Privacy Policy

At Tararea we work with personal stories — probably the most intimate thing you can entrust to a service. This policy explains, with no fine print, what data we process, why, on what legal basis, and what rights you have. We comply with the GDPR (Regulation (EU) 2016/679) and the Spanish LOPDGDD.

1. Data controller

Tararea (Veratis) · Spain · hola@tararea.app. This is the channel for any privacy matter.

2. What data we process

Account data: email, name and, if you sign in with Google, your profile picture. Your story: your interview answers and any photos you choose to upload. Keep in mind that you can tell us anything here — treat those texts as what they are: yours and personal. Generated content: the written story, the lyrics, the songs and the covers created for you. Service usage data: credits, purchases (no card data: that never passes through us) and technical logs. Cookieless statistics: we count visits in an aggregated, anonymous way, without identifying or tracking you (see our cookie policy).

3. Why we process it and on what legal basis

Providing you the service (creating your account, your song, your gift, charging your credits): performance of a contract (Art. 6(1)(b) GDPR). Sending you service emails (verification, your song is ready, receipts): performance of a contract. We do not send marketing without your consent. Security and abuse prevention: legitimate interest (Art. 6(1)(f)). Anonymous statistics: legitimate interest, with no impact on your privacy (no identification is possible).

4. AI and your stories

To create your song, excerpts from your interview are sent to artificial intelligence providers (text, music and image generation) for the sole purpose of producing your content. We do not use your stories to train models, we do not sell them, and we do not use them for advertising.

5. Who else is involved (processors)

Google Cloud (hosting and database, Madrid region, EU) · Google Firebase (authentication) · Stripe (payments — only Stripe ever sees your card details) · AI providers for text, music and images (they process the excerpts needed to generate your content). Some AI providers and Stripe may process data outside the EU; in those cases the transfer is covered by the European Commission's Standard Contractual Clauses or other mechanisms under Art. 46 GDPR.

6. How long we keep it

For as long as your account is active. If you request deletion, your account and all your data are kept for 30 days (in case you change your mind: signing back in restores everything) and then permanently deleted — from our database, our file servers and the authentication system. Billing data is kept for as long as tax regulations require.

7. Published gifts and third-party data

Your gift is only public if you publish it (link or QR code), and you can protect it with a password, choose what's visible, or unpublish it by deleting the memory. Important: if your story is about someone else (which is only natural in a gift!), you are the one deciding to share it — do it with the same care you told it with, and don't publish third-party details that person wouldn't want to see published.

A gift's files (audio, images, PDF) are served through unique, unguessable addresses: they can only be accessed from the gift's link (and its password, if there is one). When you share the link, the recipient can access that content, keep it if downloads are enabled and, beyond our control, pass it on. Responsibility for that distribution lies with whoever shares the link, as detailed in the terms of use. Unpublishing the gift or changing its password cuts off access immediately.

8. Your rights

Access, rectification, erasure, objection, restriction and portability (Arts. 15–22 GDPR). You can exercise them by writing to hola@tararea.app — we respond within 30 days at most. Erasure is also available self-service from your profile (“Delete my account”). If you believe we haven't handled your data properly, you can file a complaint with the Spanish Data Protection Agency (aepd.es).

9. Minors

Tararea is not aimed at children under 14. If we detect an account belonging to a child under that age without their guardians' consent, we will delete it.

10. Security

Encryption in transit (HTTPS/TLS) across the entire service, passwords managed by Firebase Auth (we never see them), infrastructure on Google Cloud with restricted access, and secrets managed in key management systems.

11. Changes

If this policy changes in any meaningful way, you'll see it announced on the website and, if you have an account, we'll let you know by email. Last revised: July 2026.