Privacy policy

Who is responsible

SpotRecap AB, registered in Sweden and based in Gothenburg, is the data controller for personal data processed through this website and the application. Contact: privacy@spotrecap.com.

What we collect

• Account data — name and email address, used to create and secure your account.
• Listening data — the streaming history you choose to import, including play timestamps, track identifiers and associated audio features.
• Usage data — the questions you ask the assistant and the answers it returns, kept so the model can improve for your account.
• Technical data — server logs with IP address, browser type and timestamps, retained for security and abuse prevention.

We do not buy personal data, and we do not collect data about you from third parties for advertising.

Why we process it

We process listening and account data to provide the service you have asked for (contract), to keep the service secure and working (legitimate interest), and to answer your messages (legitimate interest). Where we would like to send product updates, we ask for consent and you can withdraw it at any time.

Where it is stored

All personal data is stored in the European Union. Listening history is held single-tenant: your records are not mixed into a shared pool with other accounts. Databases are encrypted at rest and reachable only over a private network.

Who we share it with

We use a small number of infrastructure and model providers to run the service. They process data on our instructions under written agreements and are not permitted to use it for their own purposes. We never sell personal data. A current list of sub-processors is available on request.

AI features may send the content of a question — and the minimum data required to answer it — to a model provider. We route through providers that contractually exclude training on our data.

How long we keep it

Listening data is kept for as long as your account exists. If you delete your account, application data is removed within 30 days and backups are purged within 90 days. Server logs are kept for 30 days. Correspondence is kept for up to 24 months.

Your rights

Under the GDPR you can request access to your data, correction of it, deletion, restriction of processing, portability, and you can object to processing based on legitimate interest. Write to privacy@spotrecap.com and we will respond within 30 days. You may also complain to the Swedish Authority for Privacy Protection (IMY).

Cookies

This website sets no cookies of any kind — no analytics, no advertising, no consent banner needed. The SpotRecap application uses a single session cookie required for sign-in, which is strictly necessary and expires when you sign out. If we ever add optional analytics, this policy will name it and a consent control will ship with it.

Changes

If this policy changes materially we will note the change on this page and, where the law requires it, notify account holders by email.