This policy explains what data the Muzylo service (website, web app, mobile apps and players) processes, why, and for how long. Questions: [email protected].
The short version
- Reference tracks you upload are deleted within 24 hours of feature extraction. They never enter the catalog, are never logged and are never used for training.
- Card numbers are handled by the payment provider; we never see them.
- The website uses no advertising or analytics cookies. The mobile apps use no advertising identifiers and don't track you across other companies' apps or websites.
- You can delete your account in the app, on the web or by email: here's how.
- Accounts, venues and playback history of muzylo.com customers are stored in the EU.
What we process
- Account: email address, name (if given), role in the organisation.
- Sign in with Apple, Google or VK ID: your user id at that provider, your email address and your name if you choose to share it. Apple may give us a private relay address (@privaterelay.appleid.com) that forwards to your email. We never receive your password for these services. For Sign in with Apple we keep a refresh token, encrypted, only to revoke Muzylo's access at Apple when you delete your account. We don't store Google or VK tokens.
- Organisation and venues: name, legal name and address (if given), venue type, time zone, opening hours, zones.
- Sign-in sessions: the IP address and the browser or app version (user agent) of each session, for security.
- Player operation: device status (online/offline), cache size, playback events (which track, when, in which zone), likes and dislikes, vibe changes and any text you type to steer the music.
- References: uploaded audio, only until musical features (tempo, key, genre, instruments) are extracted; the features are kept, the audio is deleted.
- Billing: plan, subscription status, amounts and dates. Card data is processed by Paddle, our reseller and merchant of record, which receives your email, country and payment details for the purchase and handles them as an independent controller.
- In-app purchases: a subscription bought in a mobile app is sold and billed by the App Store (Apple), Google Play (Google) or RuStore. The store sends us transaction and subscription ids, the product, status, renewal dates and price. We never receive your card or store payment details.
- Visits to muzylo.com: the pages opened and how far they were scrolled, the referring site, browser, device type and approximate location from the IP address. PostHog (EU) counts them without cookies or browser storage: visitors are told apart by a hash computed on PostHog's servers that changes every day, not by an identifier on your device.
- Support: your conversations with our team.
Why
- To keep the music playing: stations, schedules, queues, offline cache.
- For compliance: playback history with rights-record ids is evidence that the Muzylo catalog was playing.
- For billing, support, security and abuse prevention.
- To improve the service: we record product events (sign-up and its method, setup steps such as the venue type and mood chosen, player pairing, checkout and subscription changes) under your account and organisation ids, without your name or email, in PostHog, a product analytics service with servers in the EU. They are not used for advertising.
- To improve the website: visit statistics, with no advertising and no visitor profiles.
Mobile apps
- On the device: the app keeps tracks for offline playback in its own storage, its sign-in key in the system's secure storage (Keychain or Keystore), and your region and language choice. Signing out removes the sign-in key, and uninstalling the app removes all of it from the device.
- Region: on first launch the app uses the device's region and time zone to choose the Muzylo regional server. This happens on the device.
- No tracking: the apps contain no advertising SDKs, don't use advertising identifiers (IDFA, Android advertising ID) and don't track you across other companies' apps or websites. They don't ask for access to your location, contacts, camera or microphone.
The certificate verification page
Anyone who scans a certificate's QR code can open its verification page and see the licence status, venue name, plan, territories and validity. No other account data is shown there.
Retention
- Reference audio: no more than 24 hours.
- Playback events: 400 days (so playback can be evidenced for the past year). When an organisation is deleted, its playback history is deleted with it, apart from the evidence record for licensing claims (next item).
- Evidence for licensing claims about the organisations that are closed, stored under internal ids only, without names, email addresses, IP addresses, devices or anything you typed: which Muzylo tracks played in which venue and zone, when, in which country and under which rights record, kept for 400 days from each play, as for a venue that is still open; and the rights records of the organisations' own tracks and the status and dates of their compliance certificates, kept for 3 years from the deletion (a common limitation period for claims, for example three years under 17 U.S.C. § 507(b) in the United States and § 195 BGB in Germany). We keep it on the basis of our legitimate interest in answering claims by collecting societies about the time Muzylo covered the venue, and use it for nothing else. Then it is deleted. A check of a closed organisation's certificate (its QR code) shows it as revoked.
- Sign-in sessions, with their IP address and user agent: up to 30 days while the account exists; deleted with the account.
- Product analytics events: while the account exists; when the account is deleted we delete them from PostHog with the account's profile.
- Apple refresh token: while Sign in with Apple is linked; on account deletion it is revoked and deleted.
- Payment records: while the organisation exists; after it is closed, with the organisation's name, legal name, tax id and country, until 1 January of the eleventh year after the year of payment, then deleted.
- Account data: while the account is active, then deleted or anonymised, except where the law requires us to keep it (e.g. billing records).
Deleting your account
You can delete your account in the app (the Account tab → Delete account), in the web app (Account → Delete account) or by emailing [email protected] from your account's address. What is deleted at once and what is kept, and for how long, is on the Delete your account page. If the deletion closes an organisation you own and you signed in more than 15 minutes ago, we ask for a 6-digit code emailed to your account's address. When the account is deleted, we email a confirmation to that address. A subscription bought in an app store must be cancelled in the store: deleting the account doesn't cancel it.
Who we share data with
Only the processors the service can't run without: hosting and content delivery, file storage, email delivery, payment providers and venue search on the map (Google Maps through the SerpKite service), product analytics (PostHog, EU). We don't sell data or share it with ad networks.
When you sign in with Apple, Google or VK ID, or buy a subscription in the App Store, Google Play or RuStore, that provider processes your data under its own terms as an independent controller.
Your rights
You can request a copy of your data, correct or delete it, or withdraw consent: email [email protected]. For users in the EU and the UK we process data under the GDPR and the UK GDPR; we take these requests from users in every country.
Cookies
See Cookies for cookies and local storage.
Changes
If this policy changes materially, we'll tell you in advance by email or in the app.