1. Who is responsible
PlaylistGrow, trading as PlaylistMarket, established in the Netherlands, is the data controller for the personal data described here. Contact us at support@playlist.market for anything privacy-related. We have not appointed a data protection officer, because the law does not require one for us; privacy questions go to the same address.
- Operator:
- PlaylistGrow, trading as PlaylistMarket
- Address:
- Damrak, Amsterdam, the Netherlands
- Chamber of Commerce (KvK):
- 80142052
- VAT number:
- NL003396736B66
- Email:
- support@playlist.market
2. What we process and why
- Account data (name, email, password hash, roles, country): to run your account. Legal basis: contract.
- Artist and curator profiles, songs, playlists, submissions, reviews and feedback: to provide the marketplace. Legal basis: contract.
- Payment data: handled by Stripe. We store purchase, plan and payout records, but never full card or bank numbers. Legal basis: contract and legal obligation.
- Seller tax details for curators (legal name, address, country, tax id, date of birth or business registration number): to meet reporting duties such as DAC7. Legal basis: legal obligation.
- Consent records (what you agreed to, the version, time, IP address and browser): to prove you agreed to the terms, the withdrawal waiver and Autopilot. Legal basis: legal obligation and legitimate interest.
- Sign-in sessions (IP address and browser), security and audit logs, and rate-limit counters: to keep accounts and the platform safe. Legal basis: legitimate interest.
- Fraud signals (the IP address of your first sign-in, a fingerprint of your payment card provided by Stripe, and patterns in email addresses): to spot an artist and a curator who are the same person before earnings are paid out. A match holds those earnings until our team checks it. Legal basis: legitimate interest in preventing fraud.
- Public Spotify data about playlists and songs (followers, which songs a playlist contains, when it changed): to vet playlists and check placements. Legal basis: legitimate interest. We read it through Spotify's official Web API with our own app credentials, and from a licensed music-data provider (Chartmetric) that collects public streaming data. We never ask for your Spotify login and never access your Spotify account, including when curators prove they own a playlist.
- Your answers about placements and streams (whether a song is on a playlist, and roughly how many streams it brought): to check placements and show how playlists perform. Others see only combined numbers, never who answered. Legal basis: legitimate interest.
- Support messages (the contact form, Help in the app and emails you send us) and our replies: to answer you and fix problems. Legal basis: contract and legitimate interest.
- Email preferences, notifications and email delivery events (for example a bounce or an unsubscribe): to tell you about reviews and payouts, send digests you can turn off, and respect unsubscribes. Product news only if you opt in. Legal basis: contract, legitimate interest and consent.
4. How long we keep it
- Account and profile data: for as long as you have an account.
- Purchase, plan, ledger and payout records: 7 years, as Dutch tax and accounting law requires. They stay in anonymised form after you delete your account.
- Consent records, with their IP address and browser: for as long as you have an account and 7 years after it ends, as proof of what you agreed to.
- Audit logs of important actions, with their IP address: 7 years.
- Seller tax details of curators who were paid through the platform: 10 years after the last year we reported them under DAC7, also after you delete your account (see below).
- Sign-in sessions: 30 days after you last used them. Sign-in and email confirmation links: one day after they expire. Rate-limit counters: one day.
- Email delivery logs and delivery events (for example a bounce): 90 days. Notifications in the app: 180 days once read, 365 days if unread.
- Support tickets and their messages: 3 years after the ticket is closed.
- Placement and stream answers: for as long as the submission they belong to. They count toward playlist stats for 180 days.
- Error reports: up to 90 days.
- Addresses that bounced or unsubscribed: on our suppression list, so we never email them against their wishes.
When you delete your account we anonymise your name and email straight away and delete your profiles' personal details, images, sessions and notifications. Submissions, reviews and ledger records are kept in anonymised form, because other users' balances and stats depend on them. Deleted data can remain in backups for a short time until they roll over.
Seller tax details are deleted with the account too, unless you were paid through the platform. Then EU tax rules (DAC7) require us to keep the details we reported (legal name, address, country, tax id, date of birth or business registration number) and your yearly payout totals for 10 years after the end of the last year we reported. They are kept apart from the rest of the deleted account, used only for tax reporting and deleted when that period ends. Legal basis: legal obligation, so this part is not erased on request.
5. Automated decisions and AI
Replies from our support assistant are written by AI and say so. You can ask for a person at any time.
Disputes, strike reviews and appeals against a rejected or paused playlist may be decided automatically, using our rules and an AI model that reads the information involved (the review, the reason given, our placement checks and the playlist's data). Payout fraud checks and playlist scans can hold earnings or pause a playlist automatically until they are cleared. These decisions are needed to run the marketplace you signed up for. Every automatic decision is logged and can be reversed by our team within 7 days.
Autopilot uses AI to match your song to playlists (see the Terms of Service, section 9). It reads text details only, never your audio.
You can always ask for a person to look again at a decision about you, give your side, and have it explained: ask in Help in the app or email support@playlist.market. A person will review it. Our AI provider does not use this data to train its models.
6. Your rights (GDPR and similar laws)
You have the right to access, rectify, erase and port your personal data, to restrict or object to processing, and to withdraw consent at any time without affecting what happened before.
- Data export: download a copy of your data (profiles, songs, submissions, disputes, purchases, ledger history, consents and notifications) from Settings as a JSON file. Email us for anything it does not include, such as your support messages.
- Account deletion: delete your account from Settings. We anonymise your personal data and sign you out; records we must keep by law are retained in anonymised form, except the seller tax details DAC7 requires (section 4).
- Objection: you can object to processing based on legitimate interest. We then stop unless we have compelling reasons, such as fraud prevention.
- Anything else: email support@playlist.market. We answer within one month.
If you think we handle your data wrongly, please tell us first. You also have the right to complain to the Dutch data protection authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the authority in the EU country where you live or work.
7. International transfers
Our application and database run in the EU. Some providers above are based in the US or may access data from there. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses, with extra safeguards where needed. Ask us for a copy of the safeguards.
8. Security
Data is encrypted in transit and stored with providers that encrypt it at rest. Passwords are hashed, access is role-based and audited, and payment details never touch our servers. If a breach puts your data at risk, we tell the authority and, where required, you.
9. Age
The platform is for people aged 18 and over. We do not knowingly collect data from anyone younger. If we learn that we have, we close the account and delete the data.
11. Changes
We will tell you about material changes by email or in the app before they take effect. The version date is shown at the top of this page. Questions: support@playlist.market.