Privacy Policy

Who is responsible

The data controller is [OWNER NAME], [CITY], Italy. Contact: [CONTACT EMAIL].

You can complain to the Italian data protection authority (Garante per la protezione dei dati personali, garanteprivacy.it).

What we collect when you share a story

Your story (text and/or voice recording, and its transcript), the song, your pseudonym, optional theme tags and a short 'where/when' note. These are published if you agree and we approve the story.

Your email address. It is never published. We use it only to confirm your submission, tell you when your story is published, and send you your private link to edit or remove it.

A record of your consent (which boxes you ticked, when, and which version of these texts you saw).

Legal basis: your consent (GDPR art. 6(1)(a)). You can withdraw it at any time with your private link.

Name and email are optional

You can share a story without a name (it is shown as 'Anonymous') and without an email address. Without an email we can't send you a private link to edit or remove your story; write to [CONTACT EMAIL] and we will remove it for you.

Live listening sessions

When you tick the box on the story form, you also agree that your recording may be played at Beyond Listening's live listening sessions (for example during Dutch Design Week). Your email is never shown there either.

If you register for a session, we keep your name, email and the optional note about your song to organise the evening, and delete them 30 days after the session.

If you send a booking request, we keep your message and contact details to answer you, and delete them after 12 months.

Uploaded songs

If a song isn't online, you can upload it. You confirm that you made the recording or may share it. Uploaded songs are stored privately and played only through short-lived links. Rights holders can ask us to remove a file at [CONTACT EMAIL].

Voice recordings

If you record your story, your voice may be recognisable to people who know you. Recordings are stored privately and played only through short-lived links. We don't use recordings to identify anyone.

Speech-to-text runs inside your own browser: your recording is not sent to any transcription service.

What we collect when you visit

We don't use analytics, advertising or tracking cookies.

To prevent abuse (spam, fake reactions), we store a one-way, salted hash of your IP address for up to 30 days. The salt changes every day and is deleted after two days, so the hash cannot be linked back to you. Legal basis: legitimate interest (art. 6(1)(f)).

Your browser stores which reaction you chose (local storage), so you can change it. Admin login uses a strictly necessary cookie. No consent banner is needed for these.

Services that see some data

Song search and 30-second previews come from Deezer and Apple (iTunes). When you search or play a preview, your browser or our server contacts them, as with any website that embeds media.

Speech-to-text model files are downloaded once from Hugging Face.

[DRAFT: when going online, list the hosting, database and email providers here, with their locations and safeguards.]

How long we keep data

Unconfirmed submissions: 72 hours. Rejected stories: 30 days. Published stories: until you remove them. Your email: until you remove your story or delete your email with your private link. IP hashes: 30 days. Backups: 30 days.

Your rights

You can access, correct, export or delete your data. The quickest way is your private link (Manage my story). For anything else, write to [CONTACT EMAIL]. We answer within 30 days.