Privacy Policy

Last updated: 31 July 2026

This Privacy Policy explains how Smiles & Tears Studio collects, uses, shares and protects personal data in connection with its website, Google Forms, email, social media, payments, project briefs and creative services. It applies to clients, prospective clients, business contacts and people whose information is included in project materials.

1. Data Controller

2. Personal data we collect

Depending on the interaction or project, we may collect:

• Contact and identity information, such as name, email address, telephone number, country, company and role.
• Order and billing information, such as the selected service, price, currency, invoice details, payment status and transaction references. Card details are processed by the payment provider and are not stored by the Studio.
• Project brief information, such as names, relationships, dates, memories, stories, pronunciations, preferred language, genre, mood and creative instructions.
• Client materials, such as photographs, videos, voice notes, logos, messages and other files submitted for a personalized song or video.
• Communications, approvals, revision requests, support messages and records of consent, including portfolio permission.
• Technical and website data, such as IP address, browser, device information, cookie choices and usage information where applicable.

3. How we receive data

We receive data directly from clients through the website, Google Forms, email, invoices, messages and file-sharing services. A client may also provide information about another person who is the subject or recipient of a project. In that case, the client is responsible for ensuring that the information is provided lawfully and that required permissions have been obtained.

4. Why we use personal data

We use personal data to:

• respond to enquiries and prepare quotations;
• create, revise, approve and deliver personalized songs and videos;
• manage orders, payments, invoices and accounting records;
• communicate about deadlines, materials, approvals and support;
• protect the Studio’s rights, prevent misuse and resolve complaints;
• comply with legal, tax and regulatory obligations;
• display a project in the portfolio only where separate permission has been granted; and
• operate and improve the website where permitted.

5. Legal bases under GDPR

Where the GDPR applies, processing is based on one or more of the following:

• performance of a contract or steps requested before entering into a contract;
• compliance with legal obligations, including tax and accounting duties;
• legitimate interests in operating the Studio, securing services, keeping appropriate records and handling disputes, balanced against individual rights; and
• consent, including optional portfolio publication and non-essential cookies where required.

Where processing relies on consent, consent may be withdrawn at any time for future processing.

6. Sensitive data and information about other people

Clients should not submit sensitive personal data unless it is genuinely necessary for the project. Before providing stories, images or other information about another person, the client should consider that person’s privacy and obtain any permission required by law. We may ask for material to be removed or replaced where it appears excessive, unlawful or inappropriate.

7. Service providers and recipients

We do not sell personal data. We may share only the data reasonably necessary with service providers used for:

• forms, email, cloud storage and file transfer, including Google services;
• payment processing and invoicing, including Stripe;
• AI-assisted generation, audio, image and video production;
• website hosting, content delivery, security and analytics;
• accounting, legal advice and regulatory compliance.

Providers may act as processors or independent controllers under their own privacy terms. Information may also be disclosed where required by law, to protect legal rights, or in connection with a lawful business reorganization.

8. International data transfers

Some providers may process data outside Portugal or the European Economic Area. Where required, we rely on an adequacy decision, standard contractual clauses or another safeguard recognized under applicable data protection law.

9. Portfolio permission

Private stories, submitted materials and completed projects are not published in the Studio’s portfolio without separate permission. Portfolio permission is optional and is not required to purchase a service. It may be withdrawn for future use by contacting studio@smilesntears.com, without affecting processing or publication already lawfully carried out before withdrawal.

10. Data retention

We retain personal data only for as long as reasonably necessary for the project, revisions, support, legal claims and business records. Enquiry data that does not result in an order is periodically deleted when no longer useful. Project files may be kept for a reasonable post-delivery period to support corrections or repeat orders, unless earlier deletion is requested and no legal or contractual reason requires retention. Invoices and accounting records are kept for the period required by law. Portfolio materials are kept until permission is withdrawn or the material is no longer used.

11. Security

We use reasonable technical and organizational measures to protect personal data against unauthorized access, loss, misuse or disclosure. No online transmission or storage method can be guaranteed completely secure.

12. Your rights

Subject to applicable law, individuals may request access, correction, deletion, restriction, portability or objection to processing, and may withdraw consent. Some rights may be limited where data must be retained for legal obligations, the establishment or defense of claims, or other lawful reasons.

Requests may be sent to studio@smilesntears.com. We may need to verify identity before completing a request.

13. Complaints

Individuals may lodge a complaint with the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD), or another competent data protection authority in the European Union.

14. Children

The services are ordered by adults. If a project includes information, images or recordings of a minor, the client must have the authority and permissions required to provide those materials. The Studio may request confirmation or refuse materials where permission is unclear.

15. Cookies

Information about cookies and available choices is provided in the Cookie Settings.

16. Policy updates

We may update this Policy when services, providers or legal requirements change. The current version and update date will be published on this page.

17. Contact

For privacy questions or requests, contact studio@smilesntears.com.