Privacy Policy

On The Bright Side VOF, Joos van den Steenelei 58, 2100 Deurne, Belgium, enterprise number 1041.342.114, is responsible (the controller) for processing your personal data through SongPort. Send questions about privacy to hello@songport.link. We have not appointed a data protection officer, because we are not required to.

This policy applies to songport.link, SongPort links, the SongPort app for iOS, the forms on the site, the waitlist, the API and the customer portal. It does not cover the other activities of On The Bright Side.

It also applies to artist pages (songport.link/@name), their waitlist and the studio where an artist manages a page.

Everyone who uses the site or the iOS app

We don't store raw IP addresses in our database. We only store a hashed version, with a secret key, to apply limits. Even a hashed IP address can be personal data under the GDPR. That's why we mention it here.

The iOS app sends a random, anonymous device code with every link you convert. It says nothing about you or your phone. Only a hashed version is stored, to apply the daily limit, and it is deleted once the 24 hours of that limit have passed.

The app has no accounts, no analytics or advertising code, and sends no push notifications. The list under "Your links" (the SongPort link, title, artist, cover art address and date of at most 50 links you made) stays on your phone, together with the device code and the number of links you have left today. We never receive that list. You can remove links from it or clear it in the app. The app loads cover art straight from the image server of the music platform, which sees your IP address when it does. Pages you open from the app, such as a SongPort link or this policy, are pages of the site, so what this policy says about the site applies there.

Until August 2026 we stored a hashed IP address and device data in our own database for every click on a SongPort link. That data has been deleted. Only daily totals per country, platform and device type remain, without IP addresses.

If you send us a message

With every form we also store a hashed version of your IP address, to limit spam. We use your message to reply to you and to improve the service. Legal basis: legitimate interest. Please don't put personal data in an idea for a new feature.

If you donate

Stripe processes your payment. We receive and store the amount, the currency, your message if you wrote one, and the name and email address you gave Stripe. Legal basis: performance of the contract and our legal accounting obligation.

If you join the waitlist for the API

Your email address, your description of what you want to build, the expected volume, the time you signed up and a hashed version of your IP address (to limit mass sign-ups). We use these to invite you, send you news about the API and estimate our capacity. Legal basis: consent (you sign up yourself). You can unsubscribe through the link in every email. After that we only keep your email address and the date you unsubscribed, so we don't email you again.

If you have an API account

For calls with your API key, we don't store an IP address. For a call that creates a new link, we do store the country code the call came from, just like for links made on the site.

Don't send personal data of your own users to the API. The API only needs music links or ISRC codes.

If you join the waitlist for the iOS app

Your email address, the time you signed up and a random code for your unsubscribe link. We use these to confirm your signup and to send you one email when the SongPort app is on the App Store. We don't use your address for anything else. Legal basis: consent (you sign up yourself).

To limit mass sign-ups we count signups per hashed IP address. That hashed address is not stored with your signup, only in a separate counter.

You can unsubscribe through the link in every email. After that we keep your entry with the date you unsubscribed, so we don't email you again. We delete your entry at the latest 2 years after you signed up.

If you sign up for an artist page

When you enter your email address to make an artist page, we create an account with that address right away and email you a sign-in link. Until you click it, the account has no page and nothing about it is public. With the link we store a hashed version of your IP address, to limit sign-in attempts. If you never use the account, it stays until you ask us to delete it. Legal basis: steps at your request before a contract, and legitimate interest (security) for the hashed address.

If you join the waitlist for artist pages

Your email address, the time you signed up and a random code for your unsubscribe link. If the form asks for them and you fill them in, also your artist name and a link to your music. We use these to confirm your signup and to email you when your spot is ready. We only email you about artist pages. Legal basis: consent (you sign up yourself).

To limit mass sign-ups we count signups per hashed IP address. That hashed address is not stored with your signup, only in a separate counter.

You can unsubscribe through the link in every email. After that we keep your entry with the date you unsubscribed, so we don't email you again. If you fill in the form again later, you are back on the list right away.

If you have an artist page

Signing in to the studio works the same way as signing in to the portal. The sign-in link, the hashed IP address with it, the session cookie and the log of emails we send you are handled as described under "If you have an API account".

Your photo is stored with Vercel under a public address, so anyone who has that address can open it. The studio crops the photo in your browser before it is uploaded, which leaves out hidden data in the file, such as where it was taken. We also remove that hidden data from every photo before we store it.

When you make a page or change your username, we look up that username and your artist name at Deezer, a music service, to see whether they are the name of a known artist. If they are, your page stays offline until we have checked it, and we email you when it is online. Deezer receives the name we look up and nothing else about you. Legal basis: legitimate interest (keeping people from posing as an artist).

If we paused your page for breaking the rules and you then delete it, or if we ban an address for abuse, we keep that email address on a list of addresses that can't join the waitlist or get a spot again. Legal basis: legitimate interest (keeping abuse off artist pages). You can ask us to review this at any time.

A release on your page is an ordinary SongPort link to music on the music services. What this policy says about converted links applies to it, and it stays when your page is deleted.

If you take a paid plan for your artist page

You pay on a payment page of Stripe. Stripe works out the VAT based on your country and your VAT number. If you withdraw or ask for a refund, we use these details to handle it.

If you visit an artist page

An artist page is a page of the site, so what this policy says about everyone who uses the site applies. Opening an artist page and clicking through to a music service are measured the same way as for a SongPort link: via Google Analytics and PostHog only after you consent through the cookie banner, and as an anonymous event via Vercel Analytics, without cookies. The event says which artist page and which release it was about and which music service was chosen. The page doesn't remember which music service you picked.

Apart from that, we count for each artist page, per day, how often the page is opened and what is tapped on it: a release, a music service, a social link, one of the artist's own links or "Tickets". With each view we note three things as totals for the page: the country, the kind of device (phone, tablet or computer) and the kind of place the visit came from (Instagram, TikTok, YouTube, Facebook, X, a search engine, direct or other). We don't store your IP address for this, we set no cookie and store nothing in your browser for it, and we keep no identifier for you or your device. The stored numbers can't tell us what one person did. Our hosting provider receives your IP address, as with every page you open, and derives the country from it; we keep the country only as part of a total. The artist sees these totals in the studio, and we use them for nothing else. Legal basis: legitimate interest (showing artists how their page is used).

The page loads cover art straight from the image server of the music platform and the artist's photo from Vercel's storage. Both see your IP address when they do.

If you report an artist page

The reason you pick, your note if you write one, the page it is about and the time. We store the report in our database and it is sent by email to our mailbox. We don't ask for your name or email address, and the artist doesn't see the report or who sent it. To limit abuse we count reports per hashed IP address, in a separate counter and not with the report. Legal basis: legitimate interest (keeping artist pages free of abuse).

If you send us a notice about an artist page by email, for example as a rights holder, we also get your name, your email address and what you write. We use them to handle the notice and to reply to you. We tell the artist what the notice was about, but we only give the artist your name or email address if you agree or the law requires it. Legal basis: legitimate interest (handling notices about content on SongPort).

If we act on a page after a report or a notice, we email the artist what we did and why.

We get most data from you. We also get your payment status and the billing details you enter at checkout from Stripe, and our hosting provider Vercel derives a country from your IP address.

For an API account you need an email address. For a paid plan we also need your billing details, because VAT law requires them, and you have to accept the terms. Without that data we can't provide an account or a plan. Everything else, such as a company name or a message, is voluntary. For an artist page you need an email address, a username and a name for the page, and you have to accept the terms. The bio, the photo and the links are voluntary.

To recognise tracks and make links, we request public data from Spotify, Apple Music, YouTube, TIDAL, Deezer, SoundCloud, MusicBrainz and, on the public site, Odesli. Those platforms only get the music link or the search term from us, not your IP address. We use our own keys or, if you add them, yours. We never get access to your account on those platforms and never ask you to sign in there.

SongPort uses YouTube API Services. The Google Privacy Policy also applies to that. We refresh or delete data that comes from YouTube at least every 30 days.

SongPort is not affiliated with, endorsed by or sponsored by any of these platforms.

We don't sell personal data. We only share it with service providers that process it for us:

Stripe is also partly responsible itself, for example for fraud prevention and its own legal obligations. For that, the Stripe privacy policy applies.

If data goes to a country outside the European Economic Area, this happens on the basis of the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission.

We also pass on data when the law requires us to.

Photos on artist pages are stored with Vercel, in its file storage (Vercel Blob). The photos are stored in Frankfurt, Germany (EU). The totals we count for artist pages are stored in our database, also in Frankfurt.

What loads in your browser

Of the providers above, these scripts load on the site. Analytics only loads after you consent through the cookie banner.

For the full list of cookies and how to change your choices, see the Cookie Policy.

We only store API keys as a hash. We store customers' platform keys encrypted (AES-256-GCM). We only store IP addresses hashed, with a secret key. Signing in works with one-time email links, without passwords. Access to the database is limited to the administrator of SongPort.

If a data breach still happens that puts you at risk, we report it within 72 hours to the Belgian Data Protection Authority and, if the risk is high, to you as well.

iOS app waitlist

Artist pages

You have the right to access your data, to have it corrected or erased, to have its processing restricted and to receive your data in a readable format. You can object to processing based on legitimate interest, and always to news emails. If you gave consent, you can withdraw it at any time. What we did before you withdrew it remains lawful.

If you have an API account, you can download your data and delete your account in the portal under "Profile". If you have an artist page, you can download your data and delete your page in the studio under "Settings". For everything else, email hello@songport.link. We reply within one month. For a complex request this can be extended by two months. If so, we let you know within the first month.

If you disagree with how we handle your data, you can file a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be (gegevensbeschermingsautoriteit.be). If you live in another EU country, you can also turn to the supervisory authority there.

We don't make decisions about you that are based solely on automated processing and have legal effects, and we don't build profiles. Automatic limits, such as an error when your monthly limit is reached, follow directly from your plan.

An API account is only for people aged 18 or older. The same goes for making an artist page. For an artist younger than 18, a parent or guardian, or an adult who is allowed to act for the artist, makes and manages the page (article 4 of the Terms for Artist Pages). We don't knowingly collect data from children under 13.

The current version is always at songport.link/privacy, with the date it takes effect. We announce material changes by email to everyone who has an account.