Privacy Policy

Who is responsible

[Operator legal name], [Street address, postal code, city, country], is the controller responsible for personal data processed through Sonvi. For any privacy question, contact [email protected].

What data we process

You do not need an account to use the site, and we never ask for your name or email address. We process the following data:

• Anonymous user ID: a random identifier created in your browser on your first visit, used to keep your ratings and reports together.
• Session token: a short-lived access token issued for that ID and used to authenticate requests to our API.
• Ratings and reports: the song concerned, your rating or report reason, and any optional text you enter. Please do not include personal information in report text.
• Technical data: IP address, browser and device information, requested URLs and timestamps, processed in server and security logs.
• Preferences: your interface language, song-language filter and whether you dismissed the site notice.
• Messages: if you email us, your email address and the content of your message.

Why we process it

• To provide the site, streaming and downloads (performance of our Terms, Art. 6(1)(b) GDPR).
• To save ratings and handle reports and copyright notices (our legitimate interest in operating and moderating the catalog, Art. 6(1)(f) GDPR).
• To keep the site secure, prevent abuse and fix errors (legitimate interest, Art. 6(1)(f) GDPR).
• To meet legal obligations, such as answering lawful requests from authorities (Art. 6(1)(c) GDPR).

We do not sell personal data or share it for cross-context behavioral advertising, we do not show ads, and we do not use analytics or advertising trackers.

Cookies and local storage

We do not set cookies for tracking or advertising. The site keeps the following items in your browser's local storage; they are strictly necessary for the site to work or store choices you made:

• music_web_user_id: your anonymous user ID, kept until you clear it.
• music_web_api_session: your session token and its expiry time.
• museflow_ui_locale and museflow_content_language: your language preferences.
• sonvi_notice: remembers that you dismissed the site notice.

You can delete these items at any time in your browser settings. The site will then create a new anonymous ID on your next visit.

Service providers

• Cloudflare, Inc.: hosting, content delivery, database, file storage and security for the site and the API.
• Google Fonts (Google LLC): web fonts are loaded from Google's servers, so your IP address is sent to Google when a page loads.
• YouTube (Google LLC): some song pages embed a video in privacy-enhanced mode (youtube-nocookie.com). YouTube receives data when the player loads and may store data on your device once you play the video.

These providers process data on our behalf or, where stated in their own privacy policies, as independent controllers.

International transfers

Our providers may process data outside your country, including in the United States. Where required, transfers are based on adequacy decisions or on the Standard Contractual Clauses of the European Commission.

How long we keep data

• Session tokens expire automatically and are then deleted.
• Ratings are kept while the related song remains in the catalog.
• Reports and copyright notices are kept for up to 3 years to document how they were handled.
• Server and security logs are kept for up to 30 days, unless they are needed to investigate abuse.

Your rights

Depending on where you live (for example under the GDPR, the UK GDPR or California law), you have the right to access, correct or delete your data, to restrict or object to its processing, to data portability, and to withdraw any consent you gave.

To exercise these rights, email [email protected] and include your anonymous user ID if possible (you can find it in your browser's local storage). You may also complain to your local data protection authority. We will not treat you differently for exercising your rights.

Children

The site is not directed to children under 13 (under 16 in the EEA and the UK), and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

Security

We protect data with HTTPS, access controls and short-lived tokens. No method of transmission or storage is completely secure, but we work to protect your data and to respond quickly to incidents.

Changes to this policy

We will post any update to this policy on this page and change the date at the top. If a change materially affects you, we will also announce it on the site.