Privacy Policy

Who we are

Intonality is operated by Intonality SIA, a company registered in Latvia. We are the data controller for the personal data described in this policy. You can reach us through the contact page.

This policy applies to intonality.com and to the emails we send. It explains what we collect, why, who we share it with, how long we keep it, and what you can ask us to do.

What we collect

Everyone who visits

• Technical data - IP address, browser and device type, the pages you open, the page that referred you, and timing data. Our servers and Cloudflare, which sits in front of them, record this for security and performance.
• Playlist page statistics - When you open one of our playlist pages or click through to Spotify from it, we record the visit or click together with your IP address, browser and referrer, so we can count unique visitors per playlist.
• Cookies and pixels - See the Cookie Policy for the full list, including the Google Ads, Meta and OpenAI advertising pixels.

Artists and account holders

• Account - Name, email address, password (stored hashed), profile image, notification preferences, the IP addresses you log in from, and whether you signed in with Spotify.
• Campaigns - Track title, artist name, Spotify link, release date, genres, the audio file you upload for curators, the notes you write about the track, your package choice and campaign settings.
• Unfinished submissions - What you type into the submit form is saved as you go (text fields only, never the audio or payment details) so you can continue later, including on another device. If you entered your email and did not finish, we may send you one reminder with a link back to your form. Drafts are deleted after 14 days.
• Payments - Payments are taken by Stripe. We receive the payment status, the last four digits and brand of the card, and your billing name, address and country, which appear on your invoice. We never see or store full card numbers.
• Board activity - Comments you post, ratings and replies you give to curators, votes on replies, reports you file, and the moderation actions we take on them.
• Messages - Anything you send us through the contact form or in reply to our messages.
• Guest checkout - If you buy a campaign without creating an account, we create the account for you from the email address you give at checkout and email you a sign-in link.

Curators

• Application and profile - Your name, email, the Spotify account you connect, your playlists and their follower counts, genres, your profile text and image, and how we assess your playlists (follower history, estimated active listeners, placement checks). Follower counts are refreshed from Spotify regularly.
• Reviews - Every decision and the written feedback you give on a submission, the playlist you add a track to, and how long it stays there.
• Payout details - Legal name, address, country, whether you are paid as an individual or a business, company and VAT numbers (VAT numbers are checked against the EU VIES register), your bank account details in the format your country uses, and any extra details our payment provider requires for a transfer, such as date of birth or phone number.
• Earnings and invoices - Your earnings per review, withdrawal requests, the self-billing invoices we issue in your name, and the payout status.

People we contact who are not yet users

To invite curators and artists to the platform we sometimes collect contact details that are publicly available, for example a playlist owner's profile and the contact address they publish. We use it only to send an invitation, we stop after you tell us to, and you can ask us to delete the record at any time.

Why we use it and on what basis

• Running the service you asked for (contract) - creating accounts, sending your track to curators, showing you their replies, paying curators, issuing invoices, answering messages.
• Publishing campaigns you chose to make public (contract and your choice) - see the next section.
• Keeping the platform safe and working (legitimate interest) - security logs, spam and abuse controls on comments, rate limits, fraud checks on curator applications and payouts, performance monitoring.
• Improving and promoting the service (legitimate interest, or consent where the law requires it) - usage statistics, advertising measurement, reminder emails when you start a campaign but do not finish checkout, invitations to people we think would like the platform.
• Legal obligations - keeping invoices and accounting records, tax reporting, responding to lawful requests.

Where we rely on legitimate interest you can object; where we rely on consent you can withdraw it. Both are described under "Your rights".

The public campaign board

This is the part of the platform where your data is most visible, so please read it carefully.

• When you submit a campaign, "public campaign page" is switched on by default. You can switch it off on the submission form, and you can make a public campaign private later from your campaign page.
• Once a public campaign is complete, its page is visible to anyone on the internet and can be indexed by search engines. It shows the track title, artist name, album artwork, the Spotify link, the notes you wrote about the track, every curator's decision and full written feedback, the curator's name and playlist, your ratings and replies to curators, and all comments.
• Your audio file is streamed on the public page only once the track has been released on Spotify. Before release it is available to curators and to you only.
• Curators' names, profile images, playlists, statistics and reviews are public on their curator page and on every campaign they review.
• Comments are public and carry your display name. We keep the ability to remove comments, restrict accounts and act on reports.
• Making a campaign private removes the page from our site. Copies already made by search engines, caches or other people may persist for a while, which we cannot control.

Who we share data with

We do not sell personal data. We share it with companies that provide parts of the service, each of which may only use it for that purpose:

• Spotify (Sweden) - to read playlist and track data and, when you sign in with Spotify, to verify your account.
• Stripe (Ireland / USA) - card payments for campaigns.
• Wise (Belgium / UK) - curator payouts. To make a transfer we send Wise your name, address, bank details and any verification details it requires.
• Google Cloud (servers in Montréal, Canada) - hosting and database.
• Cloudflare (USA / EU) - network security, caching of public pages, and page-load analytics.
• Brevo (France) - sending our emails.
• OpenAI (USA) - we use its models to translate feedback and messages and to read supplier invoices for our bookkeeping. We send only the text needed for the task.
• Google Ads, Meta and OpenAI advertising - advertising measurement pixels, described in the Cookie Policy.
• Our accountant - an external bookkeeper in Latvia who sees the invoices we issue and receive, including the names, addresses and bank details on curator payout invoices.
• Authorities - when the law requires it.

Some of these companies are outside the European Economic Area. Transfers to Canada rely on the European Commission's adequacy decision; transfers to the USA rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the Commission's standard contractual clauses.

How long we keep it

• Account, campaign and curator data - for as long as your account exists, then deleted or anonymised within a reasonable period after you close it, unless we must keep it for the reasons below.
• Invoices and payout records - at least five years after the end of the financial year, as Latvian accounting law requires, for both campaign invoices and curator self-billing invoices.
• Public campaign pages - until you make the campaign private or close your account.
• Sessions - the login cookie lasts up to about eight days; "remember me" lasts longer until you log out.
• Unfinished submissions - 14 days after you last touched the form, or as soon as you submit it.
• Security, performance and playlist statistics logs - for as long as we need them for the purposes above; we review and prune them periodically.
• Invitation contact records - until you ask us to delete them or the invitation is clearly no longer relevant.

Emails we send

We send emails about your account and campaigns (curator replies, campaign completion, payouts, invoices), notifications from the board (replies to you, comments on your campaign, a daily digest if you keep it on), a reminder if you start a campaign and do not complete checkout, and occasional invitations. Board notification emails can be switched off in your account settings; every marketing or reminder email has an unsubscribe link or a reply address you can use. We will still send emails that are necessary to run your account, such as invoices and security notices.

Security

Traffic is encrypted with TLS. Passwords are stored hashed. Bank details are stored in our database and are visible only to our admin staff, our payment provider and our accountant. Access to the servers is limited to the people who run the platform. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the supervisory authority as the law requires.

Your rights

Under the GDPR you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong;
• delete your data, subject to the records we must keep by law;
• restrict or object to processing based on legitimate interest, including invitations and reminders;
• withdraw consent, for example by making a campaign private or switching off notification emails;
• receive the data you gave us in a portable format.

Send requests through the contact page from the email address on your account. We answer within one month. You can also complain to the Latvian Data State Inspectorate (Datu valsts inspekcija) or the supervisory authority in your own country.

Children

You must be at least 13 to use the platform and at least 18 to buy a campaign or receive payouts. We do not knowingly collect data from children under 13; if you think we have, contact us and we will delete it.

Changes

When we change this policy we update the date at the top. For changes that affect you materially we will email account holders or show a notice on the site before the change takes effect.