Privacy Policy

Data Controller

CeremonySpeech is operated by Derwish Rosalia, based in the Netherlands. For questions about this policy or your personal data, contact us at privacy@ceremonyspeech.com.

If you subscribe to our newsletter, we store your email address with our email provider Resend until you unsubscribe (reply "unsubscribe" to any email). Legal basis: your consent (Art. 6(1)(a) GDPR), confirmed via a double opt-in email.

Checkout Reminder Email

On your speech page you can enter your email address and tick the box "Email me one reminder if I don't finish checkout". The box is never ticked in advance. If you leave it unticked, we do not store the email address you typed.

What we store: your email address, the time you asked for the reminder, the time your checkout was abandoned (expired without payment), and, once sent, the time the reminder went out. These are linked to the identifier of your speech.
Purpose: to send you one single email with a link back to your saved speech if you do not complete checkout. We send no other emails based on this, and we do not add you to our newsletter.
Processor: the reminder is sent through our email provider Resend (Resend, Inc., USA), which receives your email address and the content of the reminder only to deliver it.
Legal basis: your consent (Article 6(1)(a) GDPR), given by ticking the box. You can withdraw it at any time.
Retention: we keep this data for at most 30 days after you ask for the reminder, after which it is deleted automatically. Your email address is deleted earlier as soon as the reminder has been sent, when you complete payment, or when you delete your speech.
Removal: to have your email address removed before then, email us at privacy@ceremonyspeech.com or use the "Delete this speech" button on your speech page, which also deletes the reminder data.

Information We Collect

When you use CeremonySpeech, we collect:

Questionnaire answers: Information you provide about military service, career highlights, people to thank, ceremony details, and speech preferences.
Generated speech content: The speech text created from your answers, including any edits or revisions you make.
Payment status: Whether you have unlocked a speech (paid/pending). We do not store credit card numbers or payment card details—these are handled exclusively by Stripe.
Reminder email (optional): Your email address and related times, only if you ask for a checkout reminder (see "Checkout Reminder Email" above).
Technical logs: Basic server logs including IP addresses, browser type, and access times for security and troubleshooting purposes.

How We Store Your Data

Your speech session data (questionnaire answers, generated speech, and payment status) is stored privately on Vercel Blob and is read only on our servers. It is not published at a public URL. Access is limited to the browser that created the speech, via a signed session cookie. Each speech is assigned a unique identifier so you can return to it later. This data is stored persistently, not just in your browser session. If you opt in to an abandoned-checkout reminder, that email address is stored the same way: privately, read only on our servers, and never at a public URL.

Purposes and Legal Bases (GDPR)

We process your personal data for the following purposes:

Contract performance (Article 6(1)(b) GDPR): Processing your questionnaire answers to generate your speech, storing it so you can return to edit and download it, and processing your payment.
Legitimate interests (Article 6(1)(f) GDPR): Maintaining security, preventing fraud, analyzing aggregated usage patterns to improve the service, and troubleshooting technical issues. You may object to processing based on legitimate interests.
Consent (Article 6(1)(a) GDPR): Sending the newsletter and the single checkout reminder email, only when you have opted in.

Service Providers (Data Processors)

We share your data with the following third parties who process it on our behalf:

Vercel Inc. (San Francisco, USA) — Website hosting and data storage. Vercel stores your speech session data.
OpenAI, L.L.C. (San Francisco, USA) — AI speech generation. Your questionnaire answers are sent to OpenAI to generate your speech. OpenAI does not use data submitted via API for training unless you opt in (we do not opt in).
Stripe, Inc. (San Francisco, USA) — Payment processing. Stripe handles all credit card and payment information directly. We never see or store your card details.
Resend, Inc. (San Francisco, USA) — Email delivery. Resend sends our newsletter and the optional checkout reminder email, and receives your email address for that purpose only.

International Data Transfers

Our service providers are based in the United States. Data transfers from the EU/EEA to the US are protected by the EU-US Data Privacy Framework certifications held by these providers, and/or Standard Contractual Clauses (SCCs) approved by the European Commission. You can request a copy of the relevant safeguards by contacting us.

Data Retention

Speech sessions are automatically deleted after 90 days from creation. You can also delete your speech at any time using the "Delete my speech" button on your speech page. Deleted data is permanently removed from our systems and cannot be recovered. If you asked for a checkout reminder, your email address and the related times are deleted after at most 30 days (see "Checkout Reminder Email"). Basic technical logs are retained for up to 30 days.

Your Rights

Under GDPR (EU/EEA residents)

You have the right to:

Access your personal data and obtain a copy
Rectify (correct) inaccurate personal data
Erase your personal data ("right to be forgotten")
Restrict processing of your data
Object to processing based on legitimate interests
Data portability — receive your data in a structured format
Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl

Under California Law (CalOPPA/CCPA)

California residents have the right to:

Know what personal information is collected and how it is used
Delete personal information we hold about you
Opt-out of sale — however, we do not sell personal information
Non-discrimination for exercising your privacy rights

To exercise any of these rights, contact us at privacy@ceremonyspeech.com or use the "Delete my speech" button on your speech page. We will respond to requests within 30 days (or as required by law).

No Sale or Sharing of Personal Information

We do not sell, rent, or share your personal information with third parties for their marketing purposes. We only share data with service providers who process it on our behalf as described above.

Children's Privacy

CeremonySpeech is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately and we will delete it.

Cookies and Analytics

We use only strictly necessary cookies required for the website to function (such as session identifiers). We do not use advertising or tracking cookies.

We use Vercel Web Analytics to understand how visitors use our site (page views, referrers, countries). This service collects aggregated, anonymous data and does not use cookies or track individual users.

Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. This includes encrypted connections (HTTPS), secure cloud infrastructure, and access controls.

Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Contact Us

For questions about this privacy policy or to exercise your rights, contact us at privacy@ceremonyspeech.com.

Derwish Rosalia
Netherlands