Privacy Policy

1. Data Controller

2. Overview of Data Processing

This privacy policy explains what personal data we collect when you use our music discovery service ("DigDeeper"), how we use it, and what rights you have.

3. Legal Basis for Processing

We process your personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data protection laws. The legal bases for processing are:

• Art. 6(1)(b) GDPR: Processing necessary for contract performance (providing the service)
• Art. 6(1)(a) GDPR: Your consent (e.g., for optional features)
• Art. 6(1)(f) GDPR: Our legitimate interests (e.g., fraud prevention, service improvement)

4. Data We Collect

4.1 Anonymous Users

For users without an account, we collect:

• Browser Fingerprint: A technical identifier based on your browser configuration to track search credits and prevent abuse
• Search Queries: Music tracks and artists you search for
• Technical Data: IP address, browser type, device information (automatically collected by our server)

4.2 Registered Users

When you create an account via OAuth, we collect:

• Profile Information: Name, email address, profile picture (from your OAuth provider)
• Account Data: User ID, authentication tokens
• Usage Data: Search history, playlists, saved tracks, credit balance
• Payment Information: Subscription status, payment method (processed by our payment provider)

4.3 Automatically Collected Data

• Log Files: Date/time of access, pages visited, referrer URL, HTTP status codes
• Cookies: Session cookies for authentication and functionality (essential), plus marketing-attribution cookies (see below).
• Marketing Attribution: If you arrive via a campaign or short link, we record the source of your visit (campaign parameters, or an inferred source derived from your referrer) so we can attribute sign-ups correctly. This is stored on your device and, if you create an account, on your user record. It is transmitted to our analytics provider only if you consent to analytics. We also log clicks on our campaign links (including your approximate location and a non-reversible identifier in place of your IP address) to measure campaign performance — based on our legitimate interest (Art. 6(1)(f) GDPR).

5. How We Use Your Data

• Providing the music discovery service and search functionality
• Managing your account, credits, and subscriptions
• Preventing fraud and abuse (e.g., credit system enforcement)
• Improving our service and developing new features — this includes analysing how the product is used, which can involve your search queries, the tracks you interact with, and session replays (only where you have given analytics consent; see section 11)
• Measuring the performance of our marketing and advertising (only where you have given the relevant consent)
• Communicating with you about your account and service updates
• Complying with legal obligations

6. Data Sharing and Third Parties

We share your data only in the following cases:

6.1 Service Providers

• Hosting (Hetzner): Our application, database and vector search run on servers operated by Hetzner Online GmbH in Germany (EU).
• Google (Sign-in): Account creation and login via Google OAuth. We receive your name, email address and profile picture from Google. Subject to Google's Privacy Policy.
• Stripe: Subscription and credit payments are processed by Stripe Payments Europe, Ltd. We do not store your card details — Stripe handles them directly. Stripe may transfer data to the USA under EU Standard Contractual Clauses.
• Brevo: Transactional and lifecycle emails (e.g. welcome, trial, billing) are sent via Brevo (Sendinblue SAS, France/EU). We share your email address and the relevant account event so the appropriate email can be triggered.
• YouTube API: For playing music videos (subject to YouTube's Terms of Service and Privacy Policy).
• PostHog (EU cluster): Product analytics, heatmaps and session replay. Operated by PostHog Inc. with EU data residency (eu.i.posthog.com). Used only with your consent (or, in jurisdictions where opt-out is sufficient, with notice).
• Microsoft Clarity: Heatmaps and session replay. Operated by Microsoft Corporation. Loaded only with your analytics consent (same toggle as PostHog); Microsoft may transfer data to the USA under EU Standard Contractual Clauses.
• Google Analytics 4: Aggregate traffic and usage reporting. Operated by Google. Loaded only with your analytics consent (same toggle as PostHog), using Google Consent Mode; Google may transfer data to the USA under EU Standard Contractual Clauses.
• Advertising (Meta, TikTok, Google Ads): Conversion measurement for our advertising — we report sign-ups and purchases to these platforms (both in your browser via their pixels and server-to-server via their Conversions APIs) so we can measure ad performance. Your email is shared only in hashed (irreversible SHA-256) form. Used only with your separate advertising consent (off by default); these providers may transfer data to the USA under EU Standard Contractual Clauses.

6.2 Legal Requirements

We may disclose your data if required by law, court order, or to protect our legal rights.

7. Data Storage and Retention

• Active Accounts: Data stored while your account is active
• Deleted Accounts: Data deleted within 30 days of account deletion
• Anonymous Users: Fingerprint data retained for 90 days for abuse prevention
• Legal Retention: Some data (e.g., payment records) retained for tax/legal requirements (up to 10 years)

All data is stored on servers located in the European Union (Germany/EU data centers) in compliance with GDPR.

8. Your Rights (GDPR)

You have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): Request a copy of your personal data
• Right to Rectification (Art. 16 GDPR): Correct inaccurate data
• Right to Erasure (Art. 17 GDPR): Delete your data ("right to be forgotten")
• Right to Restriction (Art. 18 GDPR): Limit how we process your data
• Right to Data Portability (Art. 20 GDPR): Receive your data in a machine-readable format
• Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests
• Right to Withdraw Consent (Art. 7(3) GDPR): Withdraw consent at any time

To exercise these rights, contact us at: hello@digdeeper.fm

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority:

10. Data Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or destruction. This includes:

• HTTPS encryption for all data transmission
• Secure authentication via OAuth providers
• Regular security audits and updates
• Access controls and employee training
• EU-based secure server infrastructure

11. Cookies, Tracking and Analytics

In short: essential cookies keep the site working, and — only with your consent — we use analytics to understand how DigDeeper is used so we can fix problems and make it better. Nothing more.

11.1 Cookie & Tracking Categories

• Essential: Sign-in, search credits and basic security. Always on — the site can't work without them. No consent needed (§ 25(2) TDDDG, Art. 6(1)(b) GDPR).
• Analytics (optional): Used only with your consent (Art. 6(1)(a) GDPR / § 25(1) TDDDG) and switchable off at any time. We use PostHog (EU-hosted), Microsoft Clarity and Google Analytics 4 to understand how the site is used — including page views, interactions, feature usage, heatmaps and session replay, which can include your search queries and the tracks you interact with. Once you sign in, this is linked to your account.
  Note on session replay: recordings reconstruct your visit (mouse, clicks, scrolling, page content). Password fields are masked and payment fields are blocked, but other text you type into forms is not masked by default and may be captured. Recordings are kept for 30 days.
• Advertising / Marketing (optional, off by default): Conversion-measurement for Meta, TikTok and Google Ads (see section 6). This category is separate from analytics, off by default, and requires your explicit opt-in (Art. 6(1)(a) GDPR / § 25(1) TDDDG). You can enable, disable or withdraw it independently of analytics at any time.

11.2 Geo-Aware Consent

We determine your country server-side to comply with the law applicable to your visit:

• Opt-in jurisdictions (EU/EEA, UK, Switzerland, Brazil, Peru, Uruguay, South Korea, Thailand, India, China, Vietnam, Indonesia, Turkey, Saudi Arabia, UAE, South Africa, Russia): A consent banner is shown on your first visit. Analytics and session replay only start after you click "Accept all".
• Notice-and-opt-out jurisdictions (United States outside California with GPC, Canada, Mexico, Argentina, Chile, Colombia, Australia, New Zealand, Japan, Singapore, Hong Kong): Analytics start automatically based on this notice. You can opt out at any time via the "Privacy Settings" link in the footer.
• Global Privacy Control (Sec-GPC): If your browser sends the Sec-GPC signal, both analytics and advertising are disabled regardless of jurisdiction. This satisfies the universal opt-out requirements of California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas.

Advertising is always opt-in. Regardless of your jurisdiction, the advertising/marketing category is never enabled automatically — it requires your explicit, affirmative opt-in and is off until you give it.

11.3 Withdrawing Consent

You can change your decision for each category independently at any time via the Privacy Settings link in the footer. Withdrawing analytics consent stops further tracking, stops session recording, and clears the corresponding cookies and localStorage entries from your browser. Withdrawing advertising consent disables the Meta, TikTok and Google Ads pixels and instructs those providers to stop using cookies for you. Past events that were already transmitted with your consent remain at the respective provider until retention expires (12 months for analytics events, 30 days for session recordings).

12. Country Detection (IP Geolocation)

To decide whether a consent banner is legally required for your visit, we resolve your country (and, for US visitors, your state) from your IP address server-side. No IP address is sent to a third-party geolocation service. We use one of two sources:

• CDN headers (if available): When traffic is routed through our CDN, the country code is already present in the request headers — no lookup or storage on our side.
• DB-IP IP-to-Country Lite database (db-ip.com), licensed under CC BY 4.0, loaded into our application's memory. Lookups happen entirely on our server.

The resolved country code is used only to gate the consent banner. It is not persisted to your user profile or shared with any third party.

13. YouTube Embedded Content

Our service embeds YouTube videos via the YouTube API. When you play a video, YouTube may collect data about your viewing behavior. This is subject to YouTube's Privacy Policy:https://policies.google.com/privacy

14. Children's Privacy

Our service is not intended for users under 16 years of age. We do not knowingly collect data from children. If you believe we have inadvertently collected data from a child, please contact us immediately.

15. Changes to This Privacy Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. We will notify you of significant changes via email or a prominent notice on our website. The "Last updated" date at the top indicates when the policy was last revised.

16. Contact Us

For questions about this privacy policy or to exercise your rights, contact us:

17. MVP Notice

This service is currently operating as a Minimum Viable Product (MVP) for validation purposes. We are committed to maintaining full compliance with GDPR and German data protection laws during this period. User feedback and data handling practices may be adjusted based on validation results.