1. Data Controller
Media Rosenqvist is the data controller for the processing of personal data on this service. Contact for data protection questions: use the contact form.
2. Data We Process
- Account: email, display name, password (hashed), role.
- Artist profile: name, bio, links, images and uploaded content.
- Listening data: plays and favorites.
- Donations: amount, currency, date and payment identifier from Stripe. We never store card details.
- Consents: your choices in the cookie banner, version and timestamp.
- Technical: IP address (hashed), browser type and event logs for security.
3. Purpose and Legal Basis
- Provide the service — contract.
- Payments and accounting — legal obligation.
- Security, intrusion detection, incident reporting (NIS2) — legitimate interest.
- Analysis and marketing — consent (can be revoked at any time).
4. Retention Period
- Account data: as long as the account is active + 90 days.
- Accounting records (donations): 7 years under the Swedish Accounting Act.
- Security logs: 12 months.
- Consent logs: 3 years after revocation.
5. Recipients and Sub-processors
- Supabase (EU region) — database, authentication, file handling.
- Stripe — payments.
- Spotify, Suno, AzuraCast — only metadata we have entered ourselves.
- Meta (Facebook) — when a release goes live we publish the release title, artist name, cover art and link on our Facebook Page. No account or contact data is shared.
- Vercel — hosting and operations.
- Cloudflare R2 — media file storage.
6. Your Rights
You have the right to access, rectification, erasure, restriction, data portability and objection. To exercise these rights, reach us via the contact form.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
7. Security (NIS2)
We apply appropriate technical and organizational measures: TLS in transit, encryption at rest, principle of least privilege, audit logging of administrative actions and an incident handling process in accordance with the NIS2 directive. Serious incidents are reported to the competent authority within 24/72 hours.
8. Changes
When the policy is updated we raise the version number and, for material changes, ask for renewed consent.