Privacy Policy

Last updated: October 10, 2026

Data Controller

CeremonySpeech is operated by Derwish Rosalia, based in the Netherlands. For questions about this policy or your personal data, contact us at privacy@ceremonyspeech.com.

Information We Collect

When you use CeremonySpeech, we collect:

  • Questionnaire answers: Information you provide about military service, career highlights, people to thank, ceremony details, and speech preferences.
  • Generated speech content: The speech text created from your answers, including any edits or revisions you make.
  • Payment status: Whether you have unlocked a speech (paid/pending). We do not store credit card numbers or payment card details—these are handled exclusively by Stripe.
  • Technical logs: Basic server logs including IP addresses, browser type, and access times for security and troubleshooting purposes.

How We Store Your Data

Your speech session data (questionnaire answers, generated speech, and payment status) is stored on secure cloud servers provided by Vercel. Each speech is assigned a unique identifier that allows you to return to your speech later. This data is stored persistently, not just in your browser session.

Purposes and Legal Bases (GDPR)

We process your personal data for the following purposes:

  • Contract performance (Article 6(1)(b) GDPR): Processing your questionnaire answers to generate your speech, storing it so you can return to edit and download it, and processing your payment.
  • Legitimate interests (Article 6(1)(f) GDPR): Maintaining security, preventing fraud, analyzing aggregated usage patterns to improve the service, and troubleshooting technical issues. You may object to processing based on legitimate interests.

Service Providers (Data Processors)

We share your data with the following third parties who process it on our behalf:

  • Vercel Inc. (San Francisco, USA) — Website hosting and data storage. Vercel stores your speech session data.
  • OpenAI, L.L.C. (San Francisco, USA) — AI speech generation. Your questionnaire answers are sent to OpenAI to generate your speech. OpenAI does not use data submitted via API for training unless you opt in (we do not opt in).
  • Stripe, Inc. (San Francisco, USA) — Payment processing. Stripe handles all credit card and payment information directly. We never see or store your card details.

International Data Transfers

Our service providers are based in the United States. Data transfers from the EU/EEA to the US are protected by the EU-US Data Privacy Framework certifications held by these providers, and/or Standard Contractual Clauses (SCCs) approved by the European Commission. You can request a copy of the relevant safeguards by contacting us.

Data Retention

Speech sessions are automatically deleted after 90 days from creation. You can also delete your speech at any time using the "Delete my speech" button on your speech page. Deleted data is permanently removed from our systems and cannot be recovered. Basic technical logs are retained for up to 30 days.

Your Rights

Under GDPR (EU/EEA residents)

You have the right to:

  • Access your personal data and obtain a copy
  • Rectify (correct) inaccurate personal data
  • Erase your personal data ("right to be forgotten")
  • Restrict processing of your data
  • Object to processing based on legitimate interests
  • Data portability — receive your data in a structured format
  • Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl

Under California Law (CalOPPA/CCPA)

California residents have the right to:

  • Know what personal information is collected and how it is used
  • Delete personal information we hold about you
  • Opt-out of sale — however, we do not sell personal information
  • Non-discrimination for exercising your privacy rights

To exercise any of these rights, contact us at privacy@ceremonyspeech.com or use the "Delete my speech" button on your speech page. We will respond to requests within 30 days (or as required by law).

No Sale or Sharing of Personal Information

We do not sell, rent, or share your personal information with third parties for their marketing purposes. We only share data with service providers who process it on our behalf as described above.

Children's Privacy

CeremonySpeech is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately and we will delete it.

Cookies and Analytics

We use only strictly necessary cookies required for the website to function (such as session identifiers). We do not use advertising or tracking cookies.

We use Vercel Web Analytics to understand how visitors use our site (page views, referrers, countries). This service collects aggregated, anonymous data and does not use cookies or track individual users.

Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. This includes encrypted connections (HTTPS), secure cloud infrastructure, and access controls.

Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Contact Us

For questions about this privacy policy or to exercise your rights, contact us at privacy@ceremonyspeech.com.

Derwish Rosalia
Netherlands