This policy explains what personal data SongsBrew collects, why, who handles it, how long we keep it and what rights you have. We try to keep it short and plain.
1.Who is responsible for your data
The controller is:
Hernas OÜ
Kentmanni 4
10116 Tallinn
Estonia
Email: [email protected]. Write "Data Protection" in the subject line.
Hernas OÜ also runs FreeYourMusic. If you sign up to the SongsBrew newsletter through FreeYourMusic (its website or app), FreeYourMusic passes your email address to SongsBrew. This policy then applies to the newsletter data, and the FreeYourMusic privacy policy applies to your FreeYourMusic account. Hernas OÜ is the controller for both.
2.What we collect and why
| What | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email address, sign-up source, time of confirmation | Send the newsletter you asked for | Consent (double opt-in) |
| Display name (optional) | Show your name on comments | Consent / contract |
| Email opens and link clicks | Know which posts readers like; measure the newsletter; filter out bots | Legitimate interest. |
| Login links and session | Let you log in without a password | Contract (providing the account you asked for) |
| Sign-in with Apple or Google: the provider's account id for you and the email address it shares | Let you log in with that account | Contract (providing the account you asked for) |
| Comments | Publish your comment, moderate, prevent abuse | Contract and legitimate interest |
| Community posts, comments, upvotes and reports | Publish what you post, run Community, moderate, prevent abuse | Contract and legitimate interest |
| Poll votes | Count your vote and show you the results; one vote per reader | Legitimate interest |
| IP address and request logs | Security, rate limiting, abuse prevention | Legitimate interest |
| Submission details from artists | Review music and feature it | Legitimate interest and steps at your request |
| Partnership enquiry details | Reply to you | Steps at your request |
| Brand role addresses from public pages, and the pitches we send to them | Offer sponsorship on SongsBrew | Legitimate interest |
| Bounce and complaint records | Stop sending to addresses that bounce or complain | Legitimate interest |
| Records we must keep (for example invoices) | Estonian accounting law | Legal obligation |
We do not sell personal data. We do not show advertising based on your data. Sponsors receive no personal data about readers, only overall figures such as the number of subscribers and the average open rate.
4.Reader accounts, comments and Community
- There is no password. You enter your email and we send a login link, valid for 15 minutes and usable once. Only people who have confirmed a newsletter subscription, or who signed in with Apple or Google, can log in, including those who later unsubscribed.
- For 3 days after a newsletter goes out, a link to our site in it also logs you in, with no further step. If you are already logged in as someone else in that browser, it does not switch you. Anyone you forward the newsletter to can log in as you the same way, so forward it with care.
- You can also sign in with Apple or Google. We receive the provider's account id for you and the email address it shares, which with Apple may be a private relay address. If Apple shares your name, we do not keep it. Signing in this way joins the SongsBrew account with the same address, or creates one and subscribes you to the newsletter once you confirm the email we send. You can connect or disconnect these sign-ins on your account page. Apple and Google handle the sign-in itself under their own privacy policies.
- Logging in sets a session cookie (section 7). We store a hashed copy of the session token, its expiry and roughly when it was last used.
- Comments are public. We show your display name and your comment, and the time. We do not show your email address. You can edit or delete your own comments. We may hide or delete comments that break the Terms of Use, and block a reader from commenting.
- In Community, your posts, comments, display name, member handle, the month you joined and upvote counts are public, and your posts are listed on your member profile. We do not show your email address. An editor checks your first post before it appears. Reports you send are seen only by our editors.
- Articles may have polls. When you vote, we store your answer and the time, linked to your account if you are logged in. Your vote counts toward the results everyone sees; nobody else sees how you voted. Votes are final. To make sure each browser votes only once, voting sets the
sb_votercookie (section 7). - Unsubscribing from the newsletter does not delete your account. You can turn the newsletter back on from your account page. To delete your account, write to us (section 12).
5.Music submissions
If you send music through the Submit Music form we collect what you type in the form: your name or artist name, email, links to your music, any text you provide, and your answers to the questions about rights and AI use. The team reads submissions in an admin inbox and keeps internal notes and a status.
If you add a press photo, by uploading it or by giving us a link we fetch it from, we store a copy with your submission. We may use it in the feature, and we delete it with the submission when you ask us to.
To help write a feature, we may send some details of a submission to an AI model to produce a draft. We send only the artist name, the release title, its type and release date, and a note an editor may add. We never send your email address, your name, your Instagram handle or what you wrote under "Anything we should know". A person reviews every draft before anything is published, and no decision about you is made by AI alone.
If we feature you, your name, material and links appear on the site and may appear in the newsletter and our social media accounts.
6.Partnership enquiries and sponsor outreach
If you use the Partnerships form we store your name, email, brand, phone number (if given) and message, and email them to our team. If you use the booking form we store your name, email, brand, what you are promoting and its link, the placement, the Thursdays and budget you picked, and your message (if given), and email them to our team. We use them only to reply about your request, and delete them when you ask.
To find sponsors, we look for role business addresses, like ads@ or partnerships@, that brands publish on their own websites and in their newsletters, and write to them to offer sponsorship on SongsBrew. We rely on legitimate interest. We keep the address and the pitches we sent until the brand asks us to stop or to delete them. If you would rather not hear from us, reply to our email or write to [email protected], and we will not write again.
8.Analytics and error reporting
- Visit statistics count pages viewed, referrers, country and device type, without cookies and without building profiles of individuals.
- Sentry receives technical error reports (the page, the browser and a stack trace) so we can fix bugs, with personal data stripped.
- Our servers keep request logs for security and debugging, only as long as we need them, not indefinitely.
10.Transfers outside the EEA
We host in the EU. Mailgun, Cloudflare and Sentry may process data in the United States. Where they do, we rely on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
11.How long we keep data
| Data | Kept for |
|---|---|
| Subscriber record | Until you ask us to delete it. If you unsubscribe, it is kept marked unsubscribed, so we never email you again and you can still log in. |
| Email opens and clicks | Until you ask us to delete them, or your subscriber record is deleted |
| Login links | Work for 15 minutes; deleted about a day after they are used or expire |
| Reader sessions | 90 days after your last visit, and never more than a year after you logged in; deleted when they expire or you log out |
| Comments | Until you or we delete them. A deleted comment's text is kept for 30 days for moderation, then erased. If your account is deleted, the text of your comments is erased at once. |
| Community posts and comments | Until you or we delete them, or you ask us to. A deleted post's or comment's text is kept for 30 days for moderation, then erased. If your account is deleted, their text is erased at once. |
| Upvotes and reports you send | Until your account is deleted |
| Apple and Google sign-ins | Until you disconnect them or your account is deleted |
| Poll votes | Kept with the poll. A vote cast while logged in is linked to your account; if your account is deleted, the vote still counts but is no longer linked to your account. |
| Submissions and partnership enquiries | Until you ask us to delete them; a featured submission stays while the feature is on the site |
| Brand addresses and the pitches we sent them | Until the brand asks us to stop or to delete them |
| Do-not-email list (bounces, complaints and requests to stop) | Kept, even after the rest of your data is deleted, so we never email that address again |
| Accounting records | 7 years, as Estonian law requires |
| Request logs, error reports and backups | Only as long as we need them to run, secure and fix the service, not indefinitely |
12.Your rights and how to use them
Under the GDPR you can:
- Access the data we hold about you and get a copy.
- Correct data that is wrong.
- Erase your data ("right to be forgotten").
- Restrict how we use it.
- Object to processing based on legitimate interest, and always to direct marketing.
- Port your data: get it in a structured, common format.
- Withdraw consent at any time. This does not affect what we did before. Unsubscribing is one click in any email.
- Not be subject to a decision based only on automated processing. We make none.
To use a right, email [email protected] from the address concerned, or write to Hernas OÜ, Kentmanni 4, 10116 Tallinn, Estonia, marked "Data Protection". We may ask you to prove you own the address. We reply within one month. It is free unless a request is clearly excessive.
13.Security
Traffic uses HTTPS. Login links and session tokens are stored only as hashes. The admin area sits behind Cloudflare Access. Forms are rate limited. No system is perfectly secure; if a breach affects you, we will tell you and the authority as the law requires.
14.Children
SongsBrew is not for children under 16. We do not knowingly collect their data. If you think a child has given us data, write to us and we will delete it.
15.Complaints
Write to us first and we will try to fix it. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee, [email protected]) or to the authority in your own country.
16.Changes to this policy
We will post changes here and update the date above. For material changes we will tell subscribers by email. Earlier versions are available on request.
