Privacy Policy

Who is responsible

[Operator legal name], [Street address, postal code, city, country], is the controller responsible for personal data processed through Sonvi. For any privacy question, contact [email protected].

What data we process

You can use the site without an account. If you choose to log in with Google, we also receive your name, email address and profile picture from Google. We process the following data:

• Anonymous user ID: a random identifier created in your browser on your first visit, used to keep your ratings and reports together.
• Session token: a short-lived access token issued for that ID and used to authenticate requests to our API.
• Ratings and reports: the song concerned, your rating or report reason, and any optional text you enter. Please do not include personal information in report text.
• Searches and song wishes: the words you search for, stored only as daily totals per search phrase and never linked to your ID, and any song wish you submit, which is linked to your anonymous ID so we can tell you when the song is ready.
• Favorites: the songs you mark as favorites, linked to your anonymous ID.
• Technical data: IP address, browser and device information, requested URLs and timestamps, processed in server and security logs.
• Preferences: your interface language, song-language filter and whether you dismissed the site notice.
• Messages: if you email us, your email address and the content of your message.
• Account (only if you log in): the name, email address and profile picture provided by your Google account, plus a Google account identifier, linked to your user record and kept until you ask us to delete it. When you log in, the favorites, wishes, ratings and reports saved under your anonymous ID are merged into your account.

Why we process it

• To provide the site, streaming and downloads (performance of our Terms, Art. 6(1)(b) GDPR).
• To save ratings and handle reports and copyright notices (our legitimate interest in operating and moderating the catalog, Art. 6(1)(f) GDPR).
• To learn which songs listeners are missing, create new music based on search totals, wishes and favorites, and notify you when a song you wished for is published (our legitimate interest in improving the catalog, Art. 6(1)(f) GDPR).
• To keep the site secure, prevent abuse and fix errors (legitimate interest, Art. 6(1)(f) GDPR).
• To meet legal obligations, such as answering lawful requests from authorities (Art. 6(1)(c) GDPR).

We do not sell personal data or share it for cross-context behavioral advertising. We do not show ads or use third-party analytics or advertising trackers.

First-party website statistics

To understand website use and improve the service, we collect page views, page paths without query parameters, and referring domain names. We estimate daily visitors using a keyed hash of the UTC date, IP address and coarse browser information. Analytics storage contains neither raw IP addresses nor full user-agent strings, full referrer URLs or search terms. We add no persistent browser identifier and do not identify returning visitors across days. Aggregates are kept for 24 months; daily pseudonymous keys and event deduplication records are deleted after 14 days. Shared networks or network changes can affect visitor estimates.

Cookies and local storage

We do not set cookies for tracking or advertising. The site keeps the following items in your browser's local storage; they are strictly necessary for the site to work or store choices you made:

• music_web_user_id: your anonymous user ID, kept until you clear it.
• music_web_api_session: your session token and its expiry time.
• museflow_ui_locale and museflow_content_language: your language preferences.
• sonvi_notice: remembers that you dismissed the site notice.

You can delete these items at any time in your browser settings. The site will then create a new anonymous ID on your next visit.

Service providers

• Cloudflare, Inc.: hosting, content delivery, database, file storage and security for the site and the API.
• Google Fonts (Google LLC): web fonts are loaded from Google's servers, so your IP address is sent to Google when a page loads.
• YouTube (Google LLC): some song pages embed a video in privacy-enhanced mode (youtube-nocookie.com). YouTube receives data when the player loads and may store data on your device once you play the video.
• Google LLC (Google Sign-In): if you choose to log in with Google, Google authenticates you and shares your name, email address and profile picture with us. Google’s own privacy policy applies to its processing.

These providers process data on our behalf or, where stated in their own privacy policies, as independent controllers.

International transfers

Our providers may process data outside your country, including in the United States. Where required, transfers are based on adequacy decisions or on the Standard Contractual Clauses of the European Commission.

How long we keep data

• Session tokens expire automatically and are then deleted.
• Ratings are kept while the related song remains in the catalog.
• Search totals are kept for up to 24 months; the daily pseudonymous keys used to count unique searchers are deleted after 14 days. Wishes, favorites and notifications are kept until you ask us to delete them or the related song is removed.
• Reports and copyright notices are kept for up to 3 years to document how they were handled.
• Server and security logs are kept for up to 30 days, unless they are needed to investigate abuse.

Your rights

Depending on where you live (for example under the GDPR, the UK GDPR or California law), you have the right to access, correct or delete your data, to restrict or object to its processing, to data portability, and to withdraw any consent you gave.

To exercise these rights, email [email protected] and include your anonymous user ID if possible (you can find it in your browser's local storage). You may also complain to your local data protection authority. We will not treat you differently for exercising your rights.

Children

The site is not directed to children under 13 (under 16 in the EEA and the UK), and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

Security

We protect data with HTTPS, access controls and short-lived tokens. No method of transmission or storage is completely secure, but we work to protect your data and to respond quickly to incidents.

Changes to this policy

We will post any update to this policy on this page and change the date at the top. If a change materially affects you, we will also announce it on the site.