Privacy Policy

Introduction

This privacy policy explains how Soundmango ApS and its affiliated entities ("we," "us," or "our") collect, use, store, and protect the personal information of our users.

Soundmango is a playlist promotion platform. Artists submit a track, choose criteria, and buy a marketing campaign; curators apply with their playlists, listen to tracks, and deliver campaigns while considering each track for their playlist at their own discretion. This policy covers both roles, as well as visitors to our website.

We reserve the right to update this privacy policy at any time without prior notice. It is your responsibility to regularly review this privacy policy. Continued use of our services after any changes constitute a consent to the new version of the privacy policy.

Legal basis for processing

Under the General Data Protection Regulation (GDPR) and other applicable data protection laws, we process your personal information based on the following legal bases:

• Contract performance: We process account, campaign, match, curator-decision, payment, and payout information to fulfill our contractual obligations to you when you purchase a marketing campaign, accept a campaign opportunity, or receive a payout.

• Legitimate interests: We process personal data based on our legitimate interests in operating and improving the platform, matching tracks with curators, recording playlist placements observed by our daily crawl, scoring playlist quality, preventing fraud and abuse, ensuring security, and communicating with you about your account and transactions.

• Consent: We process marketing communications and certain optional features based on your explicit consent, which you may withdraw at any time.

• Legal obligations: We may process and retain certain information to comply with legal obligations, such as tax, accounting, and anti-money-laundering requirements.

Information we collect

We collect the following types of personal information:

Account information

• Your name: We collect your first and last name when you create an account.
• Your email address: We collect your email address during account creation to facilitate login and important communications.
• Authentication data: We store a hashed password, or, if you sign up with Google or Apple, the account identifier and basic profile details those providers return. We never receive your password for a third-party account.
• Profile photo: We may store a profile photo for your account and display it on your profile, where other users you transact with can see it.
• Role: We store whether you use the platform as an artist, a curator, or both.
• Newsletter preferences: If you opt in to receive marketing communications, we store your preference for receiving newsletters and promotional emails.

Artist information

• Artist name: The name you release music under.
• Track details: The track you submit for quality review, matching, and marketing, including the details we read from the streaming platform, such as title, artwork, and release date.
• Campaign details: The criteria and price of every marketing campaign you purchase, and the matches, campaign opportunities, and curator that follow from it.

Curator information

• Playlist links and details: The playlists you apply with, the genre you set for each, and the ownership check we run against them.
• Curator name: The name published as the author of a campaign's promotional content on our partner site. That name and the post are public.
• Feedback: The written feedback you give on a track as part of a campaign. It belongs to the artist, and we retain it so they can read it.
• Campaign opportunity decisions: Which campaign opportunities you accept or decline, and which tracks you add to your playlists.
• Payout details: The bank account and tax details required to pay out your earnings. These are collected and stored by our payment processor, not on our servers.

Payment and billing information

• Billing information: We use Stripe to process payments securely. Stripe collects and stores your payment information, and we do not retain any payment information on our servers. We may retain billing addresses and transaction records for accounting and legal purposes.
• Transaction records: We retain the record of every campaign payment, held balance, refund, earnings, and payout, including amounts, dates, and status.

Playlist and placement data

To run the platform, we record publicly available playlist and track data from streaming platforms through our daily crawl, including the playlist snapshots and the placement records built from them. Where that data relates to a playlist or track you own, it is covered by this policy.

Streaming platform connections

If you connect a streaming platform account to your Soundmango account, we store the connection and the access credentials that platform issues to us, and we read the data the connection permits. A connection is always linked to your existing Soundmango account and never creates a second one. You can disconnect at any time.

Uploaded content

We collect and store the files you upload to the platform. Files are stored securely on our infrastructure in the EU.

Support communications

When you contact us, we keep your message and our correspondence so we can answer it and refer back to it.

Usage and technical data

• Device and activity data: We may collect information about the device you use to access our platform, including IP address, browser type, operating system, and device identifiers, for security reasons and performance optimization.
• Error reports: When something goes wrong, our error tracking captures the technical context of the failure, which may include your account identifier and the page you were on.

Cookies and tracking technologies

We use cookies and similar tracking technologies to operate our platform and improve your experience:

Essential cookies

These cookies are necessary for the platform to function and cannot be disabled:

• Session cookies: Used to maintain your login session and authentication state.
• Security cookies: Used to protect against security threats and ensure platform integrity.

Analytics cookies

We use analytics cookies to better understand how users interact with our platform. These cookies collect anonymized usage statistics and performance metrics including pages visited, features used, session duration, and general navigation patterns. This helps us improve our services and user experience. This data is anonymized and aggregated, and we do not and cannot use it to identify individual users.

You can control cookies through your browser settings, though disabling essential cookies may impact the functionality of the platform or your user experience.

Who we share your information with

Your information will never be sold or rented to third parties for marketing purposes without your explicit consent. We may share your information with the following entities:

Other users of the platform

• Curators of fitting playlists: When you purchase a marketing campaign, the curators whose vetted playlists match your criteria see the track and your artist name as part of the campaign opportunity. They do not see your contact details, your payment details, or the price you paid.
• Artists whose campaign is activated: When a curator accepts a campaign opportunity, the artist is shown which playlist accepted the campaign and that playlist's quality score. They do not see the curator's contact or payout details.
• Playlist placement records: If our daily crawl finds the track on a curator's playlist, the artist is told, and the placement record, including position, is visible to both sides.

Published on our partner site

Every campaign's promotional content is a blog post about the track, published on our partner site under the curator's name. The post, the track, the artist name, and the curator's name are public and may be indexed by search engines.

Third-party service providers

We share your information with trusted third-party service providers who assist us in operating our platform:

• Payment processors: We use secure, PCI-DSS compliant payment processing services to handle artist payments, refunds, and curator payouts. These services collect and store payment and payout information in accordance with industry standards and their own privacy policies. We do not have access to your full payment card or bank details.

• Hosting and database providers: Our database, authentication, and file storage run on infrastructure hosted in the EU.

• Email service providers: We use third-party email services to send transactional emails such as account confirmations, password resets, receipts, and the notifications that accompany every step of a marketing campaign. These services process your email address and name for the purpose of delivering these communications.

• Analytics and error tracking providers: We use analytics and error tracking services to analyze usage, monitor performance, and diagnose failures. These services may collect anonymized usage data and technical diagnostics as described in their respective privacy policies.

These service providers are contractually obligated to keep your information confidential and only use it for the purposes specified by us. They are not permitted to use your personal information for their own purposes.

Legal and regulatory disclosures

• Legal authorities: We may disclose your information when required by law, to comply with legal processes, or to respond to valid requests by public authorities, including law enforcement agencies and regulatory bodies.

Business transfers

• Business transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred as part of that business transaction. We will notify you of any such change in ownership or control of your personal information.

Communications

We send two types of communications:

Transactional communications

We send transactional emails that are necessary for the operation of our platform and your account, including:

• Account verification and confirmation emails
• Password reset requests
• Payment receipts, refunds, and payout confirmations
• Updates at every step of a marketing campaign, such as quality review decisions, campaign activation, feedback delivered, promotional content published, playlist placement, and campaign completion or termination
• Curator application decisions, quality score warnings, and quarantine or relisting notices
• Important account updates and security notifications

You cannot opt out of transactional communications as they are essential for using our platform.

Marketing communications

We may send marketing emails or other promotional communications to users who have explicitly opted in to receive them. Marketing communications may include:

• Newsletters and updates about new features
• Promotional offers and special events
• Tips and guidance for artists and curators

Opt in: You can opt in to receive marketing communications through your account settings or during account creation.

Opt out: You can opt out of marketing communications at any time by:

• Clicking the unsubscribe link in any marketing email
• Updating your preferences in your account settings
• Contacting us at hello@soundmango.com

Even if you opt out of marketing communications, you will continue to receive transactional emails related to your account.

Your rights

Under applicable data protection laws, including the GDPR, you have the following rights regarding your personal information:

• Right to access: You have the right to request access to the personal information we hold about you, including details about how we use it and who we share it with.

• Right to rectification: You have the right to request correction of inaccurate or incomplete personal information. You can update much of your information directly through your account settings.

• Right to erasure (right to be forgotten): You have the right to request deletion of your personal information. You can request account deletion at any time by contacting us at hello@soundmango.com. We will delete your data promptly, except where we are legally required to retain it (such as financial records for tax purposes).

• Right to restrict processing: You have the right to request that we restrict the processing of your personal information in certain circumstances, such as when you contest the accuracy of the data or object to processing.

• Right to data portability: You have the right to receive your personal information in a structured, commonly used, and machine-readable format, and to transmit that information to another service provider where technically feasible.

• Right to object: You have the right to object to processing of your personal information based on legitimate interests, including direct marketing. You can object to marketing communications by opting out as described in the Marketing communications section.

• Right to withdraw consent: Where we process your personal information based on consent, you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing that occurred before the withdrawal.

Exercising your rights

To exercise any of these rights, please contact us at hello@soundmango.com with details of your request. We will respond to your request within one month, though this period may be extended by up to two additional months for complex requests. We may need to verify your identity before processing your request.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

Data retention

We will retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including:

• Active accounts: We retain your information while your account is active and for a reasonable period afterward to allow you to reactivate your account if desired.

• Campaign records: We retain the record of every campaign, match, and placement, along with the underlying data completion was based on, for as long as it may be needed to answer a question about a transaction.

• User-requested deletion: If you request deletion of your account and personal information, we will promptly delete all data we are not legally required to retain. Some data may be retained for legal compliance purposes (such as financial transaction records for tax and accounting requirements) for as long as we are legally allowed to retain it.

• Anonymized data: We may retain anonymized and aggregated data indefinitely for analytics and service improvement purposes, as this data cannot be used to identify you. Playlist and placement data is retained on this basis.

• Legal requirements: We may retain certain information for longer periods when required by law, such as:

  • Financial and transaction records for accounting and tax purposes
  • Records required for legal proceedings or regulatory compliance
  • Information necessary to resolve disputes or enforce agreements

After the retention period expires, we will securely delete or anonymize your personal information in accordance with our data deletion procedures.

Data security

We are committed to securing your information and have implemented both technical and organizational measures to protect the data we store:

• Encryption: We use encryption protocols (TLS/SSL) to protect data both in transit and at rest, ensuring that unauthorized parties cannot access your information during transmission or while stored.

• Secure storage: Your data and uploaded files are stored securely on our infrastructure in the EU using industry-standard security measures.

• Secure access controls: Access to personal data is restricted to authorized staff members only, based on their role and necessity. We implement the principle of least privilege, ensuring staff only have access to data necessary for their job functions.

• Regular security audits: We conduct regular security audits and vulnerability assessments to identify and address potential threats and weaknesses in our systems.

• System monitoring: We actively monitor our systems for security incidents and unauthorized access attempts.

• Regular updates: We keep our systems and software up to date with security patches and updates.

• Incident response: We have procedures in place to respond to security incidents and data breaches in accordance with applicable law.

While we implement robust security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your information to the best of our ability and notifying you immediately in the event of any security incident that may affect your personal information.

Data breach notification

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant data protection authority without undue delay, and in any event within 72 hours of becoming aware of the breach, where feasible.

Our breach notification will include:

• A description of the nature of the breach
• The categories and approximate number of individuals affected
• The likely consequences of the breach
• The measures we are taking or propose to take to address the breach
• Recommendations for steps you can take to protect yourself

We maintain incident response procedures to detect, investigate, and respond to security incidents promptly and in accordance with applicable data protection laws.

Age requirement

Our platform involves payments and payouts and is not intended for anyone under the age of 18. We do not knowingly collect personal information from children.

If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at hello@soundmango.com, and we will take steps to delete such information.

We do not verify the age of users during account creation. If we become aware that we have collected personal information from a child, we will take steps to delete that information as soon as possible.

Contact information

If you have any questions about this privacy policy, how we handle your personal data, or if you wish to exercise your rights under data protection laws, please contact us:

Email: hello@soundmango.com

When contacting us about privacy matters, please include:

• Your name and email address associated with your account
• A clear description of your request or question
• Any relevant account information to help us process your request

We aim to respond to privacy-related inquiries within one month. For complex requests, we may extend this period by up to two additional months, and we will inform you of any such extension.

While we do not have a designated Data Protection Officer (DPO), our support team handles all privacy-related requests and inquiries.

Complaints

If you have concerns about how we handle your personal data, we encourage you to contact us first at hello@soundmango.com. We will address your concerns promptly and aim to resolve the issue in accordance with applicable data protection laws.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

We are committed to working with data protection authorities to resolve any complaints and ensure compliance with applicable privacy laws.