Privacy Policy

Last updated: 6 August 2026 Effective date: 6 August 2026

This policy explains what personal data Soundee collects, why, on what legal basis, who we share it with, how long we keep it, and what you can do about it. It applies to soundee.com, our subdomains (including checkout, payments and subscription pages), Stores we host for Sellers, our embeddable players and embedded stores, and our APIs (together, the "Platform").

Words defined in our Terms of Service have the same meaning here.

---

1. Who is responsible for your data

Soundee is the controller for the processing described in this policy.

1.1 Sellers are separate controllers

Soundee is a marketplace. When you buy from a Seller, or download a free Item that requires your email address, the Seller receives your data as an independent controller and decides for themselves what to do with it. That includes your email address, your order details and, where relevant, the licence issued in your name.

We are not responsible for what a Seller does with that data. Sellers must comply with data protection law themselves, must have their own privacy notice where required, and must honour your rights. If you cannot reach a Seller, contact us at privacy@soundee.com and we will help you get in touch.

Sellers may also connect their own third-party tools — Mailchimp, ActiveCampaign, ConvertKit, GetResponse, Zapier and others — and forward your data to them. That transfer happens on the Seller's instruction, under the Seller's responsibility.

---

2. What we collect

2.1 Data you give us

We do not receive or store your full card number or bank details. Those go directly to the payment provider (see section 5.2).

2.2 Data we collect automatically

2.3 Data from others

• Payment providers (Stripe, PayPal) send us confirmation that a payment succeeded or failed, the amount, currency, the last four digits and brand of the card, and dispute or chargeback notifications.
• Google Sign-In, if you use it to register or log in, sends us your email address and basic profile information as permitted by your Google account settings. We do not receive your Google password.
• Advertising and analytics platforms send us aggregated campaign performance and conversion data.
• Rights holders and reporters send us information in copyright and illegal-content notices.

2.4 Special category data

We do not ask for and do not want data revealing health, ethnicity, political opinions, religion, trade union membership, sex life or sexual orientation, or biometric or genetic data. Please do not put it in your profile, your Content or your support messages.

---

3. Why we use it, and on what legal basis

Where we rely on legitimate interests, we have balanced our interest against your rights and concluded that our processing is not overridden by them. You can ask us for that assessment, and you can object — see section 8.

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that already happened.

---

4. Cookies and similar technologies

We use cookies and similar technologies. You choose which categories to allow the first time you visit, and you can change your choice at any time from the cookie settings link in the footer.

We use Google Consent Mode: until you allow the relevant category, Google's analytics and advertising storage stay denied.

4.1 Necessary

Always on. Needed for the Platform to work — signing in, keeping your session, keeping your cart, security, load balancing, and remembering your cookie choice. These do not require consent.

4.2 Analytics — requires your consent

We use Google Analytics 4 (property G-BP7HELE27D) to understand how the Platform is used.

4.3 Marketing and attribution — requires your consent

We use Google Ads to advertise Soundee and to measure which campaigns lead to signups and sales.

The last three groups are set on .soundee.com so that attribution survives when you move between soundee.com, checkout and the subscription pages.

Marketing cookies are written only after you accept the marketing category, and are deleted again if you withdraw that consent.

4.4 Managing cookies

• Change your choice at any time from the cookie settings link in the footer.
• Your browser can block or delete cookies; blocking necessary cookies will break parts of the Platform.
• Opt out of Google Analytics across all sites: tools.google.com/dlpage/gaoptout.
• Manage Google ad personalisation: myadcenter.google.com.

---

5. Who we share data with

We do not sell your personal data.

5.1 Sellers and Buyers

• A Seller receives the order and licence details of their own sales, and the email address of anyone who takes their free download. See section 1.1.
• A Buyer sees the Seller's public profile and the identity information a Seller is required to publish as a trader.

5.2 Service providers

We use the following processors and independent controllers. Each is bound by a data processing agreement where it acts as our processor.

If you connect a Seller integration (Mailchimp, ActiveCampaign, ConvertKit, GetResponse, Zapier and others), that provider receives data on your instruction as described in section 1.1.

5.3 Others

• Authorities, courts and regulators, where we are legally required to disclose, or where it is necessary to establish or defend legal claims. We check that requests are valid and disclose only what is necessary.
• Rights holders, where we forward a copyright counter-notice, as copyright law requires.
• Professional advisers (lawyers, accountants, auditors) under duties of confidentiality.
• An acquirer, if Soundee is merged, acquired or sold, subject to this policy continuing to apply.

---

6. International transfers

The Platform runs on Amazon Web Services in the us-east region, in the United States. That means the personal data described in this policy — your account, your Content, your orders and your support conversations — is stored and processed in the United States, not in the European Economic Area. Google, Intercom and our payment providers also process data in the United States.

Where we transfer personal data outside the EEA, we rely on one of:

• an adequacy decision by the European Commission, including the EU–US Data Privacy Framework for providers that are certified under it;
• the European Commission's Standard Contractual Clauses, together with a transfer impact assessment and, where needed, additional technical measures such as encryption in transit and at rest;
• an exception under Article 49 GDPR, where the transfer is necessary to perform your contract.

AWS, Google and Intercom are certified under the EU–US Data Privacy Framework, and our agreements with them also incorporate the Standard Contractual Clauses. Data is encrypted in transit and at rest.

You can ask us for a copy of the safeguards we use at privacy@soundee.com.

---

7. How long we keep it

Where a legal claim, investigation or regulatory request is pending, we keep the relevant data until it is resolved.

---

8. Your rights

You have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected. Most of it you can edit yourself in your account settings.
• Erasure — have your data deleted, where we no longer need it and no legal obligation requires us to keep it. Invoices and tax records cannot be deleted before the 7-year period ends.
• Restriction — have processing paused, for example while we check the accuracy of data you have contested.
• Data portability — receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible.
• Object — object to processing based on our legitimate interests, on grounds relating to your particular situation. You can object to direct marketing at any time, for any reason, and we will stop.
• Withdraw consent — at any time, for anything we do on the basis of consent, including cookies and marketing email.
• Not be subject to solely automated decisions producing legal or similarly significant effects — see section 9.

To exercise any of these, email privacy@soundee.com. We may ask you to confirm your identity, which for account holders normally means writing from your account email address. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. Exercising your rights is free unless a request is manifestly unfounded or excessive.

Complaints. If you think we have handled your data wrongly, please tell us first. You also have the right to complain to a supervisory authority — for the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) — or to the authority in your country of residence or work.

---

9. Automated decision-making and profiling

We use automated processing to:

• rank Items in charts, search results and recommendations;
• flag suspicious transactions, accounts and uploads for review;
• detect likely infringing uploads and likely spam.

We do not make decisions with legal or similarly significant effects about you by automated means alone. Where an automated system flags your account or Content — for example blocking a suspected fraudulent transaction or restricting an account — a person reviews the case before any lasting measure such as suspension or termination, and you can challenge the decision under section 8.4 of our Terms. If an urgent automated block is applied to prevent harm, you can ask for human review immediately and we will carry it out promptly.

---

10. Security

We protect your data with measures including encryption in transit (HTTPS), encryption at rest for stored files and databases, hashed passwords, access controls and least-privilege access for our staff, logging and monitoring, regular patching, backups, and contractual security obligations on our providers.

No system is completely secure. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours, and we will notify you directly where the risk is high.

To report a vulnerability, email security@soundee.com. We will not pursue researchers who act in good faith, do not access or modify other users' data, and give us reasonable time to fix the issue before disclosing it.

---

11. Children

You must be 16 or older to create an account. Selling on Soundee requires you to be 18 or older — see section 4.1 of our Terms. Sixteen is the age at which, in the Netherlands, you can consent to the processing of your own personal data under Article 8 GDPR.

We do not knowingly collect personal data from anyone under 16.

If you are a parent or guardian and believe your child has given us personal data, email privacy@soundee.com and we will delete it.

---

12. Changes to this policy

We may update this policy. When we make a material change, we will tell you by email or by a notice on the Platform before it takes effect, and we will update the date at the top. Non-material changes take effect when posted.

We keep previous versions available on request at privacy@soundee.com.

---

13. Contact

Postal: Hooiland 44, 9408 RB Assen, The Netherlands.