Privacy Policy

Effective date: 31 July 2026

1. Who we are

This Privacy Policy explains how SoundSpire, operated by Ashish Paul ("SoundSpire," "we," "us," "our"), collects, uses, shares, and protects your personal information when you use the SoundSpire mobile app, website, and related services (together, the "Services").

SoundSpire is a global platform where music artists build community hubs, share exclusive content with their fans, interact directly with their audience, and where fans discover, review, and engage with music. We serve artists and fans worldwide.

This policy applies to everyone who uses the Services. Both fans/general users and artists.

Contact for privacy questions: support@soundspire.online
Grievance / data protection contact: support@soundspire.online

2. Scope

This policy covers personal data we process as a data controller / data fiduciary, that is, where we decide why and how your data is handled. It does not cover third-party websites, apps, or services that we link to, which have their own privacy policies.

By using the Services, you acknowledge this Privacy Policy. Where the law requires consent (for example, for certain analytics or communications), we ask for it separately and you can withdraw it at any time.

3. Information we collect

3.1 Information you give us

• Account information: name or display name, email address, and password. Passwords are stored only as a salted hash (bcrypt); we never store your password in plain text. If you sign up using Google, we receive basic profile information (name, email, profile photo) from Google.
• Profile information: username, profile photo, bio, links, date of birth, gender, phone number, city and country, and (for artists) artist name, genre, and other details you choose to add.
• Content you create: reviews, ratings, posts, comments, community messages, fan art, and any files or media you upload.
• Communications: messages you send us (support requests, feedback, survey responses).

3.2 Information we collect automatically

• Usage data: pages/screens viewed, features used, actions taken, and interaction timestamps.
• Device and technical data: device model, operating system and version, app version, language, time zone, IP address, and general (approximate) location derived from IP.
• Diagnostics: crash logs and performance data.
• Push notification token (if you enable notifications).
• Cookies and similar technologies on our website; mobile identifiers in our app (see Section 8). Your login session is maintained with a secure cookie.

3.3 Information from third parties

• Sign-in provider (Google) when you use it to log in.
• Infrastructure and analytics providers that help us run and understand the Services.

We do not knowingly collect government IDs, financial account numbers, or payment card details through the Services.

4. How we use your information

We use personal data to:

• create and manage your account and profile;
• operate core features. Community hubs, exclusive content, community interaction, and music discovery/reviews;
• display your content and profile to other users as intended by the feature you use;
• personalize your experience and recommendations;
• communicate with you about the Services (service messages, and, with your consent where required, updates or newsletters);
• keep the Services safe: prevent fraud, abuse, spam, and violations of our terms; moderate content, and act on reports and blocks;
• analyze and improve the Services;
• comply with legal obligations and enforce our terms.

5. Legal bases for processing (EEA / UK users)

Where the EU/UK GDPR applies, we rely on:

• Contract - to provide the Services you sign up for;
• Consent - for optional analytics, marketing communications, and non-essential cookies (withdrawable anytime);
• Legitimate interests - to secure, maintain, and improve the Services, where not overridden by your rights;
• Legal obligation - where we must process data to comply with the law.

6. How we share information

We do not sell your personal information. We share it only:

• With service providers who process data on our behalf under contract, for example: Amazon Web Services (AWS) for storage, media delivery, and hosting; Supabase for our database and realtime messaging; Google for sign-in; and email and analytics vendors we use. These providers process data only to run the Services.
• With other users, to the extent your profile, reviews, posts, and community activity are meant to be visible within the Services.
• For legal reasons, to comply with applicable law, respond to lawful requests, or protect the rights, safety, and property of SoundSpire, our users, or the public.
• In a business transfer, if we are involved in a merger, acquisition, financing, or sale of assets, subject to this policy.

7. International data transfers

SoundSpire serves a global audience, and our providers may store and process data in countries other than yours. Where we transfer data internationally, we rely on appropriate safeguards (such as Standard Contractual Clauses) where required by law.

8. Cookies and similar technologies

On our website we use cookies and similar technologies for essential functionality (including keeping you signed in), to remember preferences, and with your consent where required for analytics. In our mobile app we use device identifiers for similar purposes.

You can control cookies through your browser settings and control app-level tracking through your device settings. Disabling some of these may affect functionality.

9. Data retention

We keep personal data for as long as your account is active and as needed to provide the Services, then delete or anonymize it, except where we must retain it to meet legal obligations, resolve disputes, or enforce our agreements. Content you post in communities may remain visible to others until you or we remove it.

10. Security

We use reasonable technical and organizational measures, including access controls and encryption in transit, to protect personal data. Passwords are stored only as salted hashes. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data (see Section 12);
• withdraw consent where processing is based on consent;
• object to or restrict certain processing;
• data portability;
• opt out of marketing communications at any time.

To exercise these rights, contact support@soundspire.online. We will respond within the timeframe required by applicable law. You may also lodge a complaint with your local data protection authority. EEA/UK, California, and India-specific rights are detailed in Section 15.

12. Deleting your account and data

You can delete your SoundSpire account and associated personal data at any time by:

• using the Delete Account option in your profile settings; or
• submitting a request at https://soundspire.online/delete-account or emailing support@soundspire.online.

When you delete your account, we delete or anonymize your associated personal data, except data we are legally required to retain. Some content you shared publicly or in communities may need to be removed separately, and backups are purged on a rolling cycle.

13. Children

The Services are not intended for children under 13, and we do not knowingly collect personal data from them. If you are between 13 and 17, you may use the Services only with the involvement and consent of a parent or legal guardian.

Note on India: under India's DPDP framework, anyone under 18 is treated as a "child" and processing their data generally requires verifiable parental consent. We will provide a parental-consent mechanism for under-18 users in India before that requirement is enforced.

If you believe a child has provided us data, contact support@soundspire.online and we will delete it.

14. Third-party links and content

The Services may contain links to, or content from, third parties (for example, artist links or embedded media). We are not responsible for their privacy practices. Review their policies before sharing data with them.

15. Region-specific disclosures

EEA / UK (GDPR): You have the rights in Section 11, may withdraw consent at any time, and may complain to your supervisory authority. Legal bases are in Section 5.

California (CCPA/CPRA): You have the right to know, delete, correct, and opt out of "sale" or "sharing" of personal information (we do not sell or share it as those terms are defined), and not to be discriminated against for exercising these rights. Submit requests to support@soundspire.online.

India (DPDP Act, 2023 & DPDP Rules, 2025): You may access, correct, update, and erase your personal data, nominate another person to exercise your rights, and raise grievances. Our designated contact for data-protection queries and grievances is listed in Section 1. We process personal data based on your consent or other lawful grounds and will honour consent withdrawal.

16. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice where required. Continued use of the Services after an update means you accept the revised policy.

17. Contact us

Privacy: support@soundspire.online
Grievance / data protection contact: support@soundspire.online