Privacy Policy

1. Who We Are

We operate Playlift, a smart link and music marketing service that helps artists and musicians share music links, run advertising campaigns and measure engagement across platforms. This privacy policy explains how we collect, use, and protect your personal information.

The controller responsible for the processing of your personal data is:

Michael Schmid
Playlift
Hauptstr. 16
89564 Nattheim
Germany

2. Information We Collect

2.1 Technical Data

When you visit our service, we automatically collect:

• IP address
• Browser type and version (user agent)
• Referrer URL (the page you came from)
• Device information
• Session cookies (including pl_session for authentication)

2.2 Interaction Data

We track how you interact with our service:

• Link visits and clicks
• Redirect events (whether you opened links in app or web)
• Aggregated analytics and engagement metrics
• UTM parameters and campaign attribution data

2.3 Spotify Data (When Connected)

If you choose to connect your Spotify account via OAuth:

• Spotify user ID
• Display name (if available)
• Email address (if available and provided by Spotify)
• OAuth tokens (stored securely for API access)
• Spotify activity data (saves, plays, follows, playlist additions) when you interact with music links

2.4 Account Information

If you create an account:

• Email address
• Password (hashed and encrypted)
• Account preferences and settings
• Links you create and manage

2.5 Application Form

If you apply for our marketing service through the application form on our website, we collect the information you enter:

• Name, email address and your role (artist, label or manager)
• Links to your Spotify artist profile and, optionally, to a track
• Genre, listener range, goals, what you have tried so far and your planned monthly ad budget
• Free text you write about your goals
• Where you found us (referrer or campaign source), if available

We use this information only to review your application and to reply to you. A short notification about your application is sent to our internal team chat (Discord) so that we can respond quickly.

2.6 Anonymous Website Statistics

To understand how many people visit our website and where they drop off in the application process, we run our own privacy-friendly statistics. We do not use cookies for this and we do not store your IP address. Instead, we store a short pseudonymous identifier that is derived from your IP address and browser information together with a secret value and the current date, so it changes every day and cannot be used to recognize you over time. Together with it we store the page you visited, the referring website, campaign parameters in the link, the step of the application form you reached and, if available, your country. Requests from known bots are not stored. Your browser session storage keeps the referrer and campaign parameters until you close the tab. If your browser sends a Do Not Track signal, no statistics events are sent.

2.7 Meta Advertising Data (When Connected)

If you connect a Meta account so that we can manage advertising campaigns for you, we receive the following information from Meta through Facebook Login and the Meta Marketing API:

• Meta user ID, name and profile picture from your public profile
• Email address associated with your Meta account
• OAuth access tokens (stored securely for API access)
• The advertising accounts and businesses you grant us access to, including their names and IDs
• Facebook Pages and Instagram business accounts linked to those advertising accounts
• Campaign structure we create and manage for you (campaigns, ad sets, ads and creatives)
• Advertising performance data such as impressions, clicks, spend, reach and conversions

We use this information only to create, manage and report on advertising campaigns in the accounts you connect. We do not use it to build profiles of individuals, we do not combine it with data from other customers, and we do not sell it or pass it on for advertising purposes of our own. You can revoke our access at any time, see section 6.

3. How We Use Your Information

We use the collected information to:

• Provide and maintain our smart link service
• Process redirects and track link performance
• Generate analytics and reports for link creators
• Authenticate users and manage accounts
• Connect with Spotify to enable music platform features
• Measure advertising campaign effectiveness (with consent)
• Prevent fraud and ensure service security
• Comply with legal obligations

4. Third-Party Services and Integrations

4.1 Spotify

When you connect your Spotify account, we use Spotify's OAuth service. Spotify may collect information about your use of our service through their API. We only access Spotify data necessary to provide our service (such as checking if tracks are saved, retrieving recently played tracks, etc.). Your use of Spotify is also governed by Spotify's Privacy Policy.

4.2 Meta (Facebook) Pixel and Conversions API

With your consent, we use Meta Pixel and the Conversions API to measure ad performance and improve campaign attribution. When you visit links that originate from Meta ads, we may send the following information to Meta:

• Browser identifiers: _fbp (Facebook Pixel) and _fbc (Facebook Click ID) cookies
• IP address (hashed)
• User agent string
• Hashed email address (SHA-256)
• Stable external identifier (e.g., spotify:<spotifyUserId>)
• Event data (PageView, Open in App, Open in Web, etc.)

This data helps Meta match events to ad campaigns and improve conversion tracking. We only send this data when your session originates from a Meta ad context or equivalent testing flows. Meta's use of this data is governed by Meta's Data Policy.

You can opt out of Meta Pixel tracking by adjusting your browser settings or using Meta's opt-out tools. Note that opting out may affect the accuracy of ad performance measurement.

5. Legal Basis for Processing (GDPR)

We process your personal data based on:

• Consent: For advertising and measurement services (Meta Pixel), we rely on your explicit consent
• Legitimate Interests: For service operation, security, fraud prevention, and analytics
• Contract Performance: To provide the services you request when you create an account or use our links, and to take steps at your request before a contract, such as reviewing an application you send us
• Legal Obligations: To comply with applicable laws and regulations

6. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Restriction: Request limitation of processing in certain circumstances
• Data Portability: Receive your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent for advertising/measurement at any time

To exercise these rights, please contact us using the information provided in the Contact section below. We will respond to your request within 30 days.

You can also unlink your Spotify account at any time through your account settings or by contacting us.

If you connected a Meta account, you can disconnect it in your account settings, or remove our access directly at Meta under Settings, Business Integrations. Step by step instructions for requesting deletion of your data are available on our data deletion page.

7. Data Retention

We retain personal data only as long as necessary for the purposes stated in this policy:

• Account data: Retained while your account is active and for a reasonable period after closure
• Analytics data: Retained for up to 2 years for historical reporting
• Anonymous website statistics: Deleted automatically after 400 days
• Applications: Retained for up to 24 months after our last contact, unless we start working together, in which case the data is kept for the duration of that relationship
• Spotify tokens: Retained until you disconnect your account or they expire
• Session cookies: Expire when you close your browser or after a period of inactivity
• Legal/regulatory data: Retained as required by applicable law

After the retention period, we securely delete or anonymize your personal data.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing (never storing plaintext passwords)
• OAuth token encryption and secure storage
• Regular security assessments and updates
• Access controls and authentication requirements
• Secure database storage with MongoDB

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States and other jurisdictions where our service providers operate. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions, to protect your data in accordance with this privacy policy.

10. Children's Privacy

Our service is not intended for children under 13 (or 16 in the EU). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately and we will delete such information.

11. Changes to This Privacy Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of our service after changes become effective constitutes acceptance of the updated policy.

12. Contact Us

If you have questions, concerns, or requests regarding this privacy policy or your personal data, please contact us:

• Michael Schmid, Playlift
• Hauptstr. 16, 89564 Nattheim, Germany
• Email: playlift@mikemana.com
• Website: www.playlift.io

For EU residents, you also have the right to lodge a complaint with your local data protection authority if you believe we have not addressed your concerns adequately.