Privacy policy

Who we are

The website paliva.org is run by Paliva (“we”). We are responsible for the personal data you send us through the site. For any question about it, write to info@paliva.org.

Trader

Paliva

Email

info@paliva.org

What data we collect

We only collect what you send us yourself, plus the minimum needed to keep the site secure:

• Contact details from the form: name, email and, if you choose to add it, phone number.
• The content of your message or order: subject, text, the story about the person or the occasion, your own lyrics, the occasion, the language of the lyrics, preferences for genre, vocals and mood, music wishes, the intro, how you heard about Paliva (if you answer), the discount or gift code (if you enter one) and whether you agree that the piece may be published.
• Minimal technical data when you send the form (for example anonymised identifiers of the connection and of the email), to protect against spam and abuse.
• If a limit on the number of submissions (for example too many messages in a day) or on deleting your profile stops you: your email, name, whether you were signed in, the topic, which limit and when — so we can contact you.
• Technical data recorded by our hosting provider for every visit: IP address, browser, the page you opened, the referring site and the time.
• The language and theme (day or night) you chose on the site — stored in your browser and, if you have a profile and save them there, in your profile.
• If you create a profile (optional): email, how you sign in (Google or email and password), public name, real name (if different), phone number (if you add it — only to fill in the order form) and your chosen language and theme. Your password is stored securely by our sign-in provider — we never see it. When you sign in with Google we only receive your email and name.
• With a profile, “Orders” and “Requests” show the orders and requests sent from the profile's confirmed email (also those sent without signing in), and you can ask a question about them. You also see our short messages about them there (for a new message we keep only the order or request number and the number of new messages in your profile until you open them; we may also send you a short email notice without the text). When you approve a version, ask for changes or decline from your profile, the decision, your text and the time are saved with the order, and a copy is emailed to Paliva and to you — as confirmation for both sides. Questions, decisions and messages are kept with the order or request and deleted together with it (the emails stay in the mailboxes).
• With a profile we also record when you use it, without tracking what you look at: the date the profile was created, the day of your last visit (no time), the number of days with a visit and whether you last came from a phone or a computer (no details about the device itself, the browser or your IP address).
• If Paliva creates a song or a poem for you and you agree that it may be published, we link the piece to your email (from the order or, if you ordered another way — by phone or in person — the email you give us). With a profile on the same confirmed email you see it under “Works”. The link keeps only the email and which piece it is; you can ask us to remove it at any time.
• With a profile you can like songs and poems and make playlists. What you liked and your playlists are kept in your profile and only you see them (and we, only how many there are, if we need to help you with your profile). The site shows only the total number of likes, without names. To prevent abuse, your profile also keeps how many changes you made today (up to 50 a day).
• With a profile you can write comments under songs and poems. A comment (text, date and your public name) is visible to all signed-in visitors with a profile; visitors who are not signed in do not see them. Your profile keeps a reference to each of your comments (the start of the text and the page) and when and how many you wrote recently (for the limits: 5 minutes between comments, up to 5 an hour, 10 a day). Before publishing, the text is checked automatically for links; we review inappropriate words ourselves. You can report someone else's comment — we keep that you reported it (only we see this) so we can review it. We may delete a comment that breaks the rules (we keep the deleted comment for up to 24 hours so it can be restored if that was a mistake) and, in case of abuse, block comments from the profile (this is noted in the profile).

Please do not send us sensitive data (for example about health, religion or political views) unless it truly matters for the story you want us to tell.

Why we use it

• To answer your question — our legitimate interest in replying to people who write to us (Art. 6(1)(f) GDPR).
• To discuss and fulfil an order for a song or a poem — steps you ask for before a contract, and the contract itself (Art. 6(1)(b) GDPR).
• To publish the finished piece on Paliva's YouTube channel and on paliva.org and share it on Paliva's Facebook page (marked as created on request, without your name unless you explicitly ask for it) — only if you have given your consent (Art. 6(1)(a) GDPR).
• To keep the profile you created and your settings in it — a contract, i.e. the service you asked for (Art. 6(1)(b) GDPR).
• The visit dates and the device type — to help you with a problem with your profile and to see which profiles are in use; only we see them — our legitimate interest (Art. 6(1)(f) GDPR).
• To protect the form and the comments from spam and abuse — our legitimate interest (Art. 6(1)(f) GDPR).
• To keep the site secure and working (finding errors, broken links, abuse and outages) — our legitimate interest (Art. 6(1)(f) GDPR). We do not use this data for visitor statistics or link it to particular people.

We do not sell your data, use it for advertising or build profiles about you.

Who has access to it

Only we read your messages. We keep them in our mailbox and in a secure database in the European Union that no one else can access. To run the site we use trusted providers that process data only on our behalf and with appropriate safeguards:

• website hosting and database;
• profile sign-in;
• sending and receiving emails;
• protecting the form from spam.

The videos embedded on the site come from YouTube, which only receives data once you play a video and handles it as an independent controller, under its own policies. The same applies when you open a playlist with “Open in YouTube” — YouTube then receives the list of videos.

Some providers may process data outside the EU. Such transfers are protected by the safeguards set out in the GDPR (for example standard contractual clauses).

If we send you a private link to listen to a song (a demo, a finished song or a gift), you may need to sign in to your profile with the e-mail we sent it to in order to open it. The recipients' e-mails, the texts on the page (dedication, introduction) and the song itself are kept in Google Cloud Storage by Google (USA), with no advertising and no access for anyone else, while the link is active and for 90 days after that.

The music and vocals of the songs are created with an artificial intelligence tool from a provider based in the USA. We enter the song's words and style directions into it, and for a personal intro also the intro text with the name you gave us. We do not enter your email, phone number or your story as you told it. The provider handles what we enter as an independent controller, under its own policies, stores it in the USA and may use it to improve its service. The transfer to the USA is necessary to carry out the order you asked for (Art. 49(1)(b) GDPR). If you do not want the name entered there, tell us in your order — we will suggest an intro without a name.

How long we keep it

• Messages and orders — for as long as our conversation or the work on the order lasts, and up to 2 years after our last contact, unless the law requires longer (for example for accounting records). In our database they are deleted automatically 2 years after they were sent.
• For every order and inquiry we also keep an anonymised record — date, topic, the options chosen and its status, without name, contact details or texts — as a general history of orders. It contains no personal data and does not expire.
• Technical data used against spam — deleted automatically within 2 days.
• The record that a limit stopped you — deleted automatically after 90 days (30 days in the server's technical logs).
• Technical data about visits — deleted automatically after 7 days.
• Your profile — until you delete it. The visit dates, the device type, your likes, playlists and comments are kept in the profile and deleted with it; your likes are removed from the totals and your comments are hidden as soon as the profile is archived (and come back if you restore it). You can delete a single comment at any time — deleting is final. Under “Profile” → “Delete profile” it is archived for 30 days (until the Monday after them; until then you can restore it by signing in again) and then deleted automatically, together with its data and the personal data in the requests sent from the profile’s email. We email you at each step. A profile with an unconfirmed email is deleted right away when you delete it, and automatically after 30 days if you never confirm the address. If the rules are broken, we may suspend signing in to the profile (everything in it is kept until we allow it again) or delete it — it is then archived in the same way for 30 days, but only Paliva can restore it (write to us), and we let you know by email. You can also write to us at info@paliva.org.
• Private listening links (the recipients' e-mails, the texts on the page and the song) — while the link is active and for 90 days after it expires or is switched off, then deleted; a reserved address with no content has no expiry.
• The link between a piece you ordered and your email — while the piece is on the site or until you ask us to remove it; it is also deleted with your profile.
• Your chosen language and theme — stay in your browser until you clear the site’s data.
• An unfinished message in the order or contact form — only in your browser, so it isn't lost if the page reloads or the connection drops: until you send it, press “Clear the form”, or for up to 24 hours; if you are signed in, it is shown only when you sign in with the same profile. It reaches us only when you send it.

Cookies

Paliva does not use cookies for statistics or advertising. Your language and theme choice is kept in your browser — it is needed for the site to work the way you set it. If you sign in to your profile, our sign-in system keeps your session in your browser (local storage), so you stay signed in until you press “Sign out” or for up to 2 days without a visit, the day your visit was last noted in your profile (so it is recorded only once a day) and a copy of the total like counts for up to 60 minutes (so they are not loaded on every page). External services, such as the spam protection on the form, and YouTube (when you play a video), may use their own cookies under their own policies.

Your rights

At any time you can ask us to:

• give you access to the data we keep about you and a copy of it;
• correct inaccurate or incomplete data;
• delete your data;
• restrict how we use it;
• stop using it where we rely on legitimate interest (objection);
• give it to you in a portable format;
• withdraw your consent to publishing the piece — this does not affect anything done before the withdrawal.

Write to us at info@paliva.org — we will reply as soon as possible, and no later than one month, as the law requires. If you believe your rights have been breached, you can complain to the Bulgarian Commission for Personal Data Protection (CPDP), www.cpdp.bg.

Security

The site only works over a secure connection (HTTPS). The form is protected against automated requests, and only we have access to the messages we receive.

Changes

We may update this policy when something on the site changes. The date of the last change is shown at the top of the page.