Soundportal — Privacy Policy

Last updated: June 2026
Status: Beta / Free Service

1. What Data We Collect

Account Creation

• Email address (via Google OAuth)
• Full name (from Google profile)
• Username (you create, publicly visible)
• Role (Label Owner, A&R Manager, or Producer)

Portal & Submission Data

• Portal information: name, description, genres, submission settings
• Track metadata: artist name, track title, BPM, genres, submission type
• SoundCloud URLs (links to external tracks, not files)
• Producer contact: email, username
• Access logs: who viewed which portal, when

Technical Data

• IP address (for security, stored briefly)
• Device info (browser type, OS)
• Login history (timestamps, authentication method)
• SoundCloud player analytics (SoundCloud's data, not ours)

2. How We Use Your Data

✅ To operate Soundportal:

• Create and manage your account
• Show submissions to the right people
• Notify label owners of new tracks
• Enable private portal access

✅ For security & legal compliance:

• Detect unauthorized access
• Respond to copyright/DMCA claims
• Comply with Dutch/EU law
• Prevent abuse and fraud

✅ NOT for:

• ❌ Selling to third parties
• ❌ Marketing emails (unless you opt-in)
• ❌ Building ML models on your data
• ❌ Sharing with advertisers

3. Who We Share Data With

Supabase (Data Processor):

• Hosts our database (Ireland/EU)
• Encrypted in transit and at rest
• Signed Data Processing Agreement

Google (OAuth Provider):

• Verifies your identity only
• Doesn't share login with us beyond email

No one else gets your data unless:

• You publicly share your portal (producer sees label info)
• Legal requirement (court order, GDPR request)
• Copyright claim (we share contact info with claimant)

4. How Long We Keep Data

• Active accounts: kept as long as you use Soundportal
• Deleted accounts: anonymized after 30 days
• Deleted portals/submissions: archived for 90 days (legal/DMCA), then deleted
• Login history: 90 days
• IP logs: 30 days

5. Your Rights (GDPR/AVG)

You can request anytime:

• ✅ Access: Export all your data
• ✅ Deletion: Remove your account completely
• ✅ Correction: Fix wrong info
• ✅ Portability: Get data in machine-readable format

Email: info@soundportal.app with subject "Data Request"
Response time: 30 days maximum

6. Security Measures

We implement:

• ✅ SSL/TLS encryption (all traffic)
• ✅ OAuth 2.0 authentication (no passwords stored)
• ✅ Row-level security (users see only their own data)
• ✅ Secure Supabase (enterprise-grade)
• ✅ No public databases
• ✅ Regular security audits

But: No system is 100% secure. See Terms of Service for liability limits.

7. Cookies & Tracking

Session cookies only:

• sb-session = Supabase authentication token
• sb-refresh-token = Keep you logged in
• Deleted when you log out

No tracking cookies:

• ❌ No Google Analytics
• ❌ No behavioral tracking
• ❌ No retargeting ads

SoundCloud player:

• SoundCloud sets own cookies (see SoundCloud privacy policy)

8. Beta Service Notice

Soundportal is beta software. This means:

• Data retention policies may change
• We may modify how we store/process data
• We'll notify you of major changes
• Privacy practices will evolve

9. Changes to This Policy

We may update this anytime. We'll notify you of major changes via email.

10. Contact

Data Protection Officer / Privacy Questions:

• Email: info@soundportal.app
• Subject: "Privacy Question"

Dutch Authority:

• Autoriteit Persoonsgegevens (AP)
• https://www.autoriteitpersoonsgegevens.nl

Last updated: June 2026