Privacy Policy

This policy explains which personal data PlaylistSwap processes, why, and what rights you have. The controller is PlaylistSwap, Boekstraat 52 bus 201, 2610 Antwerpen, Belgium, enterprise number BE 1012.277.845. Contact: support@playlistswap.app.

1. Data we process

• Spotify account: your Spotify user ID, display name, email address and profile picture, received when you sign in with Spotify.
• Spotify access: an access token and refresh token, so we can read your playlists and place, move and verify swap tracks in them. Tokens are never shown to other users.
• Playlists: names, covers, follower counts (including a daily follower snapshot) and the tracks in the playlists you own.
• Your content: profile details you enter (bio, genres), your song catalog (including private SoundCloud or Dropbox links you add), swaps, placements and connection requests with other users.
• Stream data: stream figures per playlist, entered by you or read from Spotify for Artists if you give our reader account access to your artist profile.
• Billing: your plan, subscription status and Paddle customer/subscription IDs. We never receive your card details; payments are handled entirely by Paddle.
• Technical data: log data such as IP address and browser type, kept by our hosting providers for security and troubleshooting.

2. Why we use it (and on what legal basis)

• To provide the Service — accounts, swaps, placing and verifying tracks, statistics (performance of our contract with you).
• To show your curator profile to other users — your name, picture, genres, playlists and swap statistics are visible to other signed-in users, because that is how they find swap partners (contract).
• Billing and accounting — keeping records of subscriptions (legal obligation and contract).
• Security and preventing abuse — for example detecting multiple accounts or broken swaps (legitimate interest).
• Contacting you about your account, swaps or subscription when needed. We do not send marketing without your consent, and we do not sell your data.

3. Who we share data with

We use these processors, each bound by a data processing agreement:

• Supabase — database and authentication.
• Vercel — website hosting.
• Spotify — sign-in and playlist access, under Spotify's own privacy policy.
• Paddle — payments. Paddle is the Merchant of Record and processes your payment details as an independent controller under its own privacy policy.
• SoundCloud and Dropbox — only when you play a private link in the app, the audio is loaded from their servers.

Some of these providers are located outside the European Economic Area. Where data leaves the EEA, the transfer is covered by an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.

4. How long we keep it

• Account, catalog and swap data: as long as your account exists.
• After you delete your account: removed within 30 days, except data we must keep by law.
• Invoices and billing records: 7 years, as required by Belgian accounting law (held mainly by Paddle).
• Swap history involving other users may be kept in anonymised form so their records stay complete.

5. Cookies

We only use cookies that are strictly necessary: to keep you signed in and to secure the sign-in process. We do not use advertising or tracking cookies. The Paddle checkout may set its own necessary cookies when you pay.

6. Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, and to receive your data in a portable format. You can disconnect PlaylistSwap from Spotify at any time in your Spotify account settings. To exercise your rights, email support@playlistswap.app; we answer within one month.

If you think we handle your data incorrectly, you can file a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, dataprotectionauthority.be, or with the authority in your own country.

7. Changes

We update this policy when the Service changes. Material changes are announced by email or in the app before they take effect.