Privacy policy

1. Controller and contact

Service

Rosify · rosify.org

Contact and rights requests

contact@rosify.org

This policy applies to Rosify’s website, app, gifts and communications. It covers data about creators, recipients and other people appearing in a gift. The Terms and conditions explain content licences; a copyright licence does not replace a legal basis for processing personal data.

2. Data we receive and its sources

• Account: name, email, account identifier, protected credentials, sign-in provider and basic information supplied by Google or Apple when you use them to sign in; your chosen alias, avatar and preferences.
• Gifts and collaborations: messages, letters, names, dates, photos, drawings, audio, music, videos, links and group contributions. These may include data about recipients or other people supplied by a gift’s creator or contributor.
• Usage and support: IP address, browser, device, access and error logs, feature interactions, creation and delivery status, enquiries, feedback and communications you send us.
• Purchases: order, amount, currency, payment status, transaction identifiers, subscription and credits. Full card details are supplied to the payment provider; Rosify receives the information needed to manage and verify the purchase.
• Permissions and publication: privacy choices, public identity, consent version and date, changes, removal requests and authorisations for commissioned publications.
• Attribution and measurement: referral campaign or link, browsing and purchase events, device or advertising identifiers where available and permitted, and related technical information.

If someone else provides your data, the source is that person and their gift, not necessarily an account you created. You can ask about its source and exercise your rights without registering. Do not include health, sex life, beliefs or other particularly sensitive data, identity documents or private information about others in gifts.

3. Purposes and legal bases

• Creating, storing and delivering gifts, managing your account and handling requests: performance of a contract or steps you request before contracting, for data about the contracting user. For recipients’ and third parties’ data, the legitimate interest in delivering the requested communication, after balancing their rights; this does not justify unexpected, sensitive or promotional uses.
• Payments, subscriptions, credits and after-sales support: performance of the contract; compliance with applicable tax, accounting and consumer protection obligations.
• Security, fraud prevention, incidents and legal claims: legitimate interests in protecting accounts, users and the service through proportionate measures; a legal obligation where a law requires retention or disclosure.
• Public gallery and Rosify’s online content: your optional consent for each purpose and the necessary authorisations from other affected people. Paid publications you commission have their own authorisation and contractual basis, without replacing third-party rights.
• AI or media features you request: performance of the chosen feature, using the information needed to generate lyrics, music, images or other outputs where offered. Do not submit sensitive information or unnecessary third-party data.
• Advertising, marketing communications and non-essential measurement technologies: consent where required. Communications about our own products similar to those purchased may only rely on the applicable legal exception and must offer a simple, free opt-out.

Data necessary to create an account, deliver a gift or process payment enables those functions; without it, we may be unable to provide them. Promotional permissions are voluntary. You can object to processing based on legitimate interests; we will consider your circumstances. We do not use these preferences to make solely automated decisions producing legal or similarly significant effects on you.

4. Turning your creations into Rosify content

In Profile and permissions (Perfil y permisos) you can separately allow your roses to appear in the public gallery and to be used in posts or videos on our online channels. The second permission allows us to showcase the service through Rosify’s own content on its website and Instagram, TikTok or YouTube profiles, within the authorised scope. It does not automatically include paid advertisements, licensing to other brands or AI training.

Productions may contain excerpts from letters, photos, music or other elements covered by your authorisation, adapted to the format as explained in the Terms. Your public identity choice determines whether your name or alias appears. Anonymous profile mode does not anonymise the contents of a gift. Contact details, sensitive information and third-party data without sufficient authorisation must be excluded.

Enabling a permission does not automatically publish a creation or guarantee selection. Sharing a link or accepting the terms does not enable the permissions. A creator’s authorisation is not the recipient’s, a depicted person’s or a group contributor’s authorisation.

You can withdraw each consent in Profile and permissions or by email. We will stop new uses and remove affected publications under our control without undue delay, unless a legal basis requires otherwise and is explained. We will retain only data with another valid legal basis, without continuing promotional use. Withdrawal does not affect the lawfulness of earlier authorised use.

Content posted on social platforms may be seen worldwide, indexed or shared by others. We will handle removals within our responsibility and cooperate with platforms, but third-party copies may require additional requests.

5. Who may receive data

Access is available to authorised people operating Rosify and providers needed for the feature used: hosting and storage, email, support, security, payments and content generation tools. Processors must act under instructions and with the required contractual safeguards. Authorities may also receive data where legally required or necessary for a legitimate claim.

• Recipients and collaborators: receive content you share with them. Anyone who obtains a link may view and forward it according to the gift’s settings.
• Sign-in and payments: Google or Apple for your chosen sign-in; Stripe for web payments; Apple or Google for store purchases where available; RevenueCat to verify purchases and manage subscriptions and access rights.
• Generation and playback: integrated generation services, such as Suno or Google Lyria depending on the feature and active provider, receive necessary instructions or materials. Links and players from YouTube or other platforms may send them your IP and playback information when loaded.
• Measurement: OpenAI Ads and X Ads integrations on the web and AppsFlyer in the app may process events, identifiers and technical information to attribute installs or purchases and measure campaigns, according to the configuration and applicable permissions.
• Authorised publication: platforms such as Instagram/Meta, TikTok or YouTube/Google receive the authorised production, which becomes available to their audience. These platforms also process data under their own policies.

We do not give third parties general permission to sell your gifts or use them for their own purposes unrelated to the service. This policy does not authorise reuse of private gifts to train AI models. Third parties acting as independent controllers, such as certain payment platforms or social networks, explain their processing in their own policies.

6. International transfers

Some providers or platforms may process data outside the European Economic Area. Transfers must rely on an applicable adequacy decision, European Commission standard contractual clauses with additional measures where needed, or another mechanism permitted by the GDPR. A provider’s certification under an adequacy framework is relevant only if current and covering the specific processing. You can request information about destinations and a copy of applicable safeguards at contact@rosify.org.

7. Cookies, storage and tracking

The website uses cookies or technical storage for sessions, security and editor continuity. Advertising, attribution and external content integrations may use additional technologies to measure visits, installs or conversions and recognise devices. The app may also use identifiers and events through its SDKs.

Non-essential technologies require prior consent where the law requires it; simply using Rosify or reading this policy does not provide that consent. Cookie controls offered and device privacy permissions allow you to manage available options. You can also clear or block storage in your browser, although this may sign you out or affect drafts. Withdrawing publication permission does not itself change measurement permissions, or vice versa. You can contact us with questions or to withdraw consents.

8. How long we retain information

• Account and preferences: while you maintain the account and they are needed to manage it; afterwards, only as needed for legal obligations or claims.
• Gifts and files: while they need to remain available under the service requested. You can request deletion; we will also consider collaborators’ and recipients’ rights. A copy retained due to a legal obligation will not be used for promotion.
• Promotional content: for the applicable permission’s duration, until withdrawal or until the purpose ends, whichever is earlier.
• Purchases and billing: during fulfilment and the statutory tax, accounting and limitation periods applicable to each record.
• Support and security: during resolution and the time needed to investigate incidents or address claims, with restricted retention where appropriate.
• Consent evidence: as necessary to demonstrate permission and address potential claims within their legal limitation period; this does not keep withdrawn consent active.

When the purpose ends, data is deleted, irreversibly anonymised or blocked where required by law. Backups are subject to their replacement cycle and access and use restrictions; restoration must respect deletion requests. You can request the criteria and period applicable to your case.

9. Your rights and how to exercise them

You can request access, rectification, erasure, restriction, portability where applicable and objection, including objection to direct marketing. You can withdraw consent at any time. Email contact@rosify.org, explaining your request and providing information needed to locate it. You do not need an account to request removal of your data from someone else’s gift.

We will only request additional identity information if there are reasonable doubts and only as necessary; a copy of your identity document is not routinely required. We will respond within one month, potentially extended by two further months for complexity or the number of requests, informing you within the first month. Requests are free except for the exceptions in the GDPR.

You can complain to the Spanish Data Protection Agency (AEPD) or the competent supervisory authority, particularly where you live or work, without having to complain to Rosify first.

10. Children, security and changes

Account creation and content submission are intended for people aged at least 16. Tell us if you find a minor’s data shared improperly. General account permissions do not authorise the use of minors in campaigns.

We apply technical and organisational measures proportionate to the risk; no system guarantees absolute security. Share links only with intended recipients and avoid including information you do not want forwarded. Incidents will be handled with any notifications required by law.

We will date policy revisions and communicate material changes. An update does not retroactively expand consented uses; a new purpose requiring consent must be requested separately.