This policy explains what personal data SongsBrew collects, why, who handles it, how long we keep it and what rights you have. We try to keep it short and plain.
1.Who is responsible for your data
The controller is:
Hernas OÜ
Kentmanni 4
10116 Tallinn
Estonia
Email: hi@songsbrew.com. Write "Data Protection" in the subject line.
Hernas OÜ also runs FreeYourMusic. If you sign up to the SongsBrew newsletter through FreeYourMusic (its website or app), FreeYourMusic passes your email address to SongsBrew. This policy then applies to the newsletter data, and the FreeYourMusic privacy policy applies to your FreeYourMusic account. Hernas OÜ is the controller for both.
2.What we collect and why
| What | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email address, sign-up source, time of confirmation | Send the newsletter you asked for | Consent (double opt-in) |
| Display name (optional) | Show your name on comments | Consent / contract |
| Email opens and link clicks | Know which posts readers like; measure the newsletter; filter out bots | Legitimate interest. |
| Login links and session | Let you log in without a password | Contract (providing the account you asked for) |
| Sign-in with Apple or Google: the provider's account id for you and the email address it shares | Let you log in with that account | Contract (providing the account you asked for) |
| Comments | Publish your comment, moderate, prevent abuse | Contract and legitimate interest |
| Community posts, comments, upvotes and reports | Publish what you post, run Community, moderate, prevent abuse | Contract and legitimate interest |
| Poll votes | Count your vote and show you the results; one vote per reader | Legitimate interest |
| IP address and request logs | Security, rate limiting, abuse prevention | Legitimate interest |
| Submission details from artists | Review music and feature it | Legitimate interest and steps at your request |
| Artist records: name, profile links, genre, location, email, answers about AI and social posts, under-18 and guardian consent, the team's votes and notes | Decide whether to feature an artist and plan the posts | Legitimate interest and steps at your request |
| Write for us applications: your name, email, idea, up to two links to things you have written, the section, and for gigs your city or region and how often | Reply to your application, edit and publish your piece with your byline, offer you gigs | Steps at your request |
| Writers Pool: your name, email, author page, your pieces (text, images, cover, suggested tags), our notes and the emails we sent you | Let you write in the writer space, edit and publish your pieces with your byline, tell you where each piece stands | Steps at your request |
| Partnership enquiry details | Reply to you | Steps at your request |
| Brand role addresses from public pages, and the pitches we send to them | Offer sponsorship on SongsBrew | Legitimate interest |
| Bounce and complaint records | Stop sending to addresses that bounce or complain | Legitimate interest |
| Records we must keep (for example invoices) | Estonian accounting law | Legal obligation |
We do not sell personal data. We do not show advertising based on your data. Sponsors receive no personal data about readers, only overall figures such as the number of subscribers and the average open rate.
4.Reader accounts, comments and Community
- There is no password. You enter your email and we send a login link, valid for 15 minutes and usable once. Only people who have confirmed a newsletter subscription, or who signed in with Apple or Google, can log in, including those who later unsubscribed.
- For 3 days after a newsletter goes out, a link to our site in it also logs you in, with no further step. If you are already logged in as someone else in that browser, it does not switch you. Anyone you forward the newsletter to can log in as you the same way, so forward it with care.
- You can also sign in with Apple or Google. We receive the provider's account id for you and the email address it shares, which with Apple may be a private relay address. If Apple shares your name, we do not keep it. Signing in this way joins the SongsBrew account with the same address, or creates one and subscribes you to the newsletter once you confirm the email we send. You can connect or disconnect these sign-ins on your account page. Apple and Google handle the sign-in itself under their own privacy policies.
- Logging in sets a session cookie (section 7). We store a hashed copy of the session token, its expiry and roughly when it was last used.
- Comments are public. We show your display name and your comment, and the time. We do not show your email address. You can edit or delete your own comments. We may hide or delete comments that break the Terms of Use, and block a reader from commenting.
- In Community, your posts, comments, display name, member handle, bio, the "Currently playing" link you add, the month you joined, your counts and upvote counts are public, and your posts, comments and the songs you drop are listed on your member profile. A "Team SongsBrew" badge marks members who write for SongsBrew. If you use Drop a song, the Spotify track and your member handle are shown publicly on the site, and the track goes into our public Spotify playlist, SongsBrew Community Picks. We do not show your email address. An editor checks your first post before it appears. Reports you send are seen only by our editors. If you use your Crate we store what you logged, your ratings, reviews, lists and who you follow, and your listening dates, and show them on your profile, the record's page and your lists (an unlisted list only to people with its link).
- Articles may have polls. When you vote, we store your answer and the time, linked to your account if you are logged in. Your vote counts toward the results everyone sees; nobody else sees how you voted. Votes are final. To make sure each browser votes only once, voting sets the
sb_votercookie (section 7). - Unsubscribing from the newsletter does not delete your account. You can turn the newsletter back on from your account page. To delete your account, write to us (section 12).
5.Music submissions
If you send music through the Submit Music form we collect what you type in the form: your name or artist name, email, links to your music, any text you provide, and your answers to the questions about rights and AI use. The team reads submissions in an admin inbox and keeps internal notes and a status.
If you add a press photo, by uploading it or by giving us a link we fetch it from, we store a copy with your submission. We may use it in the feature, and we delete it with the submission when you ask us to.
Where we use AI: a purpose-built tool to look up missing information in submissions, and populate draft texts. A person edits every draft before anything is published.
Besides each submission we keep one record per artist: the artist name, links to your public profiles, genre and location, your email if you gave one, a photo you sent or one from your public profiles, and your answers about AI use and social posts. If you tell us you are under 18 we note it, and we only post about you after a parent or guardian agrees, with the date they did. The team records its votes on whether to feature you, its notes, and a history of changes to the record; the history never holds your email address or the notes.
If we feature you, your name, material and links appear on the site and may appear in the newsletter and our social media accounts.
When a post that features you is live, an editor may send you one email with a link to the post and to your share kit: a page on our site that is not listed anywhere and is hidden from search engines, with an Instagram Story image made from your artist name, your photo if we have one, the release and the post's address, a "Featured on SongsBrew" badge for your website, and a link to the post. We only send it when an editor presses send, to the email address on your artist record. For each one we send we keep the post, the address, when it went out, who sent it and whether it was delivered. If you would rather not get it, reply to our email or write to hi@songsbrew.com.
If you submit a gig we store the details you give, the poster if you add one, and your email so we can contact you about it. We publish the gig details and poster on the Gigs page if we approve it; we never publish your email.
If you apply through Write for us we store your name, email, your idea, up to two links to things you have written, the section you picked and, if you sign up for gigs, your city or region and how often you are up for one. We never fetch your links; an editor opens them. We use these details to reply, to edit and publish your piece with your byline, and to offer you gigs; for a gig we offer, we keep the artist, venue, date and whether press access is confirmed, with the emails we sent you. We do not send you a confirmation email. We delete your application when you ask.
If we say yes to your Write for us application, or add you ourselves, you join the Writers Pool. We keep your name, your email address, the author page we make for your byline, whether your place is active or paused, and which Write for us application brought you in. You use the writer space on our site with your normal SongsBrew login, and we link your Writers Pool place to your account when you first open it. There we keep your pieces as you write them: the title, subtitle, text, images you upload, a cover image, the tags you suggest, when you saved and sent each piece, and the notes our editors send you. Our editors read a piece once you send it, edit it, and publish it on SongsBrew with your byline; the published post and its earlier versions, yours included, are kept with our posts. We email you when you join, when we get a piece, when we send it back with notes or decide not to run it, and when it goes live, and we keep a record of each of those emails and whether it was delivered. When you send a piece, or send in a Write for us application, our editors get a short email about it. When you first open the writer space, and when the contributor terms change, we record which version you agreed to and when. We keep that record, and one copy of each piece of yours we published or took down, for as long as we keep any piece of yours and for 5 years after, so we can deal with questions or legal claims. Then we delete them. We also record that you confirmed you're 18 or older, and that each piece you send is new.
6.Partnership enquiries and sponsor outreach
If you use the Partnerships form we store your name, email, brand, phone number (if given) and message, and email them to our team. If you use the booking form we store your name, email, brand, what you are promoting and its link, the placement, the Thursdays and budget you picked, and your message (if given), and email them to our team. We use them only to reply about your request, and delete them when you ask.
To find sponsors, we look for role business addresses, like ads@ or partnerships@, that brands publish on their own websites and in their newsletters, and write to them to offer sponsorship on SongsBrew. We rely on legitimate interest. We keep the address and the pitches we sent until the brand asks us to stop or to delete them. If you would rather not hear from us, reply to our email or write to hi@songsbrew.com, and we will not write again.
8.Analytics and error reporting
- Visit statistics count pages viewed, referrers, country and device type, without cookies and without building profiles of individuals.
- The share kit's link and badge add tags to the post's address (where the visit came from, the post and the artist's name), so our visit statistics can count the visits an artist sent us. If someone signs up for the newsletter on a page they opened from that link, we record "Artist share kit" as where the sign-up came from. Nothing is stored in their browser for this.
- Sentry receives technical error reports (the page, the browser and a stack trace) so we can fix bugs, with personal data stripped.
- Our servers keep request logs for security and debugging, only as long as we need them, not indefinitely.
10.Transfers outside the EEA
We host in the EU. Mailgun, Cloudflare, Sentry and our AI service may process data in the United States. Where they do, we rely on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
11.How long we keep data
| Data | Kept for |
|---|---|
| Subscriber record | Until you ask us to delete it. If you unsubscribe, it is kept marked unsubscribed, so we never email you again and you can still log in. |
| Email opens and clicks | Until you ask us to delete them, or your subscriber record is deleted |
| Login links | Work for 15 minutes; deleted about a day after they are used or expire |
| Reader sessions | 90 days after your last visit, and never more than a year after you logged in; deleted when they expire or you log out |
| Comments | Until you or we delete them. A deleted comment's text is kept for 30 days for moderation, then erased. If your account is deleted, the text of your comments is erased at once. |
| Community posts and comments | Until you or we delete them, or you ask us to. A deleted post's or comment's text is kept for 30 days for moderation, then erased. If your account is deleted, their text is erased at once. |
| Songs you drop | Kept, and stay in the public playlist. When your account is deleted they are unlinked from you: your handle is no longer shown with them. |
| Upvotes and reports you send | Until your account is deleted |
| Apple and Google sign-ins | Until you disconnect them or your account is deleted |
| Referrals: who signed up through your referral link and confirmed, and the rewards you reached | As long as your subscriber record; deleted with it |
| Poll votes | Kept with the poll. A vote cast while logged in is linked to your account; if your account is deleted, the vote still counts but is no longer linked to your account. |
| Submissions and partnership enquiries | Until you ask us to delete them; a featured submission stays while the feature is on the site |
| Gig submissions: the details, the poster and your email | Until the gig has passed and 12 months after, or until you ask us to delete it |
| Artist records, with the team's votes, notes and history | Until you ask us to delete them; a featured artist stays while the feature is on the site |
| Share kit emails we sent you (the post, the address, when, who sent it, delivery) | Until you ask us to delete them; they go when your artist record is deleted |
| Write for us applications, our emails about them and gig offers | Until you ask us to delete them |
| Writers Pool place, pieces and our emails about them | Until you ask us to delete them. If you leave or we remove you from the Writers Pool, we keep your drafts and declined pieces for 12 months so you can ask for a copy, then delete them, unless you tell us to keep them. A piece we published stays on the site with your byline as a post. |
| Contributor terms records: which version you agreed to and when, and one copy of each piece of yours we published or took down | As long as we keep any piece of yours, and 5 years after that, so we can deal with questions or legal claims. Then we delete them. |
| Brand addresses and the pitches we sent them | Until the brand asks us to stop or to delete them |
| Do-not-email list (bounces, complaints and requests to stop) | Kept, even after the rest of your data is deleted, so we never email that address again |
| Accounting records | 7 years, as Estonian law requires |
| Request logs, error reports and backups | Only as long as we need them to run, secure and fix the service, not indefinitely |
12.Your rights and how to use them
Under the GDPR you can:
- Access the data we hold about you and get a copy.
- Correct data that is wrong.
- Erase your data ("right to be forgotten").
- Restrict how we use it.
- Object to processing based on legitimate interest, and always to direct marketing.
- Port your data: get it in a structured, common format.
- Withdraw consent at any time. This does not affect what we did before. Unsubscribing is one click in any email.
- Not be subject to a decision based only on automated processing. We make none.
To use a right, email hi@songsbrew.com from the address concerned, or write to Hernas OÜ, Kentmanni 4, 10116 Tallinn, Estonia, marked "Data Protection". We may ask you to prove you own the address. We reply within one month. It is free unless a request is clearly excessive.
13.Security
Traffic uses HTTPS. Login links and session tokens are stored only as hashes. The admin area sits behind Cloudflare Access. Forms are rate limited. No system is perfectly secure; if a breach affects you, we will tell you and the authority as the law requires.
14.Children
SongsBrew is not for children under 16. We do not knowingly collect their data. If you think a child has given us data, write to us and we will delete it.
15.Complaints
Write to us first and we will try to fix it. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee, info@aki.ee) or to the authority in your own country.
16.Changes to this policy
We will post changes here and update the date above. For material changes we will tell subscribers by email. Earlier versions are available on request.