Privacy policy

1. Who we are

Jorge Mendieta Almansa and Fabrizio D'Ambrosio, who run Soundmark together from the United Kingdom, are jointly responsible for your data (the "controllers"). For any question, request or complaint about your data, write to us at:

• contact@soundmark.uk

2. What data we process

• Your account: email, password and username. Your password is stored encrypted; not even we can see it. During the pilot you join with an invitation: we keep which invitation you used and the short note we wrote on it (usually your first name) so we know whom we invited.
• Your profile, if you fill it in: photo, bio, and your featured artist, album and song.
• What you do on Soundmark: ratings (including the 1 to 5 ratings you give album covers), reviews, comments, likes, your mixtapes (their title, description, the albums and songs in them, a short note on each, and whether each is public or private), who you follow, your watchlist, your rankings, your top 5 albums, the seasons you pick, the albums you complete, the certifications you earn (and which you pin or feature), what you report, the accounts you block and the feedback you send us. Who you've blocked is visible only to you (we don't notify them, but they may notice they can no longer see your content), and what you report or send us as feedback only to our administrators. If reports hide your profile photo and bio, we keep them aside, visible only to you and our administrators, until they decide.
• Your votes: your votes in polls, in the weekly Battle and in Survivor are stored with your account and deleted with it. They are not public: nobody can see who voted for what, only the totals. If you share your Battle result, the image shows which song you picked in each round, with your username and photo; it is made when you ask for it, we don't keep it, and only you can make yours.
• Units: when you do something on Soundmark or someone values what you made, you earn units. We keep each movement with its date, the title of the album, song or mixtape, and who gave you the like, comment or follow. Your units total is public on your profile (as "units sold"); the list of movements only you can see. It is deleted with your account.
• History of your rating changes: when you change or clear a rating, we keep the score it had before and the date of the change; for a review, only the date of its last edit (not the old text). This history is not shown anywhere on Soundmark: only you and our administrators can read it, and the administrators only look at it to fix errors or investigate abuse.
• Notifications: the notifications we create for you. If you turn on phone notifications, also the technical details your browser needs to receive them, and your notification preferences.
• Technical data: your IP address and browser details. We use them for security (for example, to stop repeated attempts to get into an account) and in error reports.
• Anonymous statistics: how many visits each page gets, how many times each music preview is played, how long each visit lasts, whether you come from the installed app or the browser, and searches that find nothing (only the text searched for, with nothing saying who searched for it). They don't identify you and aren't linked to your account.

What's public: your username, photo, bio, ratings, reviews, comments, rankings, your top 5 albums, public mixtapes, certifications (and which you pin or feature, and any artist paused in a discographies certification), your units total and who you follow can be seen by anyone, even without an account. Your email is never public. Public mixtapes are kept out of search engines. A private mixtape can only be seen by you, unless someone reported it before you made it private: then our administrators can still see it, because it was reported. The history of your rating changes and your votes in polls, battles and Survivor are not public.

3. Why we use it, and our lawful basis

• To provide the service you ask for when you sign up: creating your account, saving and showing what you post, and sending you notifications within Soundmark. Lawful basis: it's necessary to provide the service to you.
• To keep Soundmark safe and running, and to improve it: preventing abuse, moderating reported content, fixing errors, counting visits anonymously and working out overall figures on how Soundmark is used (for example, how many people come back each week) from what we already store, without names. Lawful basis: our legitimate interest in Soundmark working well and securely.
• For phone notifications. Lawful basis: your consent. Turn them on or off at any time in Settings.
• Emails: we only send what your account needs, for example to reset your password. Never marketing.

4. Who we share it with

We use these services, which process data only on our instructions:

• Supabase: database, accounts and profile photos. Servers in London.
• Vercel: hosts the website and counts visits without cookies. Servers in London.
• Sentry: error reports. Servers in Germany.
• Cloudflare: receives the emails you send to contact@soundmark.uk and passes them on to us.
• Resend: sends the emails we write to you from contact@soundmark.uk and your account emails, such as password resets. Servers in Ireland.
• DeepL: translates a review between English and Spanish when someone presses "Translate" under it. It only receives the review's text, never who wrote it or who asked. On the free plan we use, DeepL may keep that text to improve its translations; reviews are public anyway. Servers in Germany.
• Your browser's push service (Apple, Google or Mozilla, depending on your device): only if you turn on phone notifications. It receives each notification in order to deliver it.

When you listen to music: the 30-second previews come straight from Apple, so your browser connects to Apple and Apple sees your IP address. If you choose to listen with Spotify, Apple Music or Deezer, their player loads, under their own privacy policy. None of this happens until you press play.

We don't sell your data or share it with anyone for advertising.

5. Data outside the United Kingdom

Your data is stored in the United Kingdom. Error reports, the emails we send you and review translations are handled in the European Union, which UK law considers to provide adequate protection. Some of these services are US companies that may access data, for example to give us technical support. When that happens, safeguards approved in the UK apply through their contracts.

6. How long we keep it

• For as long as you have an account. If you delete it (Settings → Delete account), everything else is deleted straight away: profile, photo, ratings and their change history, reviews, comments, mixtapes, followers and notifications.
• Feedback you send us (Send feedback) is one exception: if you delete your account it stays, with its category and a rough device type (phone, tablet or desktop), but nothing links it to you any more. We don't keep your username with it. If you wrote something about yourself in the message, it stays too, so keep personal details out of it.
• Records of reports are the other: when someone reports something you posted (or your profile), we keep a short record of it for 12 months, even if the content or your account is deleted: the dates, the kind of content and its number, the reason given, what happened to it, which administrator acted, and your account's identifier. We don't keep the text or the photo, or who made the report. Only our administrators can read it. It lets us show how we handled reports and help the police if something seriously illegal was posted.
• Backups: may contain your data for up to 90 days after it's deleted; after that it's gone.
• Security logs: are overwritten quickly, usually within a day.
• Error reports: up to 90 days.
• Translations of a review: we keep them with the review, so it's only translated once; they're deleted with it, and replaced if you edit it.
• Searches that found nothing: 90 days; then they're deleted automatically.
• Messages you send us (complaints, appeals, reports by email, rights requests) and what we decided: up to 2 years, so we can handle them and show how we did.
• Anonymous statistics: no limit, as they don't identify anyone.

7. Your rights

You can ask us at any time to:

• see the data we hold about you and get a copy;
• correct it (you can edit most of it yourself on your profile);
• delete it (you can delete your account yourself);
• take it with you in a reusable format;
• object to a particular use, or ask us to restrict it;
• withdraw your consent to phone notifications.

Write to the address in section 1 and we'll reply within one month at the latest.

Complaints: if you're unhappy with how we handle your data, please write to us first. We'll acknowledge your complaint within 30 days and reply as soon as we can. You can also complain to the UK's data protection authority, the Information Commissioner's Office (ico.org.uk, phone 0303 123 1113).

8. What we store on your device

Soundmark only stores what's needed, or what you choose, in your browser:

• your session, so you don't have to log in every time;
• your language, and whether you use light or dark mode;
• your preferred player;
• your recent searches. This list stays on your device.

We don't use advertising or tracking cookies, which is why we don't ask you to accept cookies.

To tell how long a visit lasts we use a random number that only exists while the page is open: it isn't stored on your device or linked to your account.

9. Minimum age

Soundmark is for people aged 18 or over. If we learn that someone under 18 has an account, we'll delete it.

10. Security

Passwords are stored encrypted, every connection is encrypted (HTTPS), access to the database is restricted, and we limit repeated attempts to get into an account.

11. Changes to this policy

If we change anything important, for example if we add paid features or advertising, we'll update this page and the date at the top, and let you know on Soundmark.