Privacy policy

PlaylistPulse, Kilian Kramer, Friesischer Bogen 17, 24983 Handewitt, Germany. Email: support@playlistpulse.io.

We are the data controller for the processing described here, with one exception: the landing pages that our customers (curators and labels) publish through PlaylistPulse. For the visitor data collected on those pages the customer is the controller and we act as their processor (see section 6).

Account data. Email address, name, password (stored hashed by our authentication provider), the username that forms your landing page addresses, your plan and subscription status.

Spotify data. For every playlist you track we store its Spotify ID, name, cover, owner name and the daily follower and track counts we retrieve from the Spotify Web API. For your own playlists we store the ID and name of the Spotify profile that owns them, and, if you connect your Spotify account, an encrypted refresh token. We only read public playlist data; we do not access your listening history. Playlists you track as external belong to other people; of those we process only what Spotify shows publicly.

Meta Ads data. If you connect your Meta ad account we store an access token for it, the ad account ID, and the campaign names and insights we import (spend, impressions, clicks, conversions, video views), plus the pixel ID you enter. The access is read-only.

Data you enter. Ad periods, budgets, notes, keywords you track, and the texts and settings of your landing pages.

Landing page data. When someone visits one of your landing pages we record the view and any click with the time, the country derived from the IP address, the referring page and UTM parameters, and a hashed IP address and browser signature used to filter bots. We do not store the raw IP address. If you have set a Meta pixel ID, your pixel fires in the visitor’s browser and we send the matching events to Meta’s Conversions API on your behalf; with Bot Block enabled, events from identified bots are not sent.

Payment data. Your Stripe customer and subscription IDs, plan, trial and billing status, and the billing name and country you provide at checkout. Card details go directly to Stripe; we never see or store them.

Usage data. Server logs with IP address, browser type, pages requested, time and date, referring page, and error diagnostics.

Contact form and beta requests. When you write to us through the contact form or ask for a beta invite, we store your name, email address, subject and message and, if you give them, your Spotify link and your role, together with the time and your IP address (to stop abuse of the form). Beta requests also go on our invite list at Brevo. If you accepted marketing cookies, a beta request is also reported to Meta as a sign-up (section 3, “Measuring our ads”).

Cookies and similar technologies. See section 8.

To run your account and the app (Art. 6(1)(b) GDPR, contract): registration, login, password resets, your dashboard, your settings.

To answer your messages and to send beta invites (Art. 6(1)(b) GDPR, steps before a contract, and Art. 6(1)(f), our interest in answering requests): the contact form and the beta list.

To track your playlists (Art. 6(1)(b) GDPR): daily snapshots of the playlists you connect. Public data about external playlists owned by others is processed on the basis of our and your legitimate interest in observing the market (Art. 6(1)(f) GDPR).

To sync your ads (Art. 6(1)(b) GDPR): importing spend and results from your Meta ad account to calculate cost per follower and campaign results.

To serve your landing pages (Art. 28 GDPR, on your instructions): collecting views and clicks, filtering bots and forwarding events to your pixel. Our own bot filtering and the protection of the service rest on our legitimate interest (Art. 6(1)(f) GDPR).

To bill you (Art. 6(1)(b) and (c) GDPR): processing subscriptions through Stripe, calculating VAT, keeping the records required by tax law.

Security and abuse prevention (Art. 6(1)(f) GDPR): server logs, rate limits, bot detection.

Transactional emails (Art. 6(1)(b) GDPR): registration and password emails, subscription and billing notices, sent through Brevo.

Legal obligations (Art. 6(1)(c) GDPR): retaining invoices and records, responding to lawful requests.

Aggregated statistics (Art. 6(1)(f) GDPR): we combine usage and performance data across all accounts into anonymised, aggregated statistics, for example average cost per follower by genre, to improve the product and to publish benchmarks and reports. The statistics never identify a customer, a playlist, a campaign or an ad account.

Website analytics (Art. 6(1)(a) GDPR): only if you accept in the cookie banner, we use Google Analytics on playlistpulse.io to see which pages are visited and where visitors come from. IP addresses are shortened by Google before storage. You can withdraw your choice at any time under “Cookie settings” in the footer. There is no analytics in the app.

Measuring our ads (Art. 6(1)(a) GDPR, § 25 (1) TDDDG): only if you accept marketing cookies in the banner, the Meta pixel runs on playlistpulse.io. It tells us whether our ads on Facebook and Instagram lead to visits and beta requests, and lets us show our ads to people who visited the site. When you request a beta invite, we report this sign-up to Meta twice, from your browser through the pixel and from our server through Meta’s Conversions API, with your email address and name hashed (SHA-256), your IP address, your browser type and the pixel’s cookie IDs; Meta matches the report to its users and counts it once. Meta Platforms Ireland Ltd. and we are joint controllers for the collection and transfer (Art. 26 GDPR); Meta is responsible for the processing after that. You can withdraw your consent at any time under “Cookie settings” in the footer; the pixel then stops and its cookies are deleted. The app itself runs no advertising tracker.

Product news: occasional emails about new features and tips. We send them if you tick the box at sign-up (Art. 6(1)(a) GDPR) or, once you are a paying customer, for our own similar services under § 7 (3) UWG (Art. 6(1)(f) GDPR). Every email has an unsubscribe link, and you can object at any time without any cost beyond the basic transmission rates. Service emails about your account and billing (section “Transactional emails”) are sent regardless.

We use the following providers, each bound by a data processing agreement:

• Supabase (Supabase Inc.): database, authentication, file storage and server functions. Our project is hosted in the European Union (AWS eu-west-1, Ireland).
• Vercel (Vercel Inc.): hosting and delivery of the website and the app; our server functions run in Frankfurt, Germany. Vercel processes request logs (IP address, user agent) to deliver and secure the site.
• Brevo (Sendinblue SAS, Paris, France): delivery of our transactional emails, such as sign-up confirmations and password resets, our product emails and the beta invite list. Brevo processes your email address and delivery data (sent, delivered, bounced) in the European Union.
• Stripe (Stripe Payments Europe, Ltd.): subscription billing and invoicing. Stripe is an independent controller for the payment data it collects; see stripe.com/privacy.
• Google Analytics (Google Ireland Ltd.): website analytics on playlistpulse.io, only with your consent (section 8). Google may transfer data to the USA; see policies.google.com/privacy.
• Spotify (Spotify AB, Sweden): we retrieve public playlist data through the Spotify Web API. If you connect your Spotify account, Spotify’s terms and privacy policy apply to that connection; see spotify.com/legal/privacy-policy.
• Meta (Meta Platforms Ireland Ltd.): we read your ad account’s insights through the Marketing API on your behalf, and we send landing page events to the Conversions API of the pixel you configured. For our own advertising, the Meta pixel and the Conversions API on playlistpulse.io, only with your consent (section 3, “Measuring our ads”, and section 8). Data may be transferred to the USA under the EU–US Data Privacy Framework; see facebook.com/privacy/policy.

We do not sell personal data. Inside the product, the figures of a landing page (views, clicks, country, source) are shown to the customer who owns the page, never with raw IP addresses. Public data about external playlists is shown to the customer who tracks them. We disclose data to authorities only where required by law, and to advisers or successors in the event of a business transfer, in which case this policy continues to apply.

If you arrived here from a playlist landing page: that page is published by a PlaylistPulse customer, who decides which data is collected and whether a Meta pixel runs on it. The customer is the controller for that data and is responsible for any consent the pixel requires; PlaylistPulse processes the data on the customer’s behalf as described in section 2. You can contact the customer through their page or write to support@playlistpulse.io, and we will forward your request.

Our systems run in the European Union. Where a provider processes data outside the EU/EEA (Meta, Google, Stripe’s US entities), transfers rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

Necessary, no consent needed: your login session (kept by our authentication provider in your browser’s storage), a flag cookie on playlistpulse.io that tells the website you are signed in to the app, your cookie choice itself, and preferences such as whether you completed the welcome tour.

Analytics, only with consent: if you accept in the banner on playlistpulse.io, Google Analytics sets the cookies _ga and_ga_* (up to 13 months) to tell visits apart. Nothing is loaded before you accept. Decline, or change your mind later under “Cookie settings” in the footer, and no analytics cookie is set.

Marketing, only with consent: if you accept marketing cookies on playlistpulse.io, the Meta pixel sets the cookies _fbp(90 days) and, when you arrive from an ad, _fbc (90 days), and loads Meta’s script from connect.facebook.net. Nothing is loaded before you accept; withdraw your consent under “Cookie settings” and the pixel stops and both cookies are deleted.

On landing pages with a connected Meta pixel, Meta may set its own cookies in the visitor’s browser; the customer who published the page is responsible for that (section 6).

• Account data: until you delete your account, then removed within 30 days unless we must keep parts for legal reasons.
• Playlist snapshots, ad data, keywords and landing page settings: for the life of your account, deleted with it.
• Spotify and Meta tokens: until you disconnect the service or delete your account.
• Landing page events: up to 24 months, pseudonymous.
• Invoices and subscription records: 10 years (German commercial and tax law), then deleted.
• Server logs: up to 30 days.
• Contact messages and beta requests: 12 months after our last exchange, or earlier on request.

You have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to processing, to receive it in a portable format, and to withdraw any consent at any time with effect for the future. Most account data can be changed by you under Settings. For everything else write to support@playlistpulse.io; we may ask you to verify your identity.

You may lodge a complaint with a supervisory authority, in particular the one responsible for us: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, datenschutzzentrum.de.

You can have your data removed at any time:

• Meta access only. In Facebook go to Settings & privacy → Settings → Business integrations, select PlaylistPulse and remove it. Our access token stops working immediately; we then delete the token and the stored campaign data of that ad account within 30 days.
• Your whole account. Write to support@playlistpulse.io from the email address of your account and ask us to delete it. We delete your account, your playlists, snapshots, ad and campaign data, landing pages and tokens within 30 days and confirm by email. Invoices we must keep by law (section 9) are the only exception.

Data is transmitted over TLS and stored in encrypted databases and buckets. Access is restricted per account by row-level security; Spotify and Meta tokens are encrypted at rest. No method of transmission or storage is completely secure, so please use a strong, unique password.

PlaylistPulse is not directed at children under 16. We do not knowingly collect personal data from anyone under 16; if you believe a child has provided us with data, contact us and we will delete it.

Our pages link to other websites (Spotify, Meta and others). Their privacy practices are their own; please review them.

We update this policy when our processing changes and show the date of the last update at the top. Material changes are announced on the site or by email before they take effect.

support@playlistpulse.io