Privacy policy

1. Controller

Aaron Bidzan
Auf der Hüls 128
52068 Aachen
Germany

Email: [email protected]
Phone: +49 152 39601605

We have not appointed a data protection officer because we are not legally required to. If you have questions about data protection, please write to the email address above.

2. Hosting and server log files

Aaronstudios Music runs on a server of a hosting provider in Germany. The database and all uploaded files, including audio and artwork, are stored there. The provider processes the data only on our behalf; we have a data processing agreement with it under Art. 28 GDPR.

Every time you open the website, our server automatically processes technical data: IP address, date and time, requested address, referrer, status code, and browser and operating system. This is necessary to deliver the website and keep it secure and stable (Art. 6 (1) (f) GDPR). We delete server log files after 30 days at the latest, unless we need them to investigate a specific security incident.

3. Your account

For your account we process your name, email address, password (only as a secure hash), your chosen language, and when you signed up and last signed in. When you reset your password, we create a single-use code that expires after one hour. The legal basis is the performance of the user agreement (Art. 6 (1) (b) GDPR).

You can listen to music without an account. You need one to like songs, build playlists and release music.

4. Login with Aaronstudios

If you sign in with your Aaronstudios account, Aaronstudios (the same controller) tells us your Aaronstudios ID, username, name, profile picture and email address after you agreed to it. We use them to create or recognise your account (Art. 6 (1) (b) GDPR). Your profile picture is loaded from aaronstudios.de. We don't keep any Aaronstudios access tokens: we only need to know who signed in. You can disconnect your Aaronstudios account under Account at any time.

5. Listening, your library and playlists

We store the songs you like, the releases you save, the artists you follow and your playlists to provide your library (Art. 6 (1) (b) GDPR). Playlists are private unless you make them public; public playlists can be opened by anyone with the link.

When you listen to a song for 30 seconds, we count a play and store which song was played, when and, if you're signed in, by which account. We use plays to show play counts, popular songs and artists, and to give artists an idea of how their music is doing (Art. 6 (1) (f) GDPR, our legitimate interest in running a fair music platform). To prevent inflated numbers, we briefly remember your IP address together with the song for 30 seconds.

6. Artists and uploads

If you apply to become an artist, we store your application with your artist name, bio, location, genre, links and the result of our review (Art. 6 (1) (b) GDPR). Approved artists have a public profile with their name, picture, bio, location and links.

For releases we store the audio files, artwork, titles, credits (for example songwriters and producers), lyrics, codes such as ISRC and UPC, and the review status. Published releases, including credits and lyrics, are public. Drafts and releases in review are only visible to the artist and our admins.

7. Emails

We send emails that belong to using the service: password reset links, the result of artist applications and release reviews, and, for admins, notices about new submissions (Art. 6 (1) (b) GDPR). We don't send newsletters or advertising. Emails are sent through an email provider that acts on our behalf (Art. 28 GDPR).

8. Cookies and storage in your browser

We only use cookies and browser storage that are strictly necessary to run the service (§ 25 (2) no. 2 TDDDG). We don't use tracking or advertising cookies.

9. Retention and account deletion

We store your data for as long as your account exists, unless a shorter period is stated above.

Under Account you can download a copy of your data and delete your account at any time. When you delete your account, we immediately remove your account, library, playlists and, if you are an artist, your artist profile with all releases, audio files and artwork. Plays you made stay counted but are no longer linked to you.

10. Recipients

We don't sell data or use it for advertising. The only recipients are the service providers named in this policy: our hosting provider in Germany and our email provider. We don't transfer data to countries outside the EU. Authorities only receive data if we are legally required to provide it. We don't use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can exercise many of these rights directly under Account; otherwise an email to [email protected] is enough.

Right to object: Where we process data based on legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint: You can complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

12. Changes to this privacy policy

We update this privacy policy when the service or the law changes. You can always find the current version on this page.