Privacy Policy

1. Overview

This policy explains what Hitou ("we") collects on hitou.site, why, and what your choices are. Short version: we collect what's needed to create and deliver your song, we don't sell your data, and voice recordings are never stored. We use Google Analytics to measure traffic, and a Meta pixel to measure ads if you came from one (section 4).

2. What we collect

Information you provide:

• the occasion, the recipient's first name, your story, and style choices (genre, mood, voice) - used to write and produce the song;
• a personal note (dedication) if you add one to the gift page;
• your email address - optional, only if you want the song link sent to you;
• a voice recording, if you choose to tell your story by voice - it is converted to text immediately and the audio is never stored;
• a video message (your face and voice), if you choose to record one for the gift page after purchase - it is processed on our own server (camera metadata such as location is stripped) and stored as part of the gift page; it is not shared with any third party.

Collected automatically when you order:

• your IP address and browser type (user agent);
• if you arrived from an ad - the ad click identifier from the link (e.g. fbclid, gclid) and click time.

Anonymous usage statistics: our own server counts page visits and quiz-step progress to understand where visitors drop off. This part is first-party and anonymous: we store a one-way daily hash instead of your IP address (it cannot be reversed and cannot link your visits across days), plus a random quiz session identifier that is not connected to your name or email. We also use Google Analytics (section 4) to see which sources bring visitors and where they stop - it sets its own cookies, described below.

In your browser: we use localStorage only to save your quiz progress on your device (so you can pick up where you left off), a random quiz session identifier for the anonymous statistics above, and to remember that a gift page belongs to you as the buyer. Our server does not set cookies. Two third-party tags do: the Meta pixel sets its advertising cookie (_fbp), and Google Analytics sets its analytics cookies (_ga and _ga_*) to tell repeat visits apart. Both are described in section 4.

3. How we use it

• to create your song and host the gift page;
• to send you service emails about your order - up to six if you haven't purchased (welcome, preview ready, two reminders, and two warnings before your song files are deleted), and if you purchase - an order confirmation and a single follow-up about a month later; each has a one-click unsubscribe;
• to process your purchase and prevent fraud or abuse;
• to measure advertising: when a purchase comes from an ad click, we may send a server-side purchase event to the ad platform (see section 4).

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

4. Who we share data with (processors)

• Whop (merchant of record) - processes card and Apple Pay payments; receives the order reference, occasion, and recipient's first name to label the purchase;
• lava.top - processes PayPal payments; receives your email (or a technical order alias if you didn't share one);
• OpenAI - converts voice stories to text; receives the audio transiently, we never store it;
• AI music providers - receive the creative brief (recipient's first name, story, style) and the finished lyrics to produce the music;
• Resend - sends our service emails; receives your email address;
• Meta - the site loads the Meta pixel (page views and the _fbp cookie) to measure ad performance. If your purchase came from a Facebook/Instagram ad, we also send a server-side Purchase event with the click id, your IP, browser type, and your email in hashed (unreadable) form.
• Google Analytics - measures traffic and where it comes from: which page you opened (this includes the unique address of your gift page), the link or search that brought you, and the technical details your browser sends anyway (device, browser, approximate location from your IP). It sets the _ga and _ga_* cookies to tell a repeat visit from a new one. We never send it your name, your email, or the story you wrote.

These providers process data on our behalf under their own security obligations. They are located in the United States and other countries.

5. How long we keep it

• Unpaid orders without an email: song files are kept for about 30 days after the preview is created, then are deleted;
• Unpaid orders with an email: song files are deleted about 30 days after the last reminder email - we send two warnings before that happens;
• in all cases, unpaid song files are deleted no later than about 90 days after the preview was created;
• Purchased songs: kept so your gift page and downloads stay available - that's the product;
• Video messages: kept as part of the purchased gift page. You can re-record or remove the video until you send the gift; after sending, the page - including the video - is locked as delivered. You can still request deletion by email at any time (section 7);
• order records are retained as needed for accounting, fraud prevention, and legal compliance.

You can request deletion earlier at any time (section 7).

6. Children

The service is not directed to children under 13, and we do not knowingly collect personal information from them. Purchases require you to be 18 or older. If you believe a child under 13 provided us personal information, contact us and we will delete it.

7. Your rights and choices

Email us at hello@hitou.site to access, correct, or delete your personal information. Every email we send has a one-click unsubscribe that stops all marketing-style messages to your address.

California residents (CCPA/CPRA): you have the right to know what personal information we collect (listed in section 2: identifiers such as email and IP; commercial information such as order details; audio converted to text; audiovisual information such as an optional video message you record for the gift), to request its deletion or correction, and to not be discriminated against for exercising these rights. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of. To exercise any right, email hello@hitou.site - we verify requests by confirming control of the email tied to the order.

8. Security

All traffic is encrypted (HTTPS). Payment card data is handled entirely by our payment processors and never touches our servers. Access to order data is restricted.

9. Changes

We may update this policy; the current version with its effective date is always at hitou.site/privacy.

10. Contact

hello@hitou.site · Hitou, Petropavlovsk, Kazakhstan