Privacy Policy

We run Beatfollow - a tool for music producers to manage sending beats to artists and repertoire (A&R) contacts. We collect only the data necessary for the service to work:

• Email address - to create and confirm your account, sign in, and send account-related messages (such as a password reset).
• Name - if you provide it during sign-up, to personalize your account.
• Login data - when you sign in with email and password, we store only a cryptographic hash of your password (never the password itself); when you sign in with Google, we receive your Google account ID, email address, and name from Google.
• Content you enter - beat names, genres, BPM, audio links, artist and A&R contact details (name, role, email, Instagram), notes, and sending and placement statuses. We process this to provide the service's features; your data is visible only to you.
• Payment data - if you purchase a paid subscription, payments are handled by Stripe. We do not store card numbers or other card details on our servers - they go directly and securely to Stripe. We keep only information about your subscription status.

We process your data on the basis of Article 6 of the GDPR (General Data Protection Regulation):

• Performance of a contract (Art. 6(1)(b)) - we process your account data and the content you enter to provide the Beatfollow service you signed up for.
• Legitimate interest (Art. 6(1)(f)) - keeping the service secure, preventing abuse, and billing paid subscriptions.
• Consent (Art. 6(1)(a)) - if we ever launch analytics features that require consent, we will ask for it explicitly and you can withdraw it at any time.
• Legal obligation (Art. 6(1)(c)) - keeping billing records where tax law requires it.

We never sell or share your data with third parties for marketing purposes. We rely only on trusted processors that help us operate:

• Supabase Inc. - our database and authentication infrastructure provider. Your data is stored on servers in the European Union (AWS cloud region eu-west-2, London). Supabase processes data only on our instructions.
• Google - if you sign in with Google, the sign-in exchange happens with Google under their terms. We do not receive any data from Google beyond what we need for sign-in.
• Stripe, Inc. - payment operator. Card details go directly to Stripe and are secured by them; we only receive the payment status.

Data may also be disclosed where required by law or by a valid order from a public authority.

• Account data and content - for as long as your account exists. After you delete your account or request deletion, we remove it permanently.
• Billing records - for the period required by tax law (as a rule, 5 years from the end of the year in which the tax obligation arose).
• Account-related correspondence - until the matter is resolved, and no longer than 12 months.

Under the GDPR you have the following rights. Just write to tomaszmig7@gmail.com - we usually respond within 30 days:

• access to data - you can find out what data we hold about you;
• rectification - you can correct outdated or incorrect data (you can edit most of it yourself in account settings);
• erasure - you can request deletion of your data and account;
• restriction of processing - you can ask us to pause processing while a dispute is being resolved;
• data portability - you can receive your data in a commonly used format (such as CSV or JSON);
• objection - you can object to processing based on legitimate interest;
• withdrawal of consent - if processing is based on consent, you can withdraw it at any time (this does not affect the lawfulness of earlier processing);
• complaint to a supervisory authority - you can lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, www.uodo.gov.pl, or with the supervisory authority in your country of residence.

We apply safeguards appropriate to the nature of the data:

• all communication takes place over an encrypted HTTPS connection;
• passwords are stored only as cryptographic hashes - never in plain text;
• the database uses Row Level Security, so every user has access only to their own data - no one else, including other users, can read it;
• payment details never pass through our servers - Stripe handles them.

No system is 100% immune to attacks, but if a personal data breach occurs, we will notify you and the relevant supervisory authority as required by applicable law.

We use the minimum necessary number of cookies and similar mechanisms:

• Session cookies (sign-in) - they keep you signed in, so you don't have to enter your credentials on every visit. They are essential for the service to work.
• Local storage (preferences) - we remember things like your chosen theme (light/dark) in your browser. They contain no personal data.

We currently use no analytics or advertising cookies. If that changes, we will update this policy and ask for consent where required.

For any questions or requests about your personal data, write to:

tomaszmig7@gmail.com

This privacy policy was last updated on September 18, 2026.

If we make significant changes, we will notify users (for example by email or with a notice after sign-in), and if a change requires your consent - we will ask for it.