Privacy Policy

Privacy Policy of MusicHeartsFM

Last Updated: October 2026

1. Introduction

Welcome to MusicHeartsFM (the "Service"). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you visit our website https://musichearts.fm and use our music services.

We operate in full compliance with the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law on Data Protection (LOPDGDD).

2. Data Controller

The entity responsible for processing your personal data (the "Controller") is:

  • Name: Aleksei Melikhov (Registered Autónomo)

  • Location: Alicante, Spain

  • Contact Email: [email protected]

3. Data We Collect

We collect only the information necessary to provide and improve our Service:

  • Account Data: When you register with an email and password or authenticate via Google or Facebook Login, we receive your name, email address and, for social login, your profile picture.

  • Technical Data: IP address, browser type, and device information are processed via Cloudflare to ensure security and prevent fraudulent activity.

  • Usage Data: Information on how you use our website, including search queries and music preferences, to enhance your experience.

  • Visit Statistics: to count visits and show aggregated statistics to the Service and to business accounts, we record each page view with the date, page, language, device type, approximate city and country derived from the IP address, the referring site and campaign (UTM). The IP address itself is not stored with this record: visits are linked only by a daily identifier computed from the IP address and browser with a secret key, which changes every day and does not allow us to identify you; if you are signed in, the record also contains your account ID. These records are kept for up to 13 months. Legal basis: our legitimate interest in measuring and improving the Service (Art. 6(1)(f) GDPR).

4. Third-Party Services and Data Transfers

To provide a rich musical experience, we integrate with several external providers. Each provider handles data according to its own privacy policy:

  • Google: authentication (Google Sign-In), traffic analysis (Google Analytics 4, only with your consent in the EEA, the UK and Switzerland) and advertising (Google AdSense, see section 5).

  • Meta (Facebook) Login: We use Meta for user authentication.

  • YouTube API Services: Our Service uses YouTube API Services to provide video and audio content. By using MusicHeartsFM, you agree to be bound by the YouTube Terms of Service and the Google Privacy Policy. You can revoke access to your data via the Google Security Settings page.

  • MusicBrainz: We use the MusicBrainz API to fetch musical metadata (artist info, album art). No personal user data is shared with MusicBrainz; only general search queries are processed by their servers.

  • Cloudflare: We use Cloudflare for content delivery, DDoS protection, and infrastructure security.

5. Advertising

We show advertisements to finance the Service:

  • Google AdSense (Google Ireland Ltd.) — on the international and Spanish versions of the site. Google, as a third-party vendor, uses cookies and similar technologies (for example, the advertising cookies of Google and its partners) to serve ads based on your prior visits to this site or other sites, to limit how often you see an ad and to measure ads. Google's use of advertising cookies enables it and its partners to serve personalised ads. You can learn how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites, and opt out of personalised advertising at Google Ads Settings or, for other vendors, at www.aboutads.info and youronlinechoices.eu.

  • Yandex Advertising Network (YANDEX LLC) — on the Russian-language regional version of the site. Yandex uses cookies to serve and measure ads; see yandex.com/legal/confidential.

In the EEA, the UK and Switzerland, personalised advertising and the related cookies are used only with your consent, which you give or refuse in the consent banner managed by Google (a certified consent management platform under the IAB Transparency and Consent Framework). If you refuse, Google may show non-personalised ads, which use cookies only for limited purposes such as frequency capping, fraud prevention and aggregated ad reporting.

6. Artificial Intelligence (AI) and Automated Processing

We may use Artificial Intelligence (AI) and machine learning algorithms to analyze your musical tastes and provide personalized recommendations.

  • This processing is designed solely to improve your user experience.

  • We do not use AI for automated decision-making that produces legal effects.

  • Our AI practices comply with the EU AI Act, ensuring transparency, safety, and respect for fundamental rights.

7. Cookies

We use the following categories of cookies and similar technologies:

  • Strictly necessary: the session cookie that keeps you signed in, security and anti-fraud cookies (including Cloudflare), and the record of your consent choices. They do not require consent.

  • Analytics: Google Analytics 4. In the EEA, the UK and Switzerland, they are set only after you consent. Ahrefs Web Analytics, which we also use, does not use cookies.

  • Advertising: cookies of Google AdSense and its partners, and of Yandex on the Russian-language version (see section 5). In the EEA, the UK and Switzerland, they are set only after you consent.

When you first visit the site, a banner asks for your consent to non-essential cookies; "Reject" is as easy as "Accept". You can change or withdraw your consent at any time through the "Privacy and cookie settings" link shown by the banner on the page, and you can also delete cookies in your browser settings. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

8. Data Storage and Retention

Your personal data is stored on secure servers located within the European Union. We retain your information only as long as your account is active or as needed to provide you with the Service.

9. Your Rights (GDPR)

Under the GDPR, you have the following rights:

  • Access & Portability: Request a copy of your personal data.

  • Rectification: Request correction of inaccurate data.

  • Erasure ("Right to be Forgotten"): Request the total deletion of your account and data.

  • Object & Restrict: Object to data processing or request its limitation.

  • Withdraw Consent: Where processing is based on your consent (for example, analytics and advertising cookies), withdraw it at any time.

  • Complaint: Lodge a complaint with the Spanish Data Protection Agency (aepd.es) or the supervisory authority of your country.

To exercise any of these rights, please contact us at [email protected].

10. Data Deletion Instructions

If you wish to delete your account and all associated data, including data received via Facebook or Google Login, you can do so by sending a request to [email protected]. We will process your deletion request and remove all your personal information from our databases within 30 days.

11. Business Accounts (Venues, Promoters, Artists)

This section applies to users of the business features (claiming and managing a venue, business accounts, artist and band profiles, booking applications) and supplements the rest of this Policy. The use of these features is also governed by the Terms for Business Accounts.

Data we process.

  • Account and role data: your name, email, login, the business accounts you belong to and your role (owner, manager, viewer), invitations and access links sent and accepted.

  • Claim and verification data: the venue claimed, the verification method, the correspondence and documents you provide to confirm your authority, the decision and its date, and the version, date and time of your acceptance of the Terms for Business Accounts.

  • Activity data: the log of changes made on behalf of the business (who changed what and when), calendar entries, published events, plan and its history, and requests for features ("I want it").

  • Artist and booking data: the artist or band profile (name, city, genres, description, links, line-up, contact email or phone), the applications sent or received and their status and replies.

  • Billing data, where a paid plan is ordered: business name, tax ID, billing address, invoices and payment status. Card data is processed directly by our payment provider (Stripe) and is not stored by us.

Contact details of the venue (address, phone, email, website, social networks) that you publish on the venue profile are public. Please use business contacts rather than private contacts of individuals.

Purposes and legal bases.

  • To provide the business features and manage the business account under the Terms for Business Accounts — performance of a contract (Art. 6(1)(b) GDPR).

  • To verify that the person who claims a venue is authorised, to prevent fraud and impersonation, to keep the change log and to defend against claims — our legitimate interest in the integrity of the Service and of the venue profiles (Art. 6(1)(f) GDPR).

  • To send service communications about claims, invitations, applications, plans and security — performance of a contract.

  • To understand which features businesses need and to improve the Service, using aggregated statistics of use — our legitimate interest (Art. 6(1)(f) GDPR).

  • To issue invoices and keep accounting records — compliance with a legal obligation (Art. 6(1)(c) GDPR).

Recipients.

  • Other members of the same business account see the data of the account and the change log.

  • When a band applies to a venue, the venue receives the band profile and contacts; when a venue answers, the band receives the reply and the venue conditions. Each of them then processes this data as an independent controller.

  • Service providers acting on our behalf: hosting in the EU, email delivery, Google (Gemini) for the automatic translation of texts you ask to translate, and Stripe for payments. Internal notifications to our team about new claims and applications may be delivered via Telegram.

  • Statistics shown to a business about its profile are aggregated and do not contain personal data of visitors.

Retention. We keep the data of a business account while it exists. After a claim ends or a business account is closed, the claim, the verification, the acceptance of the terms and the change log are kept blocked for up to 5 years for the defence of possible claims, and billing data for the periods required by tax and commercial law (generally 6 years), after which they are deleted or anonymised. Booking applications are kept while at least one of the parties keeps its account, and are deleted or anonymised on request when no longer needed.

You may exercise your rights described in section 9 in relation to this data at [email protected]. If you received personal data of others through the business features (for example, in a booking application), you are responsible for handling it lawfully.

12. Jurisdiction

Any disputes related to this Privacy Policy shall be governed by the laws of Spain, and the parties submit to the jurisdiction of the Courts of Alicante.

🤷‍♂️