Privacy Policy

1. Introduction

vocumi(“we”, “us”, “our”) is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, and your rights.

1. Who We Are (Controller)

The data controller for all personal data processed in connection with the vocumiplatform (“Service”) is:

2. Scope of This Policy

This Privacy Policy applies to all personal data processed when you visit our public website (vocumi.com), register for an account, use the vocumi web application, or use the vocumi Chrome browser extension. It applies to individual users and to members of team workspaces.

Our public marketing pages may use optional, consent-based tools — Matomo if you accept Statistics, and the LinkedIn Insight Tag if you accept Marketing in the cookie banner. The authenticated product application does not load Matomo or the Insight Tag. See §3.9, §5.16, and §4.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and other applicable data protection laws. German state data-protection laws may also apply.

2.1 Legal bases at a glance

Each processing described below names its legal basis. In summary we rely on:

• Art. 6(1)(a) GDPR — consent — where you opt in (for example Matomo statistics cookies and the LinkedIn Insight Tag). You may withdraw consent at any time.
• Art. 6(1)(b) GDPR — contract — to provide the Service you signed up for (account, search, roster, billing metadata).
• Art. 6(1)(c) GDPR — legal obligation — in particular German commercial and tax retention (see §8).
• Art. 6(1)(f) GDPR — legitimate interests — for example security logs, weekly digest (with Art. 21 objection), product telemetry, and operating our company pages on social networks. We balance these against your rights.

Device storage that is not strictly necessary (non-essential cookies) also requires consent under § 25 TDDDG before it runs on your device.

2.2 Chrome browser extension

The vocumi Chrome extension identifies artists on the public website you have open and shows a briefing, scores, and roster actions in the browser. After you agree in the extension, it reads the address of the active tab and any artist name you select, and may send those values to vocumi.com so we can look the artist up. If you sign in, the extension also stores your session tokens on this device and loads Insights, scouting, Pulse, and roster data for your workspace. The companion is listed on the Chrome Web Store. Product page: vocumi.com/chrome.

The extension does not set browser cookies. Your first-run agreement and, if you sign in, your extension session live in Chrome's chrome.storage on this device (listed in §4). After you agree, we store page_consent so we do not ask again. You can withdraw that agreement in the extension with Stop reading pages; we then clear page_consentand stop reading tab addresses and selected text until you agree again. Removing the extension or using Chrome's “Clear data” for this extension also deletes it.

Signing in to vocumi.com in a normal tab does not sign the extension in. Website login uses HttpOnly cookies on vocumi.com (the sb-[project]-auth-token cookies in §4). Chrome does not let an extension read those cookies. The extension therefore runs its own sign-in (chrome.identity) and stores its own access and refresh tokens. Those tokens are not the website auth cookie.

We do not sell this data, use it for personalized or interest-based advertising, or transfer it to data brokers. Use is limited to providing and improving this single purpose — identifying artists while you browse and opening their vocumi desk. See the Chrome Web Store User Data Policy Limited Use requirements.

Legal basis: Art. 6(1)(a) GDPR — consent for reading the open tab and selected text; Art. 6(1)(b) GDPR — contract if you sign in and use roster, Pulse, or Insights through the extension.

3. Data We Collect and Legal Basis

3.1 Account & Profile Data

When you register, we collect and store the following:

• Email address — required for login and transactional communications
• Display name — first and last name in Settings, stored as one name field and shown in your workspace (header, team list). On signup we prefill this from the part of your email before the @ until you change it.
• Password — stored as a secure hash; we never store your plaintext password. Accounts use email and password only (we do not offer Sign in with Google or other social login)
• Plan tier & account preferences — including weekly digest opt-out preference

Legal basis: Art. 6(1)(b) GDPR — performance of a contract (the subscription agreement you entered into with us).

3.2 Workspace & Collaboration Data

When you use the platform, we store:

• Artists and podcasts you add to your roster, including notes and tags you assign (private notes stay with you; workspace notes and team tags are visible to members of that workspace)
• Tags and custom labels applied to artists
• Artists you mark as personal favourites
• In-app notifications (e.g., team invitations accepted, access changes)
• Your workspace membership role (owner, admin, member, viewer) and the date you joined

Legal basis: Art. 6(1)(b) GDPR — necessary to deliver the core functionality of the Service.

3.3 Vibe Search Queries (Processing, Not Retention)

When you use Vibe Search for artists or podcasts, the text you enter is processed to return matching results. We do not retain your vibe query text in our database for quota enforcement or as searchable history. Plan limits are enforced with usage counters only (how many searches you used, not what you typed). Artist and podcast Vibe searches share one daily (or grant/monthly) counter per user.

During artist Vibe requests, your query may be transmitted to OpenAI (vector embedding for similarity matching) and to Google Gemini (ranking and discovery). Podcast Vibe requests are processed by Google Gemini only. Those providers process the query for that request under their API terms; we do not use Vibe queries to build an advertising profile.

Legal basis: Art. 6(1)(b) GDPR — necessary to deliver Vibe Search and enforce plan limits as contracted.

3.4 Direct Search Queries (Processing, Not Retention)

When you use Direct Search for artists or podcasts, the text you enter is processed to find matches. We do not retain your Direct Search query text in our database. Artist Direct Search is not counted against a daily search quota. When a lookup needs Soundcharts (for example Spotify returns no match, or we attach cached Soundcharts fields), we pace the request so results take longer instead of blocking the search. Podcast Direct Search is unlimited. Vibe Search still uses a plan-based usage counter (how many Vibe runs you used, not what you typed).

Depending on your query and entity, Direct Search may transmit your search text to Spotify (artist name search), Soundcharts (fallback artist discovery when Spotify returns no results), Apple Podcasts / iTunes Search (podcast name and catalogue lookup), public RSS feeds (podcast metadata when a feed URL is resolved), and/or Google Gemini (keyword-style artist queries that are not a single artist name). Those providers process the query for that request under their API terms; we do not use Direct Search queries to build an advertising profile.

Legal basis: Art. 6(1)(b) GDPR — necessary to deliver Direct Search.

3.5 Billing & Subscription Data

We store your subscription status, plan type, renewal date, and a reference ID linking your account to your Lemon Squeezy customer record. We do not store your payment card details — all payment processing is handled by Lemon Squeezy, which acts as the merchant of record.

Legal basis: Art. 6(1)(b) GDPR — performance of the subscription contract; Art. 6(1)(c) GDPR — compliance with tax and accounting obligations.

3.6 Weekly Digest Emails

We send a weekly summary of your workspace activity (roster updates, metric changes, team activity) to your registered email address. This feature is enabled by default but you can opt out at any time in your account settings. We use your email address and workspace data to generate these digests.

Legal basis: Art. 6(1)(f) GDPR — legitimate interests (keeping you informed about activity in your workspace). You have the right to object to this processing at any time under Art. 21 GDPR by disabling the digest in your account settings.

3.7 Email Communications Log

For operational reliability, we log the type and send status of transactional emails sent to your address (e.g., welcome, password reset, workspace invitation). Email content is not stored in our database.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in ensuring reliable delivery of account-critical communications.

3.8 Feature & AI Usage Counters

To enforce plan limits and manage AI cost, we store usage counters such as daily Vibe search counts and weekly Pulse counts (linked to your user and workspace), plus organisation-level AI token consumption records. Artist Direct Search is not daily-capped. These records contain counts and technical metadata — not the text of your Vibe queries. They are not used to build advertising profiles.

Legal basis: Art. 6(1)(b) GDPR — necessary to manage plan limits and billing; Art. 6(1)(f) GDPR — legitimate interest in cost management.

3.9 Public Website Visits, Marketing Analytics & Server Access Logs

Our public marketing pages (vocumi.com) do not use session recordings. We do not sell marketing visit data. Optional statistics (Matomo) and optional advertising measurement (LinkedIn Insight Tag, §5.16) run only after the matching cookie choice.

Marketing analytics (Matomo, opt-in only)

If you accept Statistics in our cookie banner, we load Matomo Analytics, which we operate ourselves on analytics.vocumi.com (Hetzner Cloud VPS, EU/EEA). Matomo is not loaded until you opt in. It may collect:

• Pages visited, referrer URL, and campaign parameters (mtm_* / utm_*)
• Browser/device type and language (from the user-agent)
• Anonymised IP address (last bytes masked in Matomo)
• Interaction events (e.g. which marketing button was clicked) — no form field contents or search queries

This data is used only to understand how our marketing site is used. It is not linked to your vocumi account, roster data, or in-app product telemetry (§3.11). Raw visit logs are deleted after 6 months. You can withdraw consent at any time via Cookie settings in the site footer.

Legal basis: Art. 6(1)(a) GDPR — your consent; § 25 TDDDG — consent before non-essential cookies or client-side analytics run on your device.

Server access logs

We do not store marketing analytics IP addresses in our application database. Like most web services, our hosting infrastructure generates server access logs when you visit the site or use the application. On our Hetzner Cloud VPS (reverse proxy and application containers), these logs may include your IP address, request timestamp, URL path, HTTP status code, referrer, and browser user-agent. We use these logs for security, abuse prevention, and troubleshooting — not for advertising or behavioural profiling.

Retention on our VPS:Docker log rotation keeps up to three log files of 10 MB each per service container (the effective time window depends on traffic volume). Hetzner Cloud servers are unmanaged: we configure and operate application logs ourselves. Separately, Hetzner logs logins and administrative changes in your Hetzner customer account portal under their own GDPR-compliant deletion schedule (see Hetzner TOMs). Hetzner does not access or retain the contents of our application databases.

Legal basis: Art. 6(1)(f) GDPR — legitimate interests in secure and reliable operation of the Service.

3.10 Product Feedback

When you submit feedback through the in-app feedback form (hosted at feedback.vocumi.com), we collect your feedback title and description, the board you selected, your Vocumi account identifier, email address, and name. Your name is not shown to other users when they browse feedback.

If you opt in via the contact checkbox on a specific submission, we may email you about that feedback. Without that opt-in, we use your identity only to operate and triage feedback internally.

Legal basis: Art. 6(1)(b) GDPR — necessary to operate the feedback feature; Art. 6(1)(a) GDPR — outreach about a specific submission where you opt in.

3.11 Product Telemetry (In-App Feature Adoption)

Within the authenticated web application, we record product telemetry events to understand which features are used (for example: discovery mode used, artist tabs opened, checkout started, help opened). Each event may include:

• Event name and non-sensitive properties (e.g. tab name, plan tier, query length — not the query text)
• Your user ID and workspace (organisation) ID when you are signed in
• A daily session identifier derived from your user ID and the calendar date (not a persistent cross-day tracking cookie)
• Page path, HTTP referrer, and browser user-agent
• Country code (ISO 3166-1 alpha-2) derived at write time from CDN headers or GeoIP — we do not store your raw IP address in telemetry

Telemetry is used for internal product improvement and operations. It is not sold, not used for advertising, and not combined into a marketing behavioural profile. Public marketing pages do not run this product telemetry.

Legal basis: Art. 6(1)(f) GDPR — legitimate interests in improving the Service and understanding feature adoption. You may object under Art. 21 GDPR by contacting us at contact@vocumi.com.

4. Cookies and Local Storage

We use strictly necessary cookies and local storage for the Service to function. Optional statistics cookies (Matomo) and optional marketing cookies (LinkedIn Insight Tag) are set only if you opt in in our cookie banner (§ 3.9, §5.16).

Authentication Cookies (Supabase SSR)

• sb-[project]-auth-token — Encrypted session token, HttpOnly, required for login
• sb-[project]-auth-token-code-verifier — PKCE verification token used by Supabase Auth flows, HttpOnly

Application Cookie

• active_org — Stores your currently active workspace ID to maintain context between page navigations

These cookies are session-bound or expire after a short period. They are not shared with third-party advertising networks. Because these cookies are strictly necessary for the Service to function, we do not require your consent to set them (§ 25(2) No. 2 TDDDG).

Consent storage (local storage)

• vocumi_consent_v2 — Stores your cookie choice (necessary, statistics, marketing) and a timestamp. Strictly necessary to honour your preference. Older visits may still have vocumi_consent_v1 (statistics only); we do not treat that as marketing consent.

Chrome extension storage (not cookies)

The Chrome extension does not write cookies. It uses Chrome's chrome.storageAPI on this device. Remove the extension or use Chrome's “Clear data” for this extension to delete these keys.

chrome.storage.local (persists across browser restarts):

• page_consent — Your in-product agreement to let the extension read the active tab URL and selected text. Withdraw it in the extension with Stop reading pages. Art. 6(1)(a) GDPR; § 25 TDDDG.
• access_token, refresh_token, expires_at, org_id — Extension session after you sign in through the extension. These are not the website sb-[project]-auth-token cookies. Art. 6(1)(b) GDPR.
• intel_snap, intel_seen — Last Insights / scout / mover snapshot so the toolbar can show a gold dot for unseen intel.

chrome.storage.session (cleared when the browser session ends): a working copy of the session tokens; a one-time oauth_state during sign-in; the last identified artist and page URL; the last HTTPS tab id; your last artist pick on a page; and which desk tab is open.

Statistics (optional — consent required)

If you choose Statistics, Matomo may set first-party cookies on vocumi.com, for example:

• _pk_id.* — Distinguishes returning visitors (visitor ID); up to 6 months
• _pk_ref.* — Stores campaign referrer; shorter session-based lifetime
• _pk_ses.* — Short-lived session cookie

Data is processed on our self-hosted Matomo instance (EU). Withdraw consent via Cookie settings in the footer; this stops future tracking. Clearing site data removes Matomo cookies from your browser.

Legal basis: Art. 6(1)(a) GDPR — consent; § 25 TDDDG.

Marketing (optional — consent required)

If you choose Marketing, LinkedIn may set cookies such as bcookie, lidc, li_gc, and UserMatchHistory in connection with the Insight Tag (see LinkedIn's cookie table). Withdraw via Cookie settings; this stops future loading of the tag. LinkedIn may retain data already received (see §5.16).

Legal basis: Art. 6(1)(a) GDPR — consent; § 25 TDDDG.

5. Third-Party Processors

We share personal data only with the following trusted sub-processors, each bound by data processing agreements and applicable data protection law. We do not sell your personal data.

5.1 Supabase (Authentication & Database)

We use the Supabase open-source stack for authentication and our primary database. This is self-hosted by us on a Hetzner Cloud VPS in Helsinki, Finland (EU/EEA). Your personal data — including your email address, hashed password, and all application data (profile, workspace, artists) — is stored on that server within the European Union. We do not use Supabase's managed cloud hosting. No international transfer to a third country occurs for this data.

Supabase Privacy Policy →

5.2 Hetzner (Application Hosting)

Hetzner Online GmbH (Germany) provides the cloud infrastructure on which we host the vocumi web application and marketing pages. Application servers run on a VPS in Helsinki, Finland (EU/EEA). Server access logs are described in §3.9. Hosting data remains within the EU/EEA. Hetzner Cloud servers are unmanaged — we are responsible for configuring application logs and security on the VPS; Hetzner retains only its own customer-account portal logs per Hetzner's GDPR deletion schedule.

Hetzner Privacy Policy →

5.3 Lemon Squeezy (Payment Processing & Merchant of Record)

Lemon Squeezy (a Stripe company, USA) processes all payments and acts as the merchant of record for your subscription. When you purchase a subscription, you enter into a payment relationship directly with Lemon Squeezy. They collect and process your billing name, email address, payment card details, and billing address. We receive only non-sensitive subscription metadata (status, plan type, renewal date, customer reference ID).

Lemon Squeezy Privacy Policy →

5.4 Resend (Transactional Email)

Resend Inc. (USA) delivers transactional emails on our behalf — including welcome emails, password reset links, workspace invitations, access change notifications, and weekly digest emails. To deliver these emails, we transmit your email address and, where applicable, your first name to Resend. Resend processes this data solely to deliver the email and may retain delivery logs for a limited period. Resend is GDPR-compliant via SCCs and acts as a data processor under our instruction.

Resend Privacy Policy →

5.5 Google (Gemini AI)

We use Google Geminivia Google's generative AI APIs for features such as Vibe Search, Similar Artists, Pulse / AI Profile, metadata enrichment, and Insights. We do not offer Sign in with Google.

Vibe Search: the text you type is included in the Gemini request so the model can rank or discover matching artists.

Other Gemini features: prompts contain publicly available or platform-derived artist information (names, biographies, tags, metrics summaries) — not your account email, password, or billing details.

Google processes these inputs as our AI provider. Review Google's API / generative AI data policies for how inputs are handled. Transfers to Google (USA) rely on Standard Contractual Clauses (Art. 46(2)(c) GDPR) or other appropriate safeguards.

Google Privacy Policy →

5.6 OpenAI (Vector Embeddings)

vocumi uses OpenAI's text-embedding-3-small model to generate vector embeddings. Embeddings power similarity matching for Vibe Search and related discovery features.

Vibe Search: your vibe query text is sent to OpenAI to create an embedding for that search.

Artist embeddings: publicly available or platform-stored artist text (names, genres, tags, descriptions) may be sent to OpenAI — your personal account data is not included in those artist-embedding requests.

OpenAI Inc. is based in the United States. Data is transferred under Standard Contractual Clauses (SCCs) (Art. 46(2)(c) GDPR). OpenAI's API data usage policy states that API inputs are not used to train models by default.

OpenAI Privacy Policy →

5.7 Brave Search (Web Intelligence)

vocumi uses the Brave Search API to enrich artist profiles with publicly available web information (news, interviews, descriptions). Only artist names and publicly known identifiers are sent as search queries — your personal data is not transmitted.

Brave Software Inc. is based in the United States. Data is transferred under Standard Contractual Clauses (SCCs) (Art. 46(2)(c) GDPR).

Brave Privacy Policy →

5.8 Apify (Social Media Data Collection)

vocumi uses Apify to collect publicly available social media metrics for artists (e.g., Instagram follower counts, engagement data). Only publicly visible artist profile data is collected via Apify — your personal data as a vocumi user is never sent to Apify.

Apify Technologies s.r.o. is incorporated in the Czech Republic (European Union) and is subject to EU data protection law. No international transfer applies for Apify-processed data.

Apify Privacy Policy →

5.9 Soundcharts (Licensed Artist Metrics)

vocumi uses Soundcharts as a licensed data provider for streaming and market metrics that power artist scores and tracking. We send artist identifiers and names (for example Soundcharts UUIDs or Spotify artist IDs associated with artists in our catalogue) to retrieve metrics. We do not send your account email, password, billing details, or workspace notes to Soundcharts.

Soundcharts is a commercial third-party data provider. Artist metrics we receive may be stored in our EU-hosted database to deliver the Service. Transfers of any personal data (if any) outside the EEA rely on appropriate safeguards such as Standard Contractual Clauses where required.

Soundcharts Privacy Policy →

5.10 Spotify (Artist Search & Identity)

vocumi uses the Spotify Web API for artist search, identity resolution, and display assets (such as artist images and profile links) in discovery flows. Requests contain artist names or Spotify artist IDs — not your vocumi account credentials or personal profile.

Spotify API metrics are not used to calculate our proprietary Vocumi Score. On production, all score inputs come from Soundcharts (see §5.9). Spotify popularity or follower numbers may appear on search result cards for display only; they are not persisted for scoring and are not substituted when Soundcharts data is missing — in that case we skip the metrics refresh rather than calculate from Spotify.

Spotify Privacy Policy →

5.11 Hetzner (Product Feedback Hosting)

Product feedback submitted through feedback.vocumi.com is stored in a self-hosted OpenCan database on a separate Hetzner Cloud VPS, also in Helsinki, Finland (EU/EEA). This database is operated by us as data controller and is separate from our primary Supabase database, but subject to the same privacy obligations described in this policy.

5.12 MusicBrainz (Artist Identity)

vocumi queries the MusicBrainz open music encyclopedia (musicbrainz.org, operated by the MetaBrainz Foundation) to enrich artist profiles with identity metadata — for example real name, gender, birth year, nationality, and official social links. We send artist names and, when known, MusicBrainz IDs as search parameters. We do not send your account email, password, billing details, or workspace notes to MusicBrainz. MusicBrainz data is publicly contributed under open licences; we store matched MBIDs and derived fields in our EU-hosted database to avoid repeated lookups.

MusicBrainz API documentation →

5.13 Matomo (Self-Hosted Marketing Analytics)

When you accept Statistics on our public website, we use Matomo Analytics hosted by us at analytics.vocumi.com on the same Hetzner Cloud VPS (EU/EEA) as our application. Matomo is not a third-party SaaS processor — it is software we operate as data controller. Processing details, cookies, and retention are in §3.9 and §4. No data is shared with Matomo Cloud or other Matomo-hosted services.

5.14 Apple Podcasts, RSS & Podcast Catalogue Data

vocumi uses the Apple Podcasts / iTunes Search API and public RSS feeds to discover podcasts, resolve show metadata, and refresh episode cadence metrics. We send show names, feed URLs, and catalogue identifiers — not your account email, billing details, or workspace notes. We do not access private podcast analytics, listener counts from hosting dashboards, or subscriber PII.

Podcast metrics we derive (for example episode count, publish cadence, and derived scores) are calculated from publicly available feed data and stored in our EU-hosted database. AI features such as podcast Vibe Search and Similar Podcasts send show titles, descriptions, and genres to Google Gemini for matching — see §3.3.

Apple Privacy Policy →

5.15 Company pages on Instagram and LinkedIn

We operate company pages at instagram.com/vocumi_ and linkedin.com/company/vocumi to communicate with visitors and publish information about vocumi. If you interact with those pages (follow, comment, message, or view content while logged in), the network operators process your data under their own policies. That processing may take place outside the EEA.

Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Instagram privacy policy. Transfers to Meta in the United States may rely on the EU–US Data Privacy Framework (DPF) and/or Standard Contractual Clauses.

LinkedIn Page Insights (joint controllers): Together with LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland, we are joint controllers for the collection(but not the further processing) of Page Insights statistics for our LinkedIn company page. This can include types of content viewed or interacted with, device information (such as IP address, OS, browser, language, cookies), and profile fields such as job function, country, and industry. We have entered into LinkedIn's Page Insights Joint Controller Addendum. LinkedIn provides the Insights tools and is best placed to answer access or deletion requests for that data; you can also contact us. Further processing (including any transfer to LinkedIn Corporation in the USA) is carried out by LinkedIn. LinkedIn privacy policy. Opt-out for LinkedIn advertising/retargeting: guest controls.

Legal basis: Art. 6(1)(f) GDPR — legitimate interests in public communication and understanding aggregated page reach. Company-page Insights are separate from the LinkedIn Insight Tag on vocumi.com (§5.16), which requires Marketing consent.

5.16 LinkedIn Insight Tag (ads measurement)

If you accept Marketingon our public website, we load the LinkedIn Insight Tag (partner ID 10865969) from LinkedIn's scripts (snap.licdn.com / px.ads.linkedin.com). The tag is used for conversion measurement, website audiences / retargeting, and Website Actions in LinkedIn Campaign Manager. We do notenable Enhanced Matching (hashed emails) and we do not install the tag on login, billing, settings, or legal pages. We do not include LinkedIn's noscript tracking pixel (it would run without a cookie choice).

LinkedIn Ireland Unlimited Company is an independent controller of personal data processed for LinkedIn Marketing Solutions (see LinkedIn's Independent Controller Addendum, DPA, and Ads Agreement). vocumi is controller for placing the tag on vocumi.com after your consent. Data is stored on LinkedIn servers in the United States; LinkedIn cites the EU–U.S. Data Privacy Framework and Standard Contractual Clauses (Module 1). LinkedIn states that direct identifiers are removed within about seven days and remaining pseudonymous data within about 180 days. The first-party LinkedIn Ads ID (li_adsid) is not used for traffic from the EU/EEA, UK, or Quebec.

This is not the same processing as LinkedIn Page Insights for our company page (§5.15). Matomo (§3.9 / §5.13) does not receive Insight Tag data; LinkedIn campaign URLs may include mtm_* / utm_* parameters so Matomo can attribute a visit if you also accepted Statistics.

LinkedIn privacy policy · LinkedIn advertising opt-out

Legal basis: Art. 6(1)(a) GDPR — your consent; § 25 TDDDG.

6. Artist Data & Third-Party Music Platforms

The artist intelligence data displayed in vocumi is aggregated from publicly available sources and licensed providers, including Soundcharts, Spotify, MusicBrainz, Instagram, TikTok, YouTube, SoundCloud, Last.fm, and other music or social platforms. This data relates to artists as public figures, not to our users as private individuals.

vocumi uses automated tools (including Google Gemini, OpenAI embeddings, Brave Search, Apify social data collection, Spotify search, and Soundcharts metrics APIs) to collect and update artist information on a regular schedule or on demand. We do not use this artist data to build profiles of individual private persons who are not the artists themselves.

7. International Data Transfers

The vocumi application, our self-hosted Supabase database, and product feedback (OpenCan) are all operated on servers in Helsinki, Finland (EU/EEA). This hosting does not involve international transfer to a third country.

Some providers used for specific features are based outside the EEA or process data globally. Where personal data is transferred outside the EEA we use safeguards under Chapter V GDPR:

• EU–US Data Privacy Framework (DPF) — where the recipient is certified, we rely on the Commission adequacy decision of 10 July 2023. See dataprivacyframework.gov.
• Standard Contractual Clauses (SCCs) (Art. 46(2)(c) GDPR) — as the primary tool, or as a fallback if DPF status changes.

Vendor-by-vendor (personal data we send, if any):

• Hetzner, Apify, self-hosted Matomo/Supabase/OpenCan — EU/EEA; no third-country transfer for that hosting.
• Lemon Squeezy (Stripe company, USA) — billing as merchant of record. SCCs; Stripe participates in the DPF. We receive subscription metadata only.
• Resend (USA) — transactional email. SCCs.
• Google (Gemini) — AI features and search ranking. DPF and/or SCCs.
• OpenAI — embeddings for Vibe Search. SCCs; DPF where certified.
• Brave Search, Spotify, Apple— artist/podcast catalogue lookups. SCCs and/or the provider's published transfer tools; we send names and identifiers, not your account email.
• Soundcharts — licensed metrics; hosting per their policy; SCCs where a transfer of personal data occurs.
• Meta (Instagram) and LinkedIn — company pages (see §5.15). Insight Tag on vocumi.com (see §5.16) is independent-controller processing by LinkedIn with DPF and/or SCCs.

Further Commission material on transfers: international dimension of data protection.

8. Data Retention

• Account & profile data: Retained for the duration of your account plus up to 30 days after deletion request, unless legal retention obligations apply.
• Vibe query text: Not retained in our database. Processed transiently by OpenAI and Google Gemini during the search request (see §3.3).
• Direct Search query text: Not retained in our database. Processed transiently by Spotify, Soundcharts, and/or Google Gemini during the search request (see §3.4).
• Server access logs: Rotated on our VPS at up to three files of 10 MB per service container (see §3.9). Effective retention in days depends on traffic volume.
• Marketing analytics (Matomo): Raw visit and event data deleted after 6 months (180 days) by automated purge on our Matomo instance; aggregated reports may be kept per Matomo configuration.
• LinkedIn Insight Tag: Processed by LinkedIn as independent controller; they publish about 7 days to pseudonymise and about 180 days for remaining data (see §5.16).
• Feature & AI usage counters: Retained for approximately the current period plus 3 months for quota verification and cost management; deleted automatically on a scheduled job.
• Product telemetry: Retained for 60 days, then deleted automatically by a scheduled cleanup job (Art. 5(1)(e) GDPR storage limitation).
• Billing data: Retained for 10 years in accordance with German commercial and tax law (§ 147 AO, § 257 HGB).
• Email logs: Retained for up to 2 years; automatically deleted by a scheduled database job thereafter (Art. 5(1)(e) GDPR storage limitation).
• Workspace & artist data: Retained until you delete the workspace or close your account. Upon account closure, we will delete or anonymise your personal data within 30 days.
• Product feedback: Retained for up to 24 months or until account deletion, whichever comes first. Post content may be retained in anonymised form after deletion for product prioritisation.

Statutory German commercial and tax retention

Independently of product deletion, German law can require us to archive certain records. Where several periods apply, the longest applies. Periods of at least one year that are not tied to a specific date generally start at the end of the calendar year of the triggering event. For ongoing contracts, that event is typically the end of the contractual relationship.

• 10 years — books, inventories, annual accounts, opening balance sheets and related organisational records (§ 147(1) no. 1, (3) AO; § 257(1) no. 1, (4) HGB).
• 8 years — booking documents such as invoices (§ 147(1) no. 4 and 4a, (3) AO; § 14b(1) UStG; § 257(1) no. 4, (4) HGB).
• 6 years — other commercial letters and tax-relevant business papers (§ 147(1) no. 2, 3, 5, (3) AO; § 257(1) no. 2 and 3, (4) HGB).
• 3 years — data we keep to assess typical contractual warranty or damages claims, based on the regular limitation period (§§ 195, 199 BGB).

Data kept only because of these duties is processed solely for that archival purpose, not for marketing.

9. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights (Articles 15–22 GDPR):

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
• Right to erasure / “right to be forgotten” (Art. 17): Request deletion of your personal data where there is no overriding legal basis for continued processing.
• Right to restriction of processing (Art. 18): Request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): Receive your personal data in a structured, machine-readable format.
• Right to object (Art. 21): You have the right, on grounds relating to your particular situation, to object at any time to processing based on Art. 6(1)(e) or (f) GDPR, including profiling based on those provisions. If we process your data for direct marketing, you may object at any time to that processing (including profiling related to such marketing). LinkedIn ads measurement on vocumi.com runs only with Marketing consent (§5.16); withdraw it in Cookie settings.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint (Art. 77): Lodge a complaint with a supervisory authority — in Germany, this is the relevant Landesbeauftragte für Datenschutz. For Bremen: datenschutz.bremen.de.

To exercise any of these rights, contact us at contact@vocumi.com. We will respond within one month as required by GDPR. Your account settings export includes product feedback linked to your Vocumi account where applicable.

Weekly digest opt-out (Art. 21 right to object): The weekly activity digest is sent on the basis of legitimate interests (Art. 6(1)(f) GDPR). You can exercise your right to object at any time by disabling the digest in your account settings — no justification required.

Marketing analytics (Art. 7(3) withdrawal): Where you have accepted statistics cookies, withdraw consent at any time via Cookie settings in the site footer (marketing pages). This stops future Matomo tracking; it does not delete data already collected before withdrawal.

LinkedIn Insight Tag (Art. 7(3) withdrawal): Turn off Marketingin Cookie settings to stop loading the tag. LinkedIn may keep data already received; use LinkedIn's advertising controls as well.

Product telemetry (Art. 21): In-app feature-adoption telemetry is processed on legitimate interests (Art. 6(1)(f) GDPR). To object, contact contact@vocumi.com. Telemetry rows older than 60 days are deleted automatically.

10. Security

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, or disclosure — including encryption in transit and at rest, access controls, and secure credential handling.

For a full overview of our security practices and how to report a vulnerability, see our Security page.

No method of transmission over the internet is 100% secure. If you suspect a security incident affecting your data, please contact us immediately at contact@vocumi.com.

11. Children's Privacy

The Service is intended for professional use by adults. We do not knowingly collect personal data from individuals under the age of 16. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify registered users of material changes via email at least 14 days before the changes take effect. The “Last updated” date at the top of this page reflects the current version. Continued use of the Service after changes constitutes acceptance of the updated Policy.

13. Contact & Data Protection Enquiries

For any privacy-related questions, requests, or complaints, contact us:

We do not currently have a formally appointed Data Protection Officer (DPO) as we do not fall within the mandatory DPO categories under Art. 37 GDPR. Privacy inquiries are handled directly by the company management. The address above is also the contact for data-protection enquiries (not a statutory DPO appointment).