Privacy Policy

We're committed to ensuring your privacy by handling your information with transparency and care. This page outlines how we collect, store, and protect your data.

Last updated November 3, 2026

Introduction

This privacy policy explains how Soundmango ApS (CVR 46797469, Norddigesvej 4, 8240 Risskov, Denmark) and its affiliated entities ("we," "us," or "our") collect, use, store, and protect the personal information of our users.

Soundmango is a playlist promotion platform. Artists submit a track, choose criteria, and buy a marketing campaign; curators apply with their playlists, listen to tracks, and deliver campaigns while considering each track for their playlist at their own discretion. This policy covers both roles, as well as visitors to our website.

We reserve the right to update this privacy policy at any time without prior notice. It is your responsibility to regularly review this privacy policy. Continued use of our services after any changes constitute a consent to the new version of the privacy policy.

Legal basis for processing

Under the General Data Protection Regulation (GDPR) and other applicable data protection laws, we process your personal information based on the following legal bases:

Contract performance: We process account, campaign, match, curator-decision, payment, and payout information to fulfill our contractual obligations to you when you purchase a marketing campaign, accept a campaign opportunity, or receive a payout.
Legitimate interests: We process personal data based on our legitimate interests in operating and improving the platform, matching tracks with curators, recording playlist placements observed by our daily crawl, scoring playlist quality, preventing fraud and abuse, ensuring security, and communicating with you about your account and transactions.
Consent: We process marketing communications, analytics and marketing cookies, and certain optional features based on your explicit consent, which you may withdraw at any time.
Legal obligations: We may process and retain certain information to comply with legal obligations, such as tax, accounting, and anti-money-laundering requirements.

Information we collect

We collect the following types of personal information:

Account information

Your name: We collect your first and last name when you create an account.
Your email address: We collect your email address during account creation to facilitate login and important communications.
Authentication data: We store a hashed password, or, if you sign up with Google, the account identifier and basic profile details Google returns. We never receive your password for a third-party account.
Profile photo: We may store a profile photo for your account and display it on your profile, where other users you transact with can see it.
Role: We store whether you use the platform as an artist, a curator, or both.
Newsletter preferences: If you opt in to receive marketing communications, we store your preference for receiving newsletters and promotional emails.

Artist information

Artist name: The name you release music under.
Track details: The track you submit for quality review, matching, and marketing, including the details we read from the streaming platform, such as title, artwork, and release date.
Campaign details: The criteria and price of every marketing campaign you purchase, and the matches, campaign opportunities, and curator that follow from it.

Curator information

Playlist links and details: The playlists you apply with and the ownership check we run against them.
Curator name: The name published as the author of a campaign's promotional content on our partner site. That name and the post are public.
Feedback: The written feedback you give on a track as part of a campaign. It belongs to the artist, and we retain it so they can read it.
Campaign opportunity decisions: Which campaign opportunities you accept or decline, and which tracks you add to your playlists.
Payout details: The bank account and tax details required to pay out your earnings. These are collected and stored by our payment processor, not on our servers.

Payment and billing information

Billing information: We use Stripe to process payments securely. Stripe collects and stores your payment information, and we do not retain any payment information on our servers. We may retain billing addresses and transaction records for accounting and legal purposes.
Transaction records: We retain the record of every campaign payment, held balance, refund, earnings, and payout, including amounts, dates, and status.

Playlist and placement data

To run the platform, we record publicly available playlist and track data from streaming platforms through our daily crawl, including the playlist snapshots and the placement records built from them. Where that data relates to a playlist or track you own, it is covered by this policy.

Streaming platform connections

If you connect a streaming platform account to your Soundmango account, we store the connection and the access credentials that platform issues to us, and we read the data the connection permits. A connection is always linked to your existing Soundmango account and never creates a second one. You can disconnect at any time.

Uploaded content

We collect and store the files you upload to the platform. Files are stored securely on our infrastructure in the EU.

Support communications

When you contact us, we keep your message and our correspondence so we can answer it and refer back to it.

Usage and technical data

Device and activity data: We may collect information about the device you use to access our platform, including IP address, browser type, operating system, and device identifiers, for security reasons and performance optimization.
Error reports: When something goes wrong, our error tracking captures the technical context of the failure, which may include your account identifier and the page you were on.

Cookies and tracking technologies

We use cookies and similar technologies, such as your browser's local storage, to operate our platform, understand how it is used, and measure our advertising. We group them by purpose.

Your choice

If you visit from the EU, the EEA, or the UK, we ask before we store anything on your device that is not essential, or read anything from it. Our cookie banner lets you accept or reject analytics and marketing separately, and nothing in either category runs until you accept it. We keep your answer, the date you gave it, and the version of the banner you answered in your browser, and ask again after a year or when we add a new purpose or partner.

If you visit from anywhere else, analytics and marketing are on by default.

Wherever you are, you can change your choice at any time through Cookie settings at the bottom of our website. Withdrawing consent stops further use of the technologies concerned, and we delete the marketing cookies already set on our domain.

Essential

These are necessary for the platform to function and are always on:

Session cookies: Used to maintain your login session and authentication state.
Security cookies: Used to protect against security threats and ensure platform integrity.
Error reports: If something on a page breaks, our analytics provider receives a report of the error with the page it happened on and your browser and device type, so we can fix it. Before you accept analytics, nothing is stored on your device to send them. We do this based on our legitimate interest in keeping the platform working. This data is processed in the EU.
Your cookie choices, kept in your browser's local storage.

Analytics

With your consent, our analytics stores an identifier in a cookie and your browser's local storage. It lets us recognize your browser across visits and see which pages you visit, what you click, and where something gets in the way, including recordings of how pages are used. If you give us your email address, for example in a form, we link it to this identifier. This data is processed in the EU.

Whatever you choose, when you submit a form on our website, such as starting a campaign or applying with a playlist, our server records the submission in our analytics together with the email address you gave. Nothing is read from or stored on your device for this. We do this based on our legitimate interest in running and improving the platform.

Marketing

With your consent, Google Ads and Meta (Facebook and Instagram) load on our website. They set cookies that tell us which of our ads brought you here and whether you went on to sign up or start a campaign. Meta's pixel also records the buttons you click and details about the page, such as its title, to measure and improve our ads. Google and Meta process this data under their own privacy policies and may use it to measure and improve the ads they show.

If you reject marketing, neither Google Ads nor Meta loads, and nothing is sent to them.

The cookies and storage we use

cookie-consent and cookie-consent-analytics (Soundmango, local storage): your cookie choices. Kept for a year.
cookie-consent-required (Soundmango, session storage): whether we need to ask for your consent where you are. Deleted when you close your browser.
demo_campaign (Soundmango, cookie): the marketing campaign you started. Deleted when you close your browser.
theme (Soundmango, local storage): your light or dark theme, if you choose one.
smartlink_pref (Soundmango, cookie): the streaming platform you last chose on a smartlink, so it comes first next time. Set only when you tap a platform. One year.
ph_* (Soundmango, cookie and local storage): analytics identifier. One year.
_gcl_au and _gcl_aw (Google Ads, cookies): which ad brought you here. 90 days.
_fbp and _fbc (Meta, cookies): which ad brought you here. 90 days.

Google and Meta may also set cookies on their own domains, as described in their privacy policies.

You can also block or delete cookies through your browser settings, though blocking essential cookies may stop parts of the platform from working.

Smartlinks

Artists and curators can create smartlinks: public pages at soundmango.com/s/ that send fans to a release or a playlist on the streaming platform they prefer. Each account also gets a public bio page at soundmango.com/@ followed by its handle. The name, handle, and smartlinks shown on these pages are public.

What fan pages record

When you open a smartlink, we record the view. When you tap a platform button, we record the click and the platform you chose. With each, we store:

Approximate location: the country, region, city, postal code, coordinates, and time zone your IP address points to.
Device: the type of device (mobile, tablet, or desktop), its maker and model, its operating system and version, and the browser or app you opened the link in, with its version.
Language: the first language your browser asks websites for.
Referring site: the website that sent you to the page, if any, or the path of the Soundmango page you came from.
Campaign tags: the UTM source, medium, campaign, term, and content in the link you followed, if any, and the name of any ad click parameter in it, such as fbclid, but never its value.
How you got there: which button you tapped by its place on the page, and whether the link took you straight to the platform without a tap.

We do not store your IP address or your browser's user agent. To count unique visitors, we combine them with a secret value that changes every day, and keep only a one-way hash of the result. We delete the secret value once its day has passed, and from then on the hash cannot be traced back to your IP address. Because the value changes every day, your visits on different days cannot be linked.

Fan pages load no third-party analytics or advertising trackers. The only cookie they set is smartlink_pref, a functional cookie that remembers the platform you last tapped so it comes first on the next smartlink you open.

We process this data based on our legitimate interest in giving artists and curators stats for the links they share, and in keeping smartlinks free of abuse. We keep these records without a set end date, so a link's owner keeps the full history of its stats.

Who sees it

The artist or curator who made a smartlink sees these records as stats for their own links in their dashboard: views, unique visitors, and clicks, with breakdowns by platform, location, referring site, device, and campaign tag. Our team can see all of these records, to moderate smartlinks, keep them free of abuse, and build new stats. The rest of what we record stays with our team, such as postal code, coordinates, language, device model, and browser. Other users and fans never see them.

Your information will never be sold or rented to third parties for marketing purposes without your explicit consent. We may share your information with the following entities:

Other users of the platform

Curators of fitting playlists: When you purchase a marketing campaign, the curators whose vetted playlists match your criteria see the track and your artist name as part of the campaign opportunity. They do not see your contact details, your payment details, or the price you paid.
Artists whose campaign is activated: When a curator accepts a campaign opportunity, the artist is shown which playlist accepted the campaign and that playlist's quality score. They do not see the curator's contact or payout details.
Playlist placement records: If our daily crawl finds the track on a curator's playlist, the artist is told, and the placement record, including position, is visible to both sides.

Published on our partner site

Every campaign's promotional content is a blog post about the track, published on our partner site under the curator's name. The post, the track, the artist name, and the curator's name are public and may be indexed by search engines.

Third-party service providers

We share your information with trusted third-party service providers who assist us in operating our platform:

Payment processors: We use secure, PCI-DSS compliant payment processing services to handle artist payments, refunds, and curator payouts. These services collect and store payment and payout information in accordance with industry standards and their own privacy policies. We do not have access to your full payment card or bank details.
Hosting and database providers: Our database, authentication, and file storage run on infrastructure hosted in the EU.
Email service providers: We use third-party email services to send transactional emails such as account confirmations, password resets, receipts, and the notifications that accompany every step of a marketing campaign. These services process your email address and name for the purpose of delivering these communications.
Analytics and error tracking providers: We use analytics and error tracking services to analyze usage, monitor performance, and diagnose failures. These services collect usage data and technical diagnostics as described in the Cookies and tracking technologies section and in their respective privacy policies. These service providers are contractually obligated to keep your information confidential and only use it for the purposes specified by us. They are not permitted to use your personal information for their own purposes.

Advertising partners

With your consent to marketing cookies, Google and Meta receive data about visits and sign-ups that came from our ads, as described in the Cookies and tracking technologies section. They act as independent controllers of that data under their own privacy policies.

Legal and regulatory disclosures

Legal authorities: We may disclose your information when required by law, to comply with legal processes, or to respond to valid requests by public authorities, including law enforcement agencies and regulatory bodies.

Business transfers

Prospective buyers and their advisors: If we consider a merger, acquisition, financing, or sale of all or part of our business or assets, we may share information, including personal information, with the other party and their advisors. We limit this to what they need to evaluate the transaction and share it under confidentiality obligations.
A successor: If a merger, acquisition, or sale of all or part of our business or assets goes ahead, your personal information, together with your account, content, and campaign records, may be transferred to the acquiring company as part of it. The acquiring company may use it for the purposes in this policy, and must handle it under this policy or under one that protects you at least as well. Your consents and cookie choices carry over. We will notify you of the change by email or a notice on the platform, and if the acquiring company is outside the EU and the EEA, we will make sure the safeguards the law requires for that transfer are in place.

Communications

We send two types of communications:

Transactional communications

We send transactional emails that are necessary for the operation of our platform and your account, including:

Account verification and confirmation emails
Password reset requests
Payment receipts, refunds, and payout confirmations
Updates at every step of a marketing campaign, such as quality review decisions, campaign activation, feedback delivered, promotional content published, playlist placement, and campaign completion or termination
Curator application decisions, quality score warnings, and quarantine or relisting notices
Important account updates and security notifications

You cannot opt out of transactional communications as they are essential for using our platform.

Marketing communications

We may send marketing emails or other promotional communications to users who have explicitly opted in to receive them. Marketing communications may include:

Newsletters and updates about new features
Promotional offers and special events
Tips and guidance for artists and curators

Opt in: You can opt in to receive marketing communications through your account settings, during account creation, or by giving us your email address in a sign-up form on our website, such as the one for hearing about new tools. People who were on the Backstaged playlist marketplace waitlist could also join our waitlist by confirming on our website through a link Backstaged emailed them. We only hold the details of those who confirmed.

Opt out: You can opt out of marketing communications at any time by:

Clicking the unsubscribe link in any marketing email
Updating your preferences in your account settings
Contacting us at hello@soundmango.com

Even if you opt out of marketing communications, you will continue to receive transactional emails related to your account.

Your rights

Under applicable data protection laws, including the GDPR, you have the following rights regarding your personal information:

Right to access: You have the right to request access to the personal information we hold about you, including details about how we use it and who we share it with.
Right to rectification: You have the right to request correction of inaccurate or incomplete personal information. You can update much of your information directly through your account settings.
Right to erasure (right to be forgotten): You have the right to request deletion of your personal information. You can request account deletion at any time by contacting us at hello@soundmango.com. We will delete your data promptly, except where we are legally required to retain it (such as financial records for tax purposes).
Right to restrict processing: You have the right to request that we restrict the processing of your personal information in certain circumstances, such as when you contest the accuracy of the data or object to processing.
Right to data portability: You have the right to receive your personal information in a structured, commonly used, and machine-readable format, and to transmit that information to another service provider where technically feasible.
Right to object: You have the right to object to processing of your personal information based on legitimate interests, including direct marketing. You can object to marketing communications by opting out as described in the Marketing communications section.
Right to withdraw consent: Where we process your personal information based on consent, you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing that occurred before the withdrawal.

Exercising your rights

To exercise any of these rights, please contact us at hello@soundmango.com with details of your request. We will respond to your request within one month, though this period may be extended by up to two additional months for complex requests. We may need to verify your identity before processing your request.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

Data retention

We will retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including:

Active accounts: We retain your information while your account is active and for a reasonable period afterward to allow you to reactivate your account if desired.
Campaign records: We retain the record of every campaign, match, and placement, along with the underlying data completion was based on, for as long as it may be needed to answer a question about a transaction.
User-requested deletion: If you request deletion of your account and personal information, we will promptly delete all data we are not legally required to retain. Some data may be retained for legal compliance purposes (such as financial transaction records for tax and accounting requirements) for as long as we are legally allowed to retain it.
Anonymized data: We may retain anonymized and aggregated data indefinitely for analytics and service improvement purposes, as this data cannot be used to identify you. Playlist and placement data is retained on this basis.
Legal requirements: We may retain certain information for longer periods when required by law, such as:
- Financial and transaction records for accounting and tax purposes
- Records required for legal proceedings or regulatory compliance
- Information necessary to resolve disputes or enforce agreements

After the retention period expires, we will securely delete or anonymize your personal information in accordance with our data deletion procedures.

Data security

We are committed to securing your information and have implemented both technical and organizational measures to protect the data we store:

Encryption: We use encryption protocols (TLS/SSL) to protect data both in transit and at rest, ensuring that unauthorized parties cannot access your information during transmission or while stored.
Secure storage: Your data and uploaded files are stored securely on our infrastructure in the EU using industry-standard security measures.
Secure access controls: Access to personal data is restricted to authorized staff members only, based on their role and necessity. We implement the principle of least privilege, ensuring staff only have access to data necessary for their job functions.
Regular security audits: We conduct regular security audits and vulnerability assessments to identify and address potential threats and weaknesses in our systems.
System monitoring: We actively monitor our systems for security incidents and unauthorized access attempts.
Regular updates: We keep our systems and software up to date with security patches and updates.
Incident response: We have procedures in place to respond to security incidents and data breaches in accordance with applicable law.

While we implement robust security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your information to the best of our ability and notifying you immediately in the event of any security incident that may affect your personal information.

Data breach notification

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant data protection authority without undue delay, and in any event within 72 hours of becoming aware of the breach, where feasible.

Our breach notification will include:

A description of the nature of the breach
The categories and approximate number of individuals affected
The likely consequences of the breach
The measures we are taking or propose to take to address the breach
Recommendations for steps you can take to protect yourself

We maintain incident response procedures to detect, investigate, and respond to security incidents promptly and in accordance with applicable data protection laws.

Age requirement

Our platform involves payments and payouts and is not intended for anyone under the age of 18. We do not knowingly collect personal information from children.

If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at hello@soundmango.com, and we will take steps to delete such information.

We do not verify the age of users during account creation. If we become aware that we have collected personal information from a child, we will take steps to delete that information as soon as possible.

Contact information

If you have any questions about this privacy policy, how we handle your personal data, or if you wish to exercise your rights under data protection laws, please contact us:

Email: hello@soundmango.com

When contacting us about privacy matters, please include:

Your name and email address associated with your account
A clear description of your request or question
Any relevant account information to help us process your request

We aim to respond to privacy-related inquiries within one month. For complex requests, we may extend this period by up to two additional months, and we will inform you of any such extension.

While we do not have a designated Data Protection Officer (DPO), our support team handles all privacy-related requests and inquiries.

Complaints

If you have concerns about how we handle your personal data, we encourage you to contact us first at hello@soundmango.com. We will address your concerns promptly and aim to resolve the issue in accordance with applicable data protection laws.