Privacy Policy
Last updated: 28 September 2026
In this Policy we explain, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), what personal data we process when you use Songtape, for what purposes, on what legal basis, for how long, and what your rights are.
1. Data controller
- info@songtape.com
- Website
- songtape.com
For any matter relating to your personal data you can write to info@songtape.com.
2. Data we process
- Account data: name, email address, username, profile photo (if you sign in with Google) and internal user ID.
- User Content: songs, lyrics, chords, tabs, albums, setlists, concerts, calendar, expenses, audio files and any other information you upload, as well as project membership and activity within projects.
- Billing data, if you subscribe to Pro: name, billing country and address, VAT number if provided, payment history and Stripe customer IDs. Full card details are processed directly by Stripe; Songtape has no access to them.
- Technical data: IP address, browser and device type, language and technical logs needed for the security and operation of the Service.
- Browsing analytics data, only if you accept analytics cookies.
- Communications: the messages you send us by email.
User Content belongs to you, as set out in the Legal Notice and Terms. We only process it to provide the Service and never use it for advertising or to train artificial intelligence models.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing your account and providing the Service: storing your content, enabling collaboration with your band, processing audio and generating exports. | Performance of the contract (Art. 6.1.b GDPR). |
| Managing the subscription, payments and invoicing. | Performance of the contract and compliance with tax and accounting obligations (Art. 6.1.b and 6.1.c GDPR). |
| Sending you service emails: welcome, project invitations and notices about your subscription or storage. | Performance of the contract (Art. 6.1.b GDPR). |
| Handling your enquiries, complaints and requests to exercise your rights. | Compliance with legal obligations (Art. 6.1.c GDPR) and legitimate interest in assisting you (Art. 6.1.f GDPR). |
| Ensuring the security of the Service and preventing fraud and abuse. | Legitimate interest (Art. 6.1.f GDPR). |
| Measuring website usage to improve it (Google Analytics). | Consent (Art. 6.1.a GDPR), which you can withdraw at any time. |
We do not make automated decisions with legal effects on you, we do not profile you for commercial purposes, and we will not send you marketing communications without your prior consent.
4. Retention periods
- Account data and Content: while the account is active. When you delete content or your account, the data is erased from active systems and, where applicable, from backups within a maximum of 30 days. Projects you own are deleted with your account; your contributions to projects owned by others may remain in them as part of the band's shared work, and you can request their deletion by writing to info@songtape.com.
- Billing data: for the periods required by commercial and tax law (up to six years).
- Analytics data: the period configured in Google Analytics, up to a maximum of 14 months.
- Once erased, some data may be kept blocked, available only to judges, courts and competent authorities, for the limitation period of any possible liabilities (Art. 32 LOPDGDD).
5. Recipients
We do not sell or transfer your personal data. It is only disclosed to:
- Members of the projects you take part in, who will see your name, profile photo and your activity and content within the project, as well as people with whom you choose to share a public link.
- Google Ireland Limited and Google LLC (Firebase and Google Cloud), as processors: hosting, database, file storage, authentication, server functions, email delivery and, only with your consent, Google Analytics.
- Stripe Payments Europe, Ltd., for payment processing and subscription management.
- Public authorities, judges and courts, where there is a legal obligation.
6. International transfers
Songtape's main database is hosted in the European Union. However, audio files are stored on Google Cloud servers located in the United States, and Google and Stripe may process data from that country. These transfers are covered by the European Commission's adequacy decision on the EU-US Data Privacy Framework, under which Google LLC and Stripe, Inc. are certified, and additionally by the standard contractual clauses approved by the European Commission.
7. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent given, without affecting the lawfulness of prior processing. To do so, write to info@songtape.com stating the right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for additional information. We will reply within one month.
You can also delete your account directly from your profile and change your consent to analytics cookies at any time from the Cookie Policy.
If you consider that the processing of your data does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence.
8. Minors
The Service is not intended for children under 14 (Art. 7 LOPDGDD). If we find that a child under that age has registered without the consent of their parents or guardians, we will delete their account.
9. Security
We apply technical and organisational measures appropriate to the risk, including: encryption of communications (HTTPS/TLS), encryption of stored data by our infrastructure provider, security rules that prevent users from accessing projects they are not members of, and authentication managed by Firebase.
11. Changes to this Policy
We may update this Policy to reflect legal or Service changes. We will inform you of relevant changes by email or through a notice in the Service.