Privacy Policy

Who is responsible

WaveLab, 9, Gamgye-ro 187beon-gil, Buk-myeon, Uichang-gu, Changwon-si, Gyeongsangnam-do, Republic of Korea (“we”), decides how the personal data described here is used (the controller). For any question or request about your data, write to wavelab.ai@gmail.com.

What we use, why, and on what legal basis

Your answers to the questions, your first name and, if you give it, the first name of the person you pray for: to write your letter and your pages. Answers can say something about your faith, your health, a loss or your marriage and family, which data protection law treats as sensitive. We use them only with your explicit consent, given with the checkbox in the conversation before your answers are sent (GDPR art. 9(2)(a); LGPD art. 11, I). You can withdraw it at any time by writing to wavelab.ai@gmail.com: we then delete your answers and write nothing more from them. Withdrawing does not undo pages already written.

Your email address and time zone: to send your journey link and your daily pages at the right local time, and to write to you about your order. This is needed to provide what you bought (contract: GDPR art. 6(1)(b); LGPD art. 7, V).

The amount, currency, status and identifiers of your payment, received from PortOne and PayPal (never your card number or PayPal login): to confirm your purchase and handle refunds (contract).

The IP address and browser details your checkout was opened from, stored with your order: used only for ad measurement, as described below.

To keep the site available and protect it from abuse, we count requests per IP address, and a Cloudflare Turnstile check in the conversation confirms that a person, not a program, is asking for a page to be written. The IP address is pseudonymised (replaced by a SHA-256 hash) before any count is stored (our legitimate interest in security: GDPR art. 6(1)(f); LGPD art. 7, IX).

For a memorial song: the name of the one you remember, who they were to you, the memories you write and the sound you choose, to write and sing the song. Memories can say something about health, faith or family, so they too are used only with your explicit consent, given with the checkbox in the form before they are sent (GDPR art. 9(2)(a); LGPD art. 11, I), and can be withdrawn the same way.

Ad measurement (Meta)

The Meta Pixel in your browser and the Meta Conversions API on our server tell Meta which ads led to a visit, a checkout or a purchase. Meta receives the page and the event, the price, your IP address and browser details, Meta's own cookies and ad-click identifier, and a pseudonymised (SHA-256 hashed) form of your email address, your country and your order number.

In the EEA, the UK and Switzerland, and whenever we cannot tell which country you are in, this happens only after you allow it in the cookie banner (consent: GDPR art. 6(1)(a)); where we ask, you can change your choice at any time from the cookie settings link at the bottom of the page. Elsewhere, including Brazil and the US, it runs on our legitimate interest in measuring our advertising (LGPD art. 7, IX), and you can object at any time by writing to wavelab.ai@gmail.com.

Meta also uses this data under its own privacy policy.

What is stored in your browser

prayletter_ad_consent (local storage): your ad-measurement choice, kept until you change it or clear this site's data.

prayletter_draft_<language>_<journey> (session storage): the preview written for you, so reloading the page does not lose it. Deleted when you close the tab.

prayletter_memorial_<kind> (session storage): the reference of the memorial song being made for you, so reloading the page comes back to it. Deleted when you close the tab.

prayletter_click (session storage): the ad-click identifier (fbclid) and campaign tags (utm_…) of the link that brought you here, for ad measurement. It reaches us only if ad measurement is allowed, and is deleted when you close the tab.

_fbp and _fbc (cookies): set by the Meta Pixel when ad measurement runs. The PayPal payment window and the Turnstile check may store their own data under PayPal's and Cloudflare's policies. We set no other cookies.

Who processes your data, and where

Google Cloud (Google LLC): hosting and database, in the us-central1 region, USA.

OpenAI (OpenAI, L.L.C.), USA: writes your pages with its GPT model from your answers and names. Under OpenAI's API terms, this data is not used to train its models.

APIMart, through which the Suno music model sings your song from its lyrics.

Resend, USA: delivers our emails.

Cloudflare (Cloudflare, Inc.), USA: the Turnstile check in the conversation.

PortOne, South Korea: connects our checkout to PayPal.

PayPal: processes your payment. For the details you give it, PayPal is responsible under its own privacy statement; which PayPal company serves you depends on where you live.

Meta (Meta Platforms Ireland Limited in the EEA, the UK and Switzerland; Meta Platforms, Inc., USA, elsewhere): ad measurement, as described above.

We do not sell your personal data, and we share it with no one else unless the law requires it.

International transfers

These providers process data in the USA and South Korea, so your data leaves Brazil, the EEA and the UK. The European Commission and the UK recognise South Korea as giving adequate protection. Transfers to the USA rely on the EU-U.S. Data Privacy Framework (and its UK extension) where the provider is certified, and otherwise on the standard contractual clauses in the provider's data processing terms. Transfers from Brazil rely on the safeguards LGPD art. 33 allows, such as standard contractual clauses. Write to wavelab.ai@gmail.com for a copy of the safeguards that apply.

How long we keep it

Journeys that are not paid (answers, names, the preview, and the email address if you gave one): deleted automatically 14 days after your last step. Expired records are usually removed within a day.

Memorial songs that are not bought (the name, the memories, the lyrics and the song): deleted automatically 14 days after they were made.

Paid journeys (answers, names, your pages, email address, time zone, payment details, and the IP address and browser details of the checkout): nothing deletes them automatically. They are kept so your private link and daily emails keep working, until you ask us to delete them at wavelab.ai@gmail.com. We then delete them, keeping only a record of the payment where the law requires one.

Request counts for abuse protection (pseudonymised IP address): deleted automatically after the hour they cover.

Server logs (IP address, browser, the address requested): kept by Google Cloud for 30 days for security and troubleshooting.

Your rights

Wherever you live, you can ask us at wavelab.ai@gmail.com what data we hold about you, and to correct or delete it. We answer within one month in the EEA and the UK, 15 days in Brazil and 45 days under US state laws.

In the EEA and the UK (GDPR and UK GDPR): you can also ask us to restrict the use of your data, receive it in a portable format and object to uses based on legitimate interest; withdraw your consent at any time, without affecting what was done before; and complain to the data protection authority where you live or work (in the UK, the ICO).

In Brazil (LGPD art. 18): you can ask for confirmation that we process your data, access to it, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, deletion of data used with your consent, and information about whom we share it with and about what happens if you do not consent, and you can withdraw consent. You can also complain to the National Data Protection Authority (ANPD).

In the US: depending on the state you live in (for example California, Colorado, Connecticut, Virginia or Texas), you can ask to know, access, correct and delete your personal data, and opt out of targeted advertising and of the “sale” or “sharing” of personal data. We do not sell personal data for money, but measuring our ads with Meta can count as “sharing” or targeted advertising under some of these laws: to opt out, write to wavelab.ai@gmail.com. Your answers about faith, health, a loss or family are sensitive personal information; we use them only to write your pages. We will not treat you differently for using these rights, and you may act through an authorised agent.