Privacy Policy
Version v1 · effective from 2026-10-29
This policy explains what personal data Bandzeen (band.datanius.com) and Pódium (podium.datanius.com) process, why, who else receives it and how long we keep it. It is the service-specific part of the Datanius Privacy Policy; for these services, this policy governs where the two differ.
1. Controller
Datanius s.r.o., ID No. (IČO) 300 66 786, Dandova 2619/13, Horní Počernice, 193 00 Praha 9, Czech Republic, registered with the Municipal Court in Prague, section C, file 456770. Contact for anything about your data: [email protected]. We have not appointed a data protection officer because the law does not require one for us.
2. What we process, why, and on what legal basis
| Data | Why | Legal basis (GDPR Art. 6(1)) | How long |
|---|---|---|---|
| Name, email, password hash, language, notification settings | Your account, sign-in, password reset, service emails | Contract (b) | Until you delete the account |
| Bands, membership and roles, invitations | Shared band workspace | Contract (b) | Until the band or your membership is deleted |
| Recordings, songs, photos, comments, notes, setlists, stage plots, calendar and concerts | The features you use | Contract (b) | Until you or your band delete them. On the free plan, original uploads are deleted once processing succeeds |
| Transcripts, chapters, summaries and song suggestions made from your recordings (voices in recordings may identify people) | AI features (section 4) | Contract (b) | Kept with the recording; deleted with it |
| Fan activity on Pódium: follows, likes, plays and listening progress, playlists, gifts (with country derived from IP, never the IP itself) | Pódium features, play counts and charts, statistics shown to bands | Contract (b); for anonymous visitors, legitimate interest (f) in counting plays fairly | Until you delete the account; anonymous activity is not linked to a person |
| Consent records: document version, time, hashed IP, browser type | Proof of what you agreed to | Legal obligation (c) and legitimate interest (f) | For the life of the account, then 3 years for possible claims |
| Billing: Stripe customer ID, plan, invoices (we never see your card number) | Payments, accounting and tax | Contract (b), legal obligation (c) | 10 years (Czech accounting and VAT law) |
| Reports of content and copyright notices: your name, email and what you report | Handling notices under the Digital Services Act | Legal obligation (c) | 3 years after the case is closed |
| Usage analytics: pages visited, device type, country, and for signed-in users your account ID | Understanding how the service is used and fixing problems | Legitimate interest (f) | Up to 24 months |
| Session replay and heatmaps (clicks, scrolling and what is shown on screen) | Finding usability problems | Consent (a), only if you accept analytics in the cookie banner | Up to 90 days |
| Security logs: IP address, browser, time, bot check result | Security, abuse and fraud prevention | Legitimate interest (f) | Up to 30 days |
| Error reports: device and browser type, the failing page, the error, with email addresses and invite links removed | Finding and fixing faults, such as recordings that will not play | Legitimate interest (f) in a working service | Up to 90 days |
| Marketing email (only if you opt in) | Product news | Consent (a) | Until you unsubscribe |
We do not sell personal data, show third-party ads or use your data for profiling with legal or similarly significant effects. If you record bandmates or other people, you are responsible for having their agreement.
3. Who receives your data
We use these processors, bound by data processing agreements:
| Processor | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, content delivery, bot protection (Turnstile) | EU and global network; USA |
| Our server provider in the EU | Audio conversion, transcription jobs and self-hosted analytics (Umami) | EU |
| Groq, Inc. | Speech-to-text and language-model processing for AI features | USA |
| Stripe Payments Europe, Ltd. | Payments | EU (Ireland); USA |
| Functional Software, Inc. (Sentry) | Error reports when something fails, such as playback. They contain the device and browser type, the failing page and the error, with email addresses and invite links removed | EU (Germany) |
| Mailgun Technologies, Inc. (Sinch) and ActiveCampaign, LLC (Postmark) | Sending service email | EU / USA |
| Google Ireland Ltd. | Web fonts (your browser sends your IP address when the fonts load); YouTube videos that bands embed, which load only when you play them | EU; USA |
| Your browser's push service (e.g. Google, Apple, Mozilla) | Delivering push notifications you turned on | Depends on your browser |
Members of your band see the band's content. Public content and your public profile on Pódium (display name, public playlists) are visible to everyone. We disclose data to authorities only where the law requires it.
4. AI features
When you start a transcription or use song analysis or suggestions, the recording's audio (converted to a compressed file) or the relevant text is sent to Groq, Inc. in the USA. Groq processes it only to return the result, may keep it for up to 30 days for abuse monitoring, and does not use it to train models. We store the result with the recording. No decision with legal or similarly significant effect on you is made automatically.
5. Transfers outside the EU
Where a processor is in the USA, the transfer relies on the EU-US Data Privacy Framework if the processor is certified, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
6. Cookies and local storage
We use only what is needed: a sign-in session cookie (180 days), your language (1 year), a random anonymous session ID on Pódium so that plays and likes are counted once, and your cookie-banner choice. Basic analytics are cookieless. Session replay runs only after you accept analytics, and you can withdraw that at any time in the cookie settings.
7. Deletion
You can delete content at any time and your account in the profile settings. Deleting your account also deletes the bands you created and everything in them, for all their members. Deleted data disappears from the live service immediately and from backups within 30 days; data we must keep by law (invoices) is kept only for that purpose.
8. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection (including to processing based on legitimate interest), and you can withdraw consent at any time without affecting earlier processing. You can edit and delete most data yourself in the app; for a copy of your data or anything else, write to [email protected]. We reply within one month and may first confirm that you control the account's email. You can complain to the Czech Office for Personal Data Protection (uoou.gov.cz) or the authority in your EU country.
9. Children
The service is for people aged 16 and over. If you believe a younger child has an account, tell us and we will delete it.
10. Security and breaches
The service runs only over HTTPS, passwords are stored as salted hashes, session cookies are HttpOnly and SameSite, and private recordings are served only through signed, expiring links. If a breach puts your rights at risk, we notify the Czech Office for Personal Data Protection within 72 hours and you without undue delay.
11. Changes
When this policy changes substantively, we publish a new version with a new date and tell registered users by email. Earlier versions remain available.