Privacy Policy

Last updated: 11 September 2026

This explains what I do with your personal information when you order a song or get in touch. I have written it to describe what actually happens, rather than to cover every theoretical possibility.

1. Who is responsible

I am. Nathan Grisdale, trading as Nathan Grisdale Music, based in the United Kingdom. I am the data controller for the information described here, and I will give you my full trading address on request. For anything about your data, email info@nathangrisdale.co.uk.

2. What I collect, and why

When you order a song: your name, email address, phone number and postal address. I need these to identify your order, to contact you about it, and because my payment providers require billing details.

I also collect your brief — who the song is for, the occasion, the mood you want, four memories or events, the story behind it, and any order notes. This is what I write the song from; without it there is no song.

A word about the brief. People often tell me about bereavements, illnesses, relationships and families, because that is what the songs are about. I read it, I write your song from it, and that is all it is used for. Please include only what you are comfortable putting in writing. If you would rather tell me something sensitive by email or over the phone than type it into a form, say so in the brief and I will get in touch.

When you use the contact form: your name, email address, phone number and your message.

When you download your song: the date and time, your IP address, and your browser's user-agent string. I use this to see that a song has actually been collected, which saves a good deal of "did you get it?" email on both sides.

3. My lawful bases for using it

• Performing our contract — your order details and your brief. I cannot write the song without them.
• Legal obligation — keeping records of sales for tax purposes.
• Legitimate interests — the download logs, so I can confirm a delivery succeeded; and keeping copies of the emails I have sent you, so there is a record of what you were told and when.
• Consent — if I ever ask whether I can feature your song or your story publicly. You can say no, and you can change your mind later.

I do not send marketing email and I do not keep a mailing list.

4. Payments

Card payments are handled by Stripe and PayPal payments by PayPal. Your card or account details go directly to them and are never stored on or passed through my website. Each is a separate data controller for the information it holds — see Stripe's privacy policy and PayPal's privacy policy.

What I keep is a record of which provider you used, the amount, their payment reference, and whether the payment succeeded.

5. Email

Order confirmations and download links are sent through a third-party email delivery provider, which processes your email address in order to deliver the message. I keep a copy of each email sent to you, including its contents, so there is a record of what was sent.

6. Order notifications

When an order is placed or the contact form is used, a notification goes to a private Slack workspace that only I and anyone helping me run the business can see. For contact-form enquiries, that notification includes your message.

7. Who else sees your information

Nobody, other than:

• the payment provider you chose;
• my email provider;
• my web host, who stores the site and its database on my behalf;
• anyone directly helping me run the business.

I do not sell personal information and I do not share it for advertising.

8. How long I keep it

• Order records, including your brief — kept indefinitely. They are the record of what I was asked to write and what I delivered, and I am required to keep the financial side for at least six years.
• Copies of emails sent to you — the contents are deleted after 24 months. I keep a note that the email was sent.
• Download logs — 12 months.
• Contact-form enquiries — 24 months.

9. Your rights

You have the right to ask for a copy of the information I hold about you, to have it corrected, to have it deleted, to restrict or object to how I use it, to receive it in a portable form, and to withdraw consent where you have given it.

One honest caveat about deletion. I can delete your brief, your contact details and your address, and I will if you ask. What I cannot delete is the financial record of the sale — the amount, the date and the payment reference — because I am legally required to keep it. So an erasure request leaves your order as an anonymous transaction rather than removing it altogether.

Email me and I will deal with your request within one month.

10. Cookies

The site sets one essential cookie, which keeps your session working while you fill in the checkout form. That is all. There is no analytics, no advertising tracking and no third-party cookies, which is why you are not being asked to accept anything.

11. Where your information is held

The website and its database are held by my hosting provider. Stripe, PayPal and my email provider may process data outside the UK; where they do, they rely on the safeguards set out in their own privacy policies. If you want to know exactly where your information sits at any point, ask me and I will tell you.

12. Security

The site runs over an encrypted connection. Download links are private, individual to your order and time-limited. Finished songs are stored privately and cannot be browsed or guessed at from the web.

13. Complaints

If you are unhappy with how I have handled your information, please email me first so I can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

14. Changes to this policy

If I change this policy I will update the date at the top of this page.