1. Data Controller Information
The Data Controller responsible for the processing of your personal data under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR" / Polish "RODO") and the Polish Personal Data Protection Act of May 10, 2018 is:
2. Scope & Applicable Law
This Privacy Policy applies to all personal data collected through the Soundalike website (soundalike.io), mobile applications (com.soundalikesteam.soundalikemobileapp), music recommendation engines, and related services. It complies with:
- Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR);
- Polish Personal Data Protection Act (Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych);
- Google Play Data Safety guidelines;
- Apple App Store Privacy Nutrition Labels and App Review Guidelines.
3. Categories of Data We Collect
We process only data strictly necessary to deliver our music workspace and marketplace features:
- Account & Profile Information: Email address, stage name or display name, account creation date, hashed passwords, and authentication tokens.
- Spotify Web API Integration (Optional): If you choose to link or search your artist profile, we retrieve your public Spotify Artist Name, Artist ID, Spotify follower count, and public avatar image from the official Spotify Web API. We do not access your private Spotify listening history or private Spotify credentials.
- Marketplace & Transaction Data: Records of purchased beat licenses, order numbers, stems download tokens, and payout logs.Note on Financial Details: All credit card payments, BLIK, and Google Pay/Apple Pay transactions are tokenized and processed directly by Stripe, Inc. Soundalike never stores or has access to your full credit card numbers or security CVV codes.
- Audio & Creative Works: User-uploaded instrumental audio files (MP3/WAV/STEMS), beat metadata (BPM, Key, Moods), and draft lyrics written in the RhymeFlow module.
- Algorithmic Taste Profiling (Customizable): Interaction data in Swap Mode (swiping right to match or left to skip), genre preferences, and listened previews. You may disable taste profiling at any time in your Settings under Privacy & Data.
- Technical & Device Data: IP address, device model, operating system version, crash diagnostics, and anonymous session identifiers.
4. Data We Explicitly DO NOT Collect (Mobile App Safety)
To ensure total privacy and compliance with Google Play & Apple App Store review:
- NO Audio Recording / Microphone Access: Soundalike Mobile does not request or require microphone permissions. The app does not record ambient sound or audio from your device.
- NO Photo Gallery / Camera Access: The app does not inspect, read, or upload personal photos or camera streams from your phone. Artist avatars are retrieved from Spotify or our cloud CDN.
- NO Geolocation Tracking: We do not track or store your precise real-time GPS coordinates.
- NO Contact List Access: We never scan your address book or phone contacts.
5. Purposes & Legal Bases for Processing (Art. 6 GDPR)
| Purpose of Processing | Legal Basis (GDPR) | Retention Period |
|---|---|---|
| User authentication, delivering beat downloads, RhymeFlow workspace, custom orders | Art. 6(1)(b) - Performance of contract | Duration of active account |
| Financial settlements, invoice issuance, DAC7 platform reporting | Art. 6(1)(c) - Legal obligation (Tax Code) | 5 years from end of calendar year (statutory requirement) |
| Platform security, fraud prevention, DMCA takedown enforcement | Art. 6(1)(f) - Legitimate interests | Up to 3 years after account deletion |
| AI-driven Taste Profiling & personalized recommendations | Art. 6(1)(a) - User consent (Toggleable) | Until consent is revoked in app settings |
6. Third-Party Sub-Processors & Data Transfers
We work with world-class, security-audited infrastructure providers:
- Stripe, Inc. (USA / Ireland): Payment gateway and Stripe Connect split payouts. Compliant with PCI-DSS Level 1.
- Cloudflare, Inc. (USA): Cloudflare R2 audio storage and CDN caching for high-speed streaming.
- Vercel, Inc. (USA): Next.js web application server hosting.
- MongoDB, Inc. (Atlas - Ireland / EU): Primary encrypted cloud database storage.
- Spotify AB (Sweden): Public artist metadata verification.
Any transfer of data outside the European Economic Area (EEA) is governed by Standard Contractual Clauses (SCCs) approved by the European Commission or the EU-U.S. Data Privacy Framework to guarantee adequate safeguards.
6.1. Data Security & Breach Notification
We implement appropriate technical and organisational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (PUODO) within 72 hours of becoming aware of the breach, and will communicate the breach to affected data subjects without undue delay where it is likely to result in a high risk to their rights and freedoms (Article 33 and Article 34 GDPR).
7. Your Rights Under GDPR (RODO)
Under Chapter III of the GDPR, you have the following rights regarding your personal data:
- Right of Access (Art. 15): Request confirmation and a copy of all personal data held about you.
- Right to Rectification (Art. 16): Correct outdated or inaccurate information.
- Right to Erasure ("Right to be Forgotten", Art. 17): Request deletion of your account and personal data.
- Right to Restriction of Processing (Art. 18): Restrict processing in certain circumstances.
- Right to Data Portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format.
- Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing.
- Right to Lodge a Complaint: You have the right to lodge a complaint with the Polish supervisory authority:Prezes Urzędu Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warszawa, Poland (www.uodo.gov.pl).
8. Account & Data Deletion Procedure
We provide direct, automated tools to exercise your right to erasure:
How to delete your account:
- In Mobile App: Open Settings → Scroll to Account → Tap Delete Account → Confirm with the verification code.
- On Web: Navigate to your Profile → Privacy & Data → Delete Account.
- Public Web Deletion Form: Visit our dedicated Delete Account Page or email us at contact@soundalike.io with the subject "Data Erasure Request".
Upon deletion, your audio stems, match histories, and profile details are permanently purged from active production servers. Transaction records required for statutory tax accounting under Polish law will be archived securely until the statutory limitation period expires.
9. Contact Us
To exercise any of your privacy rights or discuss data handling, contact our team: