Privacy & data protection at PersonalHits.

This Privacy Notice explains how information about you is collected, used, shared, stored, and secured by PersonalHits (“PersonalHits,” “we,” “our,” or “us”) when you use personalhits.com and related applications, products, and services (collectively, the “Services”), or when you otherwise interact with us. It also explains your choices regarding your information.

By using the Services, you consent to the practices described in this Privacy Policy.

We may update this Privacy Policy from time to time. If changes are material, we will notify you through the Services or by email.

We collect information you provide, information generated automatically by your use of the Services, and information from third parties. Broadly, we collect Contact Information, User Account Information, User Activity Information, and Content.

*Payment data (e.g., card numbers) is collected and processed directly by Stripe. See Payment Processing.

We collect User Activity Information such as pages viewed, actions taken (e.g., creating a song brief, generating visuals), access times, IP address, device/browser type, OS, referring/exit pages, and approximate location (via IP). We log media generation events and feature usage. We use cookies and similar technologies (see Cookies).

We may receive Contact Information from partners (e.g., analytics/communication tools) and login providers if you use third-party sign-in (e.g., Google). We may also receive information from publicly available sources where lawful.

Under GDPR/KVKK, our legal bases include contract, legitimate interests, consent, and legal obligation:

We use cookies, pixels, and SDKs to operate the site, remember preferences, perform analytics, and (where permitted) for marketing.

You can change preferences anytime. We currently do not respond to “Do Not Track.” Where Global Privacy Control (GPC) or similar signals are legally required, we honor them in those jurisdictions.

We do not sell your personal information.

We use vendors for hosting, infrastructure, security, analytics, customer support, email/SMS delivery, payments (Stripe), and similar services. They process data under our instructions and must protect it appropriately. See Annex B – Sub-Processor List.

For example, testimonials or referrals, or third-party logins.

To comply with law, enforce terms, or protect rights, users, or the public.

In a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards.

We operate globally. Where we transfer EEA/UK personal data to countries without an adequacy decision, we rely on appropriate safeguards such as EU/UK Standard Contractual Clauses (SCCs) plus additional measures as needed. For Türkiye personal data under KVKK, we use adequate safeguards and, where required, obtain explicit consent or rely on PDPL-compliant mechanisms.

We implement technical and organizational measures (e.g., encryption in transit, access controls, least privilege, monitoring). No system is 100% secure. You are responsible for safeguarding your password and logging out after sessions.

We retain personal data only as long as necessary for the purposes described, including:

We may retain de-identified or aggregated data for lawful business purposes.

Payments are processed by Stripe. You provide payment details directly to Stripe. We do not store your full card details. Stripe may act as an independent controller/processor depending on the activity. See Stripe’s own private documentation for details.

Residents of U.S. states with comprehensive privacy laws (e.g., CA, CO, CT, VA, UT) may have rights to know/access, correct, delete, and (where applicable) opt-out of certain processing. We do not “sell” or “share” personal information as defined by these laws, nor do we knowingly sell/share personal information of consumers under 16. Submit requests via Contact. We verify requests as required and do not discriminate for exercising rights.

If you are in the EEA/UK, PersonalHits is the data controller (unless stated otherwise). Subject to conditions/exemptions, you have the right to access, rectify, erase, restrict, object (including to direct marketing), portability, and withdraw consent where processing is based on consent. You may lodge a complaint with your local DPA (or the UK ICO). Please contact us first so we can help.

For data subjects in Türkiye, we process personal data per KVKK No. 6698 and secondary legislation.

Your KVKK rights include (subject to legal conditions):

Application method: You can submit KVKK applications to us via the Contact details below. We will respond within statutory time limits. For international transfers under KVKK, we use appropriate safeguards and, where required, obtain explicit consent.

You must be at least 13 years old to use the Services. If you are under 18, you may only use the Services with the consent and supervision of a parent or legal guardian. We do not knowingly collect personal information from children under 13. If we learn that a child under 13 has provided personal information, we will take steps to delete such information promptly.

We may update this Notice from time to time. We will post changes here with the updated “Last Modified” date. If changes are material, we may provide additional notice (e.g., on our homepage or via email). If you disagree with the updated Notice, you should stop using the Services.

For questions, requests (including GDPR/KVKK/US state law requests), or complaints, contact us at:
 Email: contact@personalhits.com

(You can also reach support via the same address. Please specify your country of residence to help route your request.)

Purpose. This DPA forms part of the agreement between PersonalHits and a business customer (the “Customer”) where PersonalHits processes personal data on behalf of Customer (e.g., corporate gifting or managed accounts). For consumer/end-user relationships in which PersonalHits determines purposes/means, PersonalHits acts as controller, and this DPA does not apply.

Roles. Customer is controller; PersonalHits is processor (EEA/UK GDPR) and/or data processor (KVKK). For U.S. state laws, PersonalHits acts as processor/service provider.

Processor Obligations. PersonalHits shall:
(a) process personal data only on documented instructions from Customer;
(b) ensure confidentiality;
(c) implement appropriate technical/organizational measures (TOMs);
(d) assist Customer with data subject requests, security, DPIAs, and consultations as reasonably necessary;
(e) delete or return personal data at termination (unless law requires storage);
(f) make available information necessary to demonstrate compliance and allow reasonable audits (subject to confidentiality and scheduling);
(g) promptly notify Customer of personal data breaches affecting Customer data.

Sub-processing. Customer authorizes PersonalHits to engage sub-processors listed in Annex B and replacements/additions with prior notice. PersonalHits will impose data protection terms no less protective than this DPA on all sub-processors.

International Transfers. For EEA/UK personal data, the EU/UK SCCs (controller-to-processor, Module 2) are incorporated by reference, including relevant Annexes. For KVKK transfers, PersonalHits will use PDPL-compliant mechanisms and, where required, obtain explicit consent.

Liability & Precedence. This DPA prevails over conflicting terms in the main agreement concerning data protection. Each party remains responsible for its own compliance obligations.

We will update this Annex when we add or replace a sub-processor and will provide customers with a method to subscribe to updates (e.g., a changelog or email notice). Objections may be raised per the DPA.