Privacy Policy (GDPR)

The data controller is:
Aira Softix s.r.o., Company ID (IČO): 243 84 135
Registered office: Záhřebská 562/41, Vinohrady, 120 00 Prague 2, Czech Republic
Registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 439968
Contact email for data protection matters: support@melirana.com

Melirana is an online service for creating personalized digital content using artificial intelligence technologies. We process personal data in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the legal regulations of the Czech Republic.

• Contact details: email address and phone number (if provided in the order or during communication via WhatsApp).
• Order and payment data: specifications and parameters of the ordered digital content, order date and time, price, payment status, transaction identifier, and tax invoice number if issued. Payments are processed through the payment service provider available in the order interface. The controller does not store or collect payment card details; these data are processed exclusively by the relevant payment service provider.
• Input materials for creation: names, facts, descriptions, memories, wishes, selected style, or language provided to personalize content.
• Uploaded media files: photos or video recordings voluntarily uploaded for visual personalization of digital content.
• Voice samples: voice recordings of the buyer's own voice voluntarily provided when using the synthetic voice feature.
• Created personalized result: generated text, audio, and audiovisual materials.
• Communication and customer support: messages sent to support, email correspondence, profile or conversation identifiers when communicating via Facebook Messenger or WhatsApp.
• Technical data: IP address, browser and device type, system logs, session identifiers, and cookies.

• Performance of a contract and steps prior to entering into a contract at the request of the data subject (Art. 6(1)(b) GDPR): creation, personalization, and provision of access to digital content according to instructions, providing a pre-purchase preview, delivery of digital content, customer support, and, if the buyer chooses the respective feature, processing of their voice sample for the purpose of creating or using a synthetic voice.
• Consent of the data subject (Art. 6(1)(a) GDPR): sending newsletters, marketing offers, and commercial communications (if you grant voluntary consent in the order form; consent can be withdrawn at any time via the unsubscribe link in each email or by contacting the controller), storage of optional analytical and marketing cookies, and other optional processing where consent is required.
• Compliance with legal obligations (Art. 6(1)(c) GDPR): issuing invoices, accounting, and tax compliance under the legal regulations of the Czech Republic.
• Legitimate interests (Art. 6(1)(f) GDPR): ensuring the security of the web platform, protection against abuse, DoS attacks, and rate limiting, as well as the establishment, exercise, or defense of legal claims.

• No biometric identification: Uploaded photos, videos, or voice recordings are not processed for the purpose of unique biometric identification or authentication under Art. 9 GDPR. They serve solely as source materials for generating the ordered content.
• Synthetic voice: If the product selected by the buyer includes creating or using a synthetic voice of the buyer, we process their voice samples only to the extent necessary to provide this feature and related support. Before processing begins, the controller may require confirmation that the voice sample belongs to the buyer and that the buyer provides it for the purpose of creating the ordered digital content. Voice samples and any voice profile are not used for unique biometric identification or authentication of the buyer. The buyer may provide only their own voice sample for the creation or use of a synthetic voice. Providing a voice sample of another person is not permitted.
• Third-party data: If you provide us with personal data or photos of other persons (e.g. gift recipients), we process them solely in connection with completing your gift order.
• Privacy protection: We do not use your input materials or created personalized content for public promotion or advertising without your separate, explicit consent.

We use specialized artificial intelligence technologies and cloud interfaces for the creation and personalization of digital content.

Depending on the nature of the ordered product, text materials, technical parameters, photos, image or audiovisual materials, and voice recordings may be processed through these technologies, strictly to the extent necessary to create the ordered digital content.

Contact and payment details are never transferred to AI technology providers under any circumstances. The controller recommends not including confidential or sensitive data in requests that are not necessary to personalize the result.

The controller selects the scope of data transferred to artificial intelligence technology providers so that it is limited to data necessary to generate the ordered digital content.

To ensure the operation of the service, personal data may be made available to the extent necessary to the following categories of processors or other recipients:

• Payment and billing services: providers of payment services and order management, including FAPI Business s.r.o., which provides order management and invoicing.
• Cloud infrastructure and storage: providers of secure server infrastructure and cloud data storage.
• Email and communication tools: email and newsletter service providers (for transactional messages and consent-based marketing communications) and communication platforms (when communicating through them).
• Artificial intelligence providers: cloud AI services for content generation and synthesis.
• Analytics and advertising tools: providers of Google Analytics, Meta Pixel, TikTok Pixel, and OpenAI Pixel services, only to the extent corresponding to the user's granted consent.

If personal data is transferred outside the European Economic Area, it takes place only subject to the conditions of the GDPR, in particular on the basis of European Commission adequacy decisions or Standard Contractual Clauses approved by the European Commission, or another valid mechanism under the GDPR.

We retain personal data only for as long as necessary to fulfill the relevant purpose of processing, protect legal claims, or for the period required by legal regulations.

• Input materials, media files, and working drafts: retained for the period necessary to create and make available the ordered content, provide related support, and handle potential complaints, unless longer retention is required by law.
• Purchased digital content: retained for the duration during which the buyer is provided agreed access, and thereafter only to the extent necessary to fulfill legal obligations or protect legal claims.
• Voice samples and any voice profile: retained only for the period necessary to deliver the ordered performance, provide related support, and resolve any complaints. When determining the retention period, we also take into account the technical deletion timelines of the providers used.
• Data for sending newsletters and commercial communications: retained for the duration of your consent, at most until its withdrawal (unsubscribing).
• Accounting and tax records: retained for the period specified by applicable legal regulations.
• Customer support communications: retained for the period needed to handle the request and subsequently for the period necessary to protect legal claims.
• Technical logs: retained for the period necessary to ensure security, diagnose technical issues, and protect against abuse.

On our website, we use necessary technical cookies to ensure the proper functioning of the site and the order process.

With user consent, tools such as Google Analytics, Meta Pixel, TikTok Pixel, and OpenAI Pixel may be used in particular to measure traffic, evaluate advertising campaign effectiveness, and conduct marketing analysis. These tools may store or read identifiers and cookies, particularly cookies of Google, Meta, TikTok, and OpenAI services.

Details regarding specific cookies, their providers, purposes, and validity periods are provided in the Cookie settings interface, where you can change your preferences or withdraw your granted consent at any time.

You can also delete or block cookies in your web browser settings.

We obtain personal data primarily directly from you when specifying personalization, placing an order, making a payment, or communicating with customer support.

If you are a person for whom another user ordered personalized digital content, we may receive your personal data from that user in connection with their order.

Certain technical and payment data is obtained from providers of payment, hosting, analytics, or communication services.

Providing the data necessary to create an order and provide digital content is a contractual requirement. Without this data, we may not be able to process the order or make the digital content available, and the timeframe for delivering the result shall be suspended until they are properly provided.

Providing data for analytical or marketing purposes is voluntary, and refusing consent has no effect on the ability to order the product.

Under GDPR, you have the right to:

• request access to your data and obtain a copy (Art. 15 GDPR);
• request rectification of inaccurate or incomplete data (Art. 16 GDPR);
• request erasure of your data ("right to be forgotten") when grounds for processing no longer exist (Art. 17 GDPR);
• request restriction of processing (Art. 18 GDPR);
• request data portability (Art. 20 GDPR);
• object to processing based on legitimate interests (Art. 21 GDPR);
• withdraw your consent at any time (Art. 7(3) GDPR); withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Requests can be submitted by email to: support@melirana.com.

If you believe that the processing of your personal data infringes legal regulations, you have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection (ÚOOÚ) (https://uoou.gov.cz) or with the supervisory authority in your EU member state of residence.

The controller does not carry out automated individual decision-making with legal or similarly significant effects under Art. 22 GDPR.

This policy becomes effective on 15.09.2026 (last updated: 23.09.2026).