online store is operated using the ecommerce platform provided by Shopify.

Relevant Shopify entities may include:

Shopify International Limited
Victoria Buildings
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

and

Shopify Inc.
151 O'Connor Street
Ground Floor
Ottawa, Ontario K2P 2L8
Canada

Shopify processes personal information necessary to provide the ecommerce infrastructure used by Melory.

This may include information concerning:

• website visits;

• customer accounts;

• orders;

• contact information;

• transactions;

• devices;

• IP addresses;

• browsing activity;

• checkout activity.

Depending on the Shopify service involved, Shopify may act as our processor or may process certain information for its own purposes in accordance with its own privacy documentation.

More information can be found in Shopify's privacy documentation.

7. CONTENT DELIVERY AND INFRASTRUCTURE

Our website may use content delivery and infrastructure services provided through Shopify and its technical partners, which may include providers such as Cloudflare, Inc.

These services help deliver website content, images, scripts and other files efficiently and securely.

In connection with these services, technical information such as IP addresses and device information may be processed.

8. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies.

Cookies are small data files stored on your device or browser.

They may be used for purposes including:

Essential Cookies

These cookies are required for functions such as:

• website navigation;

• shopping cart functionality;

• checkout;

• security;

• fraud prevention;

• remembering privacy preferences.

Analytics Cookies

These technologies help us understand how visitors use our website.

Advertising Cookies

These technologies may help us:

• measure advertising campaigns;

• attribute purchases to advertising;

• create audiences;

• show relevant advertising;

• understand customer journeys.

Preference Cookies

These may remember certain choices or preferences.

Where consent is legally required, analytics and advertising technologies will not be activated until the required consent has been obtained.

You may manage your preferences through the cookie or privacy controls available on our website.

9. CUSTOMER PRIVACY SETTINGS

We may use Shopify's customer privacy functionality or another consent-management platform to manage:

• cookie consent;

• tracking preferences;

• advertising preferences;

• privacy opt-outs.

Essential technologies necessary to operate the website may remain active even where optional tracking has been rejected.

10. PERSONALIZED SONG PRODUCTION

The information you submit through our personalization process is used to create your customized Melory product.

We may process this information to:

• write or generate lyrics;

• determine song structure;

• incorporate personal memories;

• generate or produce audio;

• create vocals;

• produce or master the song;

• perform quality control;

• create revisions;

• deliver the completed product;

• answer customer questions.

For users subject to the GDPR, processing necessary to fulfill an order is generally based on Article 6(1)(b) GDPR.

11. ARTIFICIAL INTELLIGENCE AND PRODUCTION TOOLS

Melory may use artificial intelligence, generative technology, audio-production software, songwriting tools, music-generation systems and other third-party production services in connection with creating personalized products.

Information submitted by customers may therefore be processed using third-party technology providers where reasonably necessary to produce the ordered product.

Where possible and appropriate, we seek to minimize the personal information provided to such systems.

We do not authorize third-party production providers to independently use customer information for unrelated marketing purposes solely because we use their services.

However, third-party providers may process information in accordance with their own applicable terms, data processing arrangements and legal obligations.

Customers should avoid including unnecessary sensitive information in personalization fields.

12. ORDER PROCESSING

We process customer information where necessary to:

• accept orders;

• process payment;

• create personalized products;

• communicate about orders;

• deliver digital products;

• process revisions;

• provide customer support;

• issue refunds;

• detect fraud;

• comply with accounting and tax obligations.

For customers subject to the GDPR, this processing may be based on:

• performance of a contract under Article 6(1)(b) GDPR;

• compliance with a legal obligation under Article 6(1)(c) GDPR;

• legitimate interests under Article 6(1)(f) GDPR.

13. DIGITAL DELIVERY

Melory products are primarily delivered electronically.

We therefore use the email address or other contact details supplied during the ordering process to deliver:

• order confirmations;

• personalized songs;

• download links;

• revision updates;

• service communications;

• other information directly connected to the order.

These communications are transactional and are not considered promotional newsletters merely because they are sent by email.

14. PAYMENT PROCESSING

Depending on the payment method selected at checkout, personal information may be processed by payment providers.

These may include:

Shopify Payments

Shopify International Limited and affiliated payment processors.

PayPal

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

Stripe

Stripe Payments Europe Ltd.
1 Grand Canal Street Lower
Grand Canal Dock
Dublin
Ireland

Klarna

Klarna Bank AB (publ)
Sveavägen 46
111 34 Stockholm
Sweden

Apple Pay

Apple Distribution International Ltd.
Hollyhill Industrial Estate
Hollyhill
Cork
Ireland

Google Pay

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

The specific payment services available to you depend on your location and the payment methods activated on our store.

Payment providers may receive information including:

• name;

• billing information;

• payment information;

• transaction value;

• currency;

• order information;

• device information;

• fraud-prevention information.

Payment providers may process certain information independently according to their own privacy policies.

15. EMAIL MARKETING – KLAVIYO

We may use Klaviyo, Inc., 125 Summer Street, Boston, Massachusetts, USA, to manage email marketing, customer communications and related marketing functionality.

Where you subscribe to our marketing communications, Klaviyo may process information including:

• email address;

• name;

• purchase history;

• interactions with emails;

• website activity;

• cart activity;

• device information.

Marketing emails may contain tracking technologies that allow us to understand whether an email was opened or whether links were clicked, where permitted by applicable law.

Where required under the GDPR or other applicable law, marketing communications and associated tracking are based on your consent.

You may unsubscribe from promotional emails at any time by clicking the unsubscribe link in the relevant email.

Unsubscribing from marketing communications does not prevent us from sending necessary transactional communications relating to your orders.

16. ABANDONED CART COMMUNICATIONS

Where permitted by applicable law and depending on your privacy and marketing preferences, we may send reminders relating to an incomplete purchase or abandoned checkout.

You may opt out of promotional communications at any time.

17. SMS MARKETING

If Melory offers SMS marketing and you voluntarily subscribe, we may process your:

• telephone number;

• consent records;

• message engagement information;

• order information;

• associated customer information.

Where SMS marketing is offered, messages will only be sent in accordance with applicable consent and marketing requirements.

You may withdraw consent using the opt-out method communicated in the SMS or by contacting us.

Message and data rates may apply depending on your mobile provider.

18. CUSTOMER REVIEWS – JUDGE.ME

We may use Judge.me Ltd. to display customer reviews and, where permitted, request reviews following a purchase.

For this purpose, information such as:

• customer name;

• email address;

• order information;

• product purchased;

may be processed.

Where legally required, review-request communications will only be sent with the necessary consent or other lawful basis.

If you voluntarily publish a review, information included in that review may become publicly visible.

Do not include information in a public review that you do not want others to see.

19. GOOGLE ANALYTICS 4

We may use Google Analytics 4, provided by Google Ireland Limited and affiliated Google entities.

Google Analytics helps us understand how visitors interact with our website.

Information processed may include:

• IP-related information;

• device information;

• browser information;

• approximate location;

• website interactions;

• pages viewed;

• referral information;

• purchases and conversion events.

Where legally required, Google Analytics will only operate after you have provided consent through our cookie management system.

You may withdraw consent through the privacy or cookie settings available on our website.

20. MICROSOFT CLARITY

We may use Microsoft Clarity, provided by Microsoft Corporation.

Clarity helps us understand how visitors interact with our website through functionality such as:

• session analytics;

• click analysis;

• scrolling behavior;

• heatmaps;

• navigation behavior.

Information such as device details, browser information, IP-related information and website interactions may be processed.

Where required by law, Clarity is activated only after appropriate consent has been obtained.

We configure analytics services with the intention of avoiding the intentional capture of payment information or other information that should not be included in behavioral analytics.

21. SHOPIFY ANALYTICS

We use analytics functionality provided by Shopify to understand:

• traffic;

• store performance;

• conversion rates;

• orders;

• customer journeys;

• marketing performance.

Shopify may use cookies or similar technologies for this purpose.

Where applicable law requires consent for such technologies, they will be subject to the website's privacy choices.

22. TRIPLE WHALE

We may use analytics and marketing attribution services provided by Triple Whale.

Triple Whale may help us understand:

• advertising performance;

• customer journeys;

• marketing attribution;

• website usage;

• conversion performance.

Information processed may include device information, browser information, website activity, transaction information and advertising attribution data.

Where legally required, tracking technologies associated with Triple Whale are used only with the necessary consent.

23. META PIXEL AND META ADVERTISING

We may use the Meta Pixel and related advertising technologies provided by:

Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland

and associated Meta entities, including Meta Platforms, Inc. in the United States.

Meta technologies may allow us to:

• measure advertising effectiveness;

• determine whether advertisements resulted in purchases;

• understand customer journeys;

• create advertising audiences;

• retarget visitors;

• optimize advertising campaigns.

Depending on our configuration, information sent to Meta may include:

• website activity;

• page views;

• purchases;

• cart activity;

• device information;

• browser information;

• IP-related information;

• cookie identifiers;

• hashed contact information, such as an email address, where Enhanced Matching is used.

Meta may associate information received through these technologies with information already associated with a Meta account.

Where required under European privacy law, Meta advertising technologies are activated only after appropriate consent has been provided.

You may withdraw consent through the cookie or privacy settings available on our website.

24. TARGETED ADVERTISING

We may use information about website interactions to measure and personalize advertising.

Depending on the privacy law applicable to you, certain advertising-related disclosures of personal information may be considered:

• “sharing”;

• “sale”;

• processing for “targeted advertising”;

• or equivalent activity under applicable law.

Where required, you may opt out using the privacy controls made available on our website.

We do not sell personal information to data brokers for monetary payment.

25. CONTACTING US

When you contact us through:

• email;

• contact forms;

• customer support;

• social media;

• or another communication method,

we process the information necessary to respond to your request.

This may include:

• name;

• email address;

• order number;

• message content;

• attachments;

• customer support history.

For GDPR purposes, processing may be based on Article 6(1)(b) GDPR where the communication relates to a contract or Article 6(1)(f) GDPR where we have a legitimate interest in responding to inquiries.

26. FRAUD PREVENTION AND SECURITY

We may process personal information where reasonably necessary to:

• detect fraudulent transactions;

• prevent payment fraud;

• investigate chargebacks;

• protect our website;

• enforce our Terms and Conditions;

• prevent unauthorized access;

• protect our legal rights;

• comply with legal obligations.

We may share relevant transaction information with payment processors, financial institutions, ecommerce providers or authorities where reasonably necessary for these purposes.

27. WHEN WE DISCLOSE PERSONAL INFORMATION

We may disclose personal information to service providers and other parties where reasonably necessary to operate Melory.

These may include providers of:

• ecommerce infrastructure;

• web hosting;

• content delivery;

• payment processing;

• email delivery;

• analytics;

• advertising;

• customer reviews;

• customer support;

• cloud storage;

• fraud prevention;

• artificial intelligence;

• music generation;

• audio production;

• personalization;

• accounting;

• legal services.

We may also disclose information:

• when required by law;

• in response to a lawful authority request;

• to protect our legal rights;

• to investigate fraud or abuse;

• in connection with a business sale, restructuring or acquisition where legally permitted.

Service providers are only provided with information reasonably necessary for their role.

28. INTERNATIONAL DATA TRANSFERS

Melory is operated from Germany but serves customers internationally.

Some service providers used by Melory are located in or process information in countries outside Germany or the European Economic Area, including the United States and Canada.

Where GDPR requirements apply to international transfers, we use or rely on legally recognized transfer mechanisms where necessary, which may include:

• adequacy decisions;

• the EU-U.S. Data Privacy Framework where applicable;

• Standard Contractual Clauses;

• other legally permitted safeguards.

29. HOW LONG WE KEEP PERSONAL INFORMATION

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal obligations.

Retention periods depend on the type of information.

For example:

Order and Accounting Information

Certain transaction information may be retained for statutory accounting, tax and commercial recordkeeping periods.

Personalization Information

Information submitted for personalized song production may be retained for the time reasonably necessary to:

• produce the order;

• deliver the product;

• provide revisions;

• handle refunds;

• provide customer support;

• defend or establish legal claims.

We may subsequently delete or anonymize such information where it is no longer required.

Marketing Information

Marketing information may be retained until you withdraw consent, opt out or the information is no longer required, subject to records we may need to retain to demonstrate your opt-out.

Analytics Information

Analytics data is retained according to the settings and retention periods configured for the applicable analytics provider.

We may retain information longer where necessary to comply with legal obligations, prevent fraud, resolve disputes or enforce agreements.

30. GDPR RIGHTS

If the GDPR applies to you, you may have the following rights, subject to applicable legal requirements and exceptions:

• Right of access under Article 15 GDPR;

• Right to rectification under Article 16 GDPR;

• Right to erasure under Article 17 GDPR;

• Right to restriction of processing under Article 18 GDPR;

• Right to notification under Article 19 GDPR;

• Right to data portability under Article 20 GDPR;

• Right to object under Article 21 GDPR;

• Right to withdraw consent under Article 7(3) GDPR;

• Right to lodge a complaint with a supervisory authority under Article 77 GDPR.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

31. RIGHT TO OBJECT UNDER THE GDPR

Where we process personal information on the basis of our legitimate interests under Article 6(1)(f) GDPR, you may have the right to object to such processing on grounds relating to your particular situation.

We will stop the relevant processing unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defense of legal claims.

Where personal information is processed for direct marketing purposes, you have the right to object to that processing at any time.

If you object to processing for direct marketing purposes, we will stop processing the relevant information for those purposes.

32. UNITED STATES PRIVACY RIGHTS

Residents of certain U.S. states may have additional privacy rights.

Depending on your state of residence, the law applicable to Melory and applicable statutory thresholds, these rights may include the right to:

• know or access personal information we process;

• obtain information about categories of personal information collected;

• request correction of inaccurate information;

• request deletion of personal information;

• obtain a portable copy of certain information;

• opt out of targeted advertising;

• opt out of the sale of personal information;

• opt out of certain sharing of personal information;

• limit certain uses of sensitive personal information;

• appeal the denial of a privacy request;

• receive equal service and pricing without unlawful discrimination for exercising privacy rights.

These rights are subject to exceptions and eligibility requirements under applicable law.

We will not unlawfully discriminate against you because you exercise an applicable privacy right.

33. CALIFORNIA PRIVACY RIGHTS

If you are a California resident and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), applies to our processing, you may have rights including:

• the right to know what personal information we collect;

• the right to know how it is used and disclosed;

• the right to request deletion;

• the right to request correction;

• the right to opt out of the sale or sharing of personal information;

• the right to limit certain uses or disclosures of sensitive personal information where applicable;

• the right not to receive discriminatory treatment for exercising applicable rights.

For purposes of California law, certain advertising or tracking activities may potentially qualify as “sharing” even where no money is exchanged.

Where applicable, privacy controls allowing you to opt out of such activities will be made available through our website.

34. GLOBAL PRIVACY CONTROL

Where required by applicable law, including where applicable under California privacy law, we recognize qualifying browser-based privacy signals such as Global Privacy Control (“GPC”) as an opt-out request for relevant browser or device activity.

The effect of a GPC signal may depend on:

• the browser used;

• the device used;

• whether you are logged in;

• applicable legal requirements;

• our technical configuration.

35. CHILDREN'S PRIVACY

Melory is not directed toward children under the age of 13.

We do not knowingly collect personal information directly from children under 13 for the purpose of creating customer accounts or selling products to them.

Customers ordering personalized products should be adults or otherwise legally permitted to enter into the transaction.

A customer may provide information about a child in connection with a personalized gift, for example the name of a son or daughter mentioned in a song.

Such information is processed as part of the personalization information submitted by the adult customer.

If you believe a child has directly provided us with personal information without appropriate authorization, please contact us.

36. SENSITIVE PERSONAL INFORMATION

Our service does not require customers to provide highly sensitive personal information.

Please avoid submitting unnecessary information concerning matters such as:

• health conditions;

• precise financial information;

• government identification numbers;

• passwords;

• sexual orientation or sex life;

• religious beliefs;

• political beliefs;

• biometric information;

• other highly sensitive personal information.

If you voluntarily include sensitive information in your personalization request, we will process it only to the extent reasonably necessary to provide the service, subject to applicable law.

37. DATA SECURITY

We use reasonable technical and organizational measures intended to protect personal information against:

• unauthorized access;

• alteration;

• disclosure;

• destruction;

• accidental loss.

However, no electronic transmission or storage system can be guaranteed to be completely secure.

You are responsible for keeping any account credentials or private download links confidential.

38. THIRD-PARTY WEBSITES

Our website may contain links to websites or services operated by third parties.

We are not responsible for the privacy practices of third-party websites that are not controlled by Melory.

We encourage you to review the privacy policies of those third parties.

39. DO NOT TRACK

Some browsers provide a “Do Not Track” signal.

Because there is not a universally applied technical standard governing all Do Not Track signals, our website may not respond to every such signal.

Where legally required, however, recognized privacy preference signals such as Global Privacy Control are handled in accordance with applicable law.

40. LEGAL BASES FOR PROCESSING

Where the GDPR applies, we process personal information primarily on the following legal bases:

Article 6(1)(a) GDPR – Consent

For example:

• optional cookies;

• advertising tracking;

• certain analytics;

• marketing emails;

• optional SMS marketing.

Article 6(1)(b) GDPR – Contract

For example:

• processing orders;

• creating personalized songs;

• payment processing;

• product delivery;

• customer support relating to an order.

Article 6(1)(c) GDPR – Legal Obligation

For example:

• accounting;

• tax obligations;

• legal recordkeeping;

• responding to legally binding requests.

Article 6(1)(f) GDPR – Legitimate Interests

For example:

• website security;

• fraud prevention;

• customer support;

• improving our service;

• enforcing legal rights;

• maintaining technical infrastructure.

Where we rely on legitimate interests, we balance those interests against the rights and interests of affected individuals.

41. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

• changes to our services;

• changes to service providers;

• changes to technology;

• changes to legal requirements;

• changes to our privacy practices.

The current version will be published on getmelory.com with an updated “Last Updated” date.

Where required by law, material changes will be communicated through an appropriate additional notice.

42. CONTACT AND PRIVACY REQUESTS

To exercise an applicable privacy right or ask a question regarding this Privacy Policy, contact:

Melory
Heinrich-Seliger-Straße 5
60528 Frankfurt am Main
Germany

Website: https://getmelory.com

Email: support@getmelory.com

Please include enough information for us to understand and process your request.

We may need to verify your identity before fulfilling certain requests where required or permitted by law.