Privacy Policy

1. Data controller

The data controller responsible for your personal data is the publisher identified in the “Who we are” section above. For any question about this policy or your data, contact us at [email protected].

2. What data we collect

We only collect the data we need to operate the service. Depending on how you use Songfindr, this may include:

• Account data: your name, email address, and password (passwords are stored in hashed form by our authentication provider, never in plain text).
• Authentication data: if you sign in with Google, we receive your name, email address, and profile picture from Google. We never receive your Google password.
• Profile and preference data: your customer segment, language, and settings.
• Billing and transaction data: your purchase history, licenses, subscription status, and billing details. Card numbers are processed and stored solely by our payment provider (Stripe) - we never see or store your full card number.
• Content you create: playlists, projects, favorites, and any names or descriptions you add to them.
• Technical and usage data: IP address, approximate country (used to display the correct currency), browser and device information, pages viewed, and interactions with the site.
• Communications: messages you send us for support or quotes.

3. Linking your YouTube channel

Linking a YouTube channel is optional, and only concerns customers who want a video whitelisted. If you link one, we ask Google for read-only access to your YouTube account. Songfindr's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements (developers.google.com/terms/api-services-user-data-policy).

Using YouTube through Songfindr is also governed by the YouTube Terms of Service (youtube.com/t/terms) and the Google Privacy Policy (policies.google.com/privacy).

• What we read: your channel (identifier, name, avatar, subscriber count, number of videos) and your own uploads (title, description, thumbnail, publication date, and privacy status).
• Why: to confirm the channel is yours, to let you pick the video you want whitelisted, and to pass that video to our distributor so the Content ID claim can be lifted on it.
• What we keep: the channel identifier, its name, avatar, subscriber and video counts, the Google address used for the link, and an encrypted Google refresh token, so a check can run again without asking you to sign in every time.
• What we never do: we never publish, edit, or delete anything on your YouTube account. We never use your YouTube data for advertising, never sell it, and never use it to train models.
• Withdrawing your consent: you can disconnect a channel at any time from your Songfindr account, which also revokes our access at Google. You can review and revoke it yourself at myaccount.google.com/permissions.

4. Why we use your data and on what legal basis

We process your data for the following purposes:

• To create and manage your account and provide the service - legal basis: performance of our contract with you.
• To process payments, subscriptions, and issue licenses and invoices - legal basis: performance of our contract and compliance with legal obligations.
• To provide customer support and respond to your requests - legal basis: performance of our contract and our legitimate interest.
• To secure the service, prevent fraud, and debug problems - legal basis: our legitimate interest.
• To measure how the service is used and improve it through privacy-focused analytics - legal basis: our legitimate interest in maintaining and improving the service.
• To measure how the Songfindr panel for Premiere Pro is used (searches, previews, tracks placed in the timeline, errors), linked to your account when you are signed in, in order to improve it - never the content of your edits. You can decline this at any time in the panel’s settings, under Privacy - legal basis: our legitimate interest.
• To send you service-related emails (e.g. welcome, password reset, payment confirmations) - legal basis: performance of our contract.
• To comply with accounting, tax, and other legal obligations - legal basis: legal obligation.

5. Service providers and data sharing

We do not sell your personal data. We share it only with the service providers (processors) that help us run Songfindr, and only to the extent needed:

• Stripe - payment processing and subscription management.
• Resend - transactional email delivery.
• PostHog (EU region) - privacy-focused product analytics. When you are signed in, this includes a recording of how you use the pages (clicks, scrolling, page changes) so we can find what gets in the way, for example during checkout. Everything you type in a form field is masked and never recorded, and payment details are handled by Stripe, outside our pages.
• Bunny CDN - file storage and content delivery for audio and images.
• Cloudflare - DNS, security, and geolocation for currency display.
• Google / YouTube - the YouTube Data API, only if you link a channel to request whitelisting.
• Our music distributor - the video link, channel name, and track details of a whitelisting request, so the Content ID claim can be lifted on your video.
• We may also disclose data where required by law, or to protect our rights, safety, or property.

6. International transfers

Some of our providers (such as Stripe) may process data outside the European Economic Area. Where this happens, the transfer is protected by appropriate safeguards - typically the European Commission’s Standard Contractual Clauses - so that your data continues to receive an equivalent level of protection.

7. How long we keep your data

We keep your account data for as long as your account is active. After you delete your account, we remove or anonymize your personal data, except where we must retain certain records (for example invoices and transaction records) to meet legal, accounting, and tax obligations, which we keep for the legally required period.

YouTube data is kept for as long as the channel stays linked. Disconnecting a channel deletes it along with our copy of the Google token, and revokes our access at Google unless another of your channels linked from the same Google account still needs it.

8. Cookies and similar technologies

We use cookies and similar technologies that are strictly necessary to run the service (for example to keep you signed in and to remember your language and cart). We also use privacy-focused analytics to understand how the service is used so we can improve it; this is based on our legitimate interest. You can object at any time, or block non-essential cookies through your browser settings.

9. Your rights

Under the GDPR, you have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw your consent at any time. You can exercise most of these rights from your account, or by emailing [email protected]. You also have the right to lodge a complaint with the French data protection authority (CNIL, www.cnil.fr) or your local supervisory authority.

10. Data security

We take reasonable technical and organizational measures to protect your data, including encryption in transit, hashed passwords, and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the authorities of any breach where required by law.

11. Children

Songfindr is not directed to children. You must be at least 16 years old (or the minimum age required in your country to consent to data processing) to create an account. If you believe a child has provided us with personal data, please contact us so we can remove it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Your continued use of the service after an update means you accept the revised policy.