Privacy Policy

• Account and identity: email, role, password hash, email-verification status, country, sessions, and security events.
• Profile: name, display name, biography, birthday day and month if provided, avatar, professional details, linked artist or curator identity, and policy on AI use in submitted tracks.
• Music and curation: Spotify links and identifiers, track and playlist metadata, genres, campaign selections, submissions, feedback, acceptance or rejection, placements, ratings, and public profile activity.
• Transactions: Drop balances and ledger entries, package and coupon use, amounts, billing details, Stripe customer and transaction references, payout recipient references, quotes, fees and status, refunds, disputes, and tax information you provide.
• Communications: support conversations, notices, transactional messages, newsletter choices and email verification, and referral activity.
• Device and usage: IP address, IP-derived country, browser User-Agent, request and security logs, cookie or preference identifiers, consent history, page and feature events, and referral URLs.

Stripe handles purchase payment credentials. Wise processes bank details and curator withdrawals under its own privacy notice. We transmit the bank details you enter to Wise and retain the recipient reference, account-holder name, currency and masked account details, together with financial records. We do not retain full bank account numbers in our payout database or browser storage. Squeeze My Music does not store full payment-card numbers. Passwords are stored only in hashed form. A password breach check sends only a partial cryptographic hash prefix to Have I Been Pwned; it does not send your password or full password hash.

We receive information from you, your use of the Platform, other users interacting with you, payment and support providers, and public or licensed Spotify data. We derive limited information, such as account status, campaign totals, playlist compliance, fraud signals, and an approximate country from your IP address. IP geolocation is performed against a locally hosted IPinfo database rather than by sending each visitor’s IP address to IPinfo.

IP geolocation data is provided by IPinfo, licensed under CC BY-SA 4.0.

Registration, login, and password recovery use Google reCAPTCHA to assess the risk of automated abuse. The browser connects to Google and sends device and browser information, your IP address, and a verification token; our server sends the token, IP address, and browser User-Agent to Google for an assessment. We use the result to decide whether to accept the request. Google processes this information for us to provide the security check.

• create and authenticate accounts, maintain sessions, and provide artist and curator features;
• process purchases, reserve and return Drops, administer reviews, verify playlist commitments, make payouts, issue transaction records, and resolve disputes;
• display public profiles, playlist details, accepted tracks, ratings, and attributed comments;
• detect abuse, credential compromise, artificial activity, sanctions risk, payment fraud, and violations of our Terms;
• send service, security, submission, payout, legal, support, and opted-in newsletter communications;
• operate referrals and promotions, measure Platform performance, troubleshoot, and improve our services;
• measure advertising and attribute conversions when permitted by your choice and applicable law; and
• comply with tax, accounting, sanctions, law-enforcement, and other legal obligations.

Where a law such as the EEA or UK GDPR requires a legal basis, we rely on: performance of our contract to provide the Platform; legitimate interests in securing, operating, improving, and promoting a B2B service, balanced against your rights; compliance with legal obligations; and consent for newsletters, advertising technologies, or other uses where consent is required. We may process information to establish, exercise, or defend legal claims and, in an emergency, to protect vital interests.

You may withdraw consent at any time without affecting earlier lawful processing. You may object to legitimate-interest processing; we will stop unless we demonstrate overriding grounds or need the information for legal claims.

Curator profiles and approved playlists are public and may include names, images, biographies, service information, selected metrics, accepted tracks, ratings, and attributed artist comments. Artists and curators also receive the information needed to complete a submission. Public information may be indexed, copied, or retained by third parties outside our control. Do not include private or sensitive information in public fields or feedback.

Stripe receives information necessary to create customers, display checkout, process and reconcile purchases, and address fraud or disputes. For withdrawals, Wise receives the account-holder name, bank and country details, currency, amount, payment reference and information required for the supported route. We retain quotes, fees, exchange rates, provider references, status observations and limited webhook records to account for and reconcile withdrawals. Stripe and Wise may act as independent controllers for their legal, fraud and network obligations. We may use and disclose identity, tax, country, transaction, and account-risk information to verify professional eligibility, prevent prohibited payments, and comply with sanctions or financial laws.

When allowed, Meta Pixel in the browser and Meta Conversions API from our servers measure page views and whether advertising leads to registration, activation, checkout activity, adding payment information, or purchases. Depending on the event, Meta may receive event time and URL, value and currency, IP address, User-Agent, Meta browser identifiers, and hashed identifiers such as email or Squeeze My Music user ID. Event URLs may include public referral codes used to identify the source of a visit. We do not send submission content, feedback, curator selections, music preferences, internal referral or reward records, or newsletter membership to Meta as advertising event content.

Squeeze My Music does not sell personal information for money. Disclosure to Meta may be treated as “sharing,” “targeted advertising,” or a “sale” under some US privacy laws. Where those laws apply, you may opt out through Your Privacy Choices or an enabled Global Privacy Control signal. See the Cookie Policy for regional defaults and browser storage.

We disclose information only as reasonably necessary to:

• Platform participants and the public: operate submissions, profiles, ratings, and placements as described above;
• service providers: use Stripe, Wise, Brevo, Meta, Google reCAPTCHA, IPinfo, Spotify-related services, file storage, hosting, email, observability, and self-hosted Chatwoot support;
• professional advisers and authorities: comply with law, enforce agreements, protect rights and safety, or establish and defend claims;
• business successors: evaluate or complete a financing, merger, reorganization, acquisition, or sale, subject to appropriate confidentiality; and
• others at your direction: complete an integration or disclosure you request.

Service providers are authorized to process information for their contracted functions. Some third parties, including payment networks, Stripe, Wise, Spotify, and Meta, also determine their own processing under their privacy notices.

Spotify players load automatically for the selected track when reviewing a submission or preparing a campaign, without starting audio. On public curator profiles, they load when you choose content to play. Loading sends your IP address, browser and device information, and the requested content identifier to Spotify even before playback. Spotify may use cookies and process information for its own purposes under its Privacy Policy. See our Cookie Policy for the loading behaviour and available controls.

Service and transactional messages are necessary to administer your account and cannot be opted out of while the relevant service continues. Newsletters require your optional sign-up and a verified account email. Newsletter unsubscribe and tracking-withdrawal links remain available without signing in or accepting updated Platform terms. Account controls require access to the Platform, including acceptance of its current required terms. If you provide your birthday day and month, we may use them for birthday marketing only while you are subscribed; we do not collect your birth year for this purpose. Brevo processes contact details, role, country, available profile fields, and list status to deliver and manage these communications.

Newsletter statistics linked to your email address are optional and require a separate choice from subscribing. If you allow them, Brevo uses tracking pixels and tracked links to record newsletter openings and link clicks, which may be associated with your email address. We use these records to compare campaign performance and improve our newsletters, not to personalize messages or build individual marketing profiles. You can subscribe without individual tracking or withdraw this permission in Account > Email preferences or through the tracking withdrawal link in our newsletters while keeping your subscription. Withdrawals made through our email provider are reflected in your account once processed. Unsubscribing also withdraws permission for individual newsletter statistics. This choice does not authorize individual tracking of service or security emails.

Turning off individual tracking does not necessarily remove all email statistics. Our email provider may still report anonymous, aggregate totals, including anonymized openings of service and transactional emails. These totals do not identify you in the reports we receive. We may use them to assess overall email performance. Delivery, bounce, and unsubscribe records are also processed to operate the email service and respect your preferences.

Automated rules help reconcile payments, detect suspicious activity, apply privacy choices, expire unanswered submissions, and verify whether an accepted track remains on a public playlist. A rule may return Drops or temporarily restrict an account. You may contact support for human review of an action you believe is incorrect. We do not use personal information to make solely automated decisions that produce legal or similarly significant effects where prohibited by applicable law.

Squeeze My Music operates from the United States, and providers may process information in the United States and other countries whose laws may differ from yours. Where a restricted transfer requires a legal mechanism, we use an available lawful safeguard appropriate to the provider and transfer, such as an adequacy decision, approved contractual clauses, or a recognized certification framework. You may contact us for information about the safeguard relevant to you.

We keep personal information only as long as reasonably necessary for the purposes above, considering account status, ongoing submissions or placements, payment and payout reconciliation, contractual and statutory limitation periods, tax and accounting rules, fraud prevention, consent evidence, disputes, and legal holds. Authentication sessions are scheduled for deletion after they have been expired or revoked for 90 days.

Public profile data is generally kept while the profile is active. Transaction, ledger, tax, consent, enforcement, and support records may be retained after closure where needed for the purposes above. Deletion from active systems may not immediately remove encrypted backups; backup copies are isolated and expire under our backup cycle. We delete or anonymize information when no longer required.

We use measures designed for the nature of the information, including access controls, password hashing, breach screening, transport encryption, secure and HttpOnly cookies, anti-forgery controls, rate limits, signed payment webhooks, restricted administration, and logging. No system is completely secure. Protect your credentials and contact us immediately if you suspect misuse.

Depending on your location, you may ask us to confirm processing and provide access; correct inaccurate information; delete information; restrict or object to processing; provide portable information; opt out of targeted advertising, sale, or sharing; withdraw consent; or appeal a denied request. You may also request account closure. We will not discriminate against you for exercising a privacy right, although some information is necessary to provide the Platform.

Account closure, deletion and data-export requests are handled manually by our support team. Submit a request to support@squeezemymusic.com. We may verify your identity and authority, ask an authorized agent for proof, and retain a record of the request. We may deny or limit a request where an exemption applies and will explain available appeal or regulator options. You may also use Your Privacy Choices without an account for applicable advertising controls.

EEA and United Kingdom. You may complain to the data-protection authority where you live or work. You may also contact us first so we can try to resolve the issue.

Brazil. Subject to the LGPD, you may request confirmation, access, correction, anonymization, blocking or deletion, portability, information about sharing, consent information and withdrawal, and review where applicable. You may complain to the ANPD.

United States. The categories collected are listed in Section 1, the purposes in Section 3, and the recipients in Section 8. We do not use sensitive personal information to infer characteristics. Optional referral and newsletter promotions provide the disclosed Drop or price benefit in return for qualifying participation; the benefit’s value is the displayed reward and is reasonably related to customer acquisition and engagement. Participation can be declined or ended under the displayed promotion rules.

Canada. You may request access and correction and withdraw consent, subject to legal and contractual limits. Questions about our accountability may be sent to the contact below, and you may complain to the Office of the Privacy Commissioner of Canada or the applicable provincial regulator.

The Platform is not directed to anyone who has not reached the age of majority or lacks legal capacity to enter into a binding agreement where they reside. Contact us if you believe an ineligible person has provided information so we can investigate and take appropriate action.

We will publish material changes as a new dated version and provide any additional notice or consent required by law. Questions, complaints, and privacy requests may be sent to support@squeezemymusic.com or mailed to Squeeze My Music LLC at the address at the beginning of this Policy.

Artists may optionally provide a birthday day and month for our birthday promotion. We use this date, its qualification period, the account time zone, marketing subscription consent, and account eligibility to grant a personal annual coupon. We do not collect a birth year for this purpose. Promotional emails require an existing marketing subscription, and their delivery does not require permission for individual email statistics.

We retain records of the gift’s birthday year, celebration date, time zone, qualifying consent, coupon and email delivery to prevent duplicate awards, administer the promotion and support financial records. We do not track individual opens or clicks for birthday emails. A granted coupon remains usable until its expiry after marketing consent is withdrawn, subject to account restrictions.

Curators no longer provide or edit birthdays. Previously saved curator dates are retained as historical account data but are not used for the birthday program or exported again during profile synchronization. Historical copies already held by our email provider are not used by this program. Requests to remove historical data may be sent to support@squeezemymusic.com under the rights and retention provisions of this Policy.