Last updated:
GrooveGauge helps you discover music through reviews, artist information and personal recommendations. This policy explains what happens to your personal data when you visit our website, create an account, use our API, join the newsletter or submit music.
It applies to the English and Dutch versions of GrooveGauge, including visits through groovegauge.com and groovegauge.nl.
1. Who is responsible?
GrooveGauge is operated by Sitix. Sitix is the controller responsible for the personal data described in this policy. For privacy questions, objections or requests about your data, email info@groovegauge.com.
2. Your account and music preferences
When you create an account, we process your email address, first name, username, language and account activity, such as registration and sign-in dates. Your password is stored as a secure hash, not as readable text. We also keep temporary verification and password-reset information and the information needed to keep you signed in.
If you save a release, follow an artist or genre, or like, dislike or skip something in Discovery, we save that choice with your account. We use it to show your collection, avoid repeating releases you have already rated or skipped, and make recommendations more relevant. Your personal Discovery choices are not displayed publicly.
We need your account details to provide the account features you request. You can browse reviews without an account. You can update your profile and delete your account through your account. Account deletion and newsletter unsubscription are separate actions.
3. The newsletter and other emails
For the newsletter we use your name, email address, language, selected genres and subscription status. We store your current preferences and record your subscription confirmation, consent source and unsubscribe status. Newsletter signup normally includes email confirmation; an account with a verified address can subscribe through its newsletter settings.
We keep a record of which reviews we have sent you so future newsletters can offer new content. We also record sending attempts, delivery reports, bounces, complaints and unsubscribes. Our newsletter system does not use tracking pixels to measure opens or tracking links to measure clicks.
Newsletter delivery is based on your consent. You can withdraw it using the unsubscribe link in an email or your newsletter preferences. Unsubscribing stops future newsletters; it does not automatically erase earlier consent or delivery records. We may keep a limited suppression record to avoid sending messages to an unsubscribed, invalid or complaining address.
Account verification, password-reset and service emails are separate from the newsletter. We send them when needed to carry out your request or operate your account.
4. Music submissions and correspondence
If you submit music, we receive the name and email address you provide, the artist and release details, music links, selected genres, biography, description and any optional social-media details. We use this information to assess the submission, prepare editorial work, keep track of our correspondence and contact you about a published review. Submission details are stored in our editorial system and sent to the editorial email environment.
Artist names, release information and material intended for publication may appear in reviews and artist pages. Your private contact email is not published as part of a review. Sending music does not automatically subscribe you to the newsletter.
For music identification we may search Spotify or Apple using artist names and release titles. Editorial translation tools receive review text and relevant music or concert information. Submission contact fields are not automatically included in that translation context.
5. Website statistics and security
Our own statistics system records information such as your IP address, browser and device information, language, visited pages, referring page, campaign parameters and visit times. It also records technical information that helps distinguish human visits from automated traffic, including a browser-verification result. We use a temporary visit identifier and a derived browser identifier; this information is not fully anonymous.
We use these records to understand which content is useful, maintain the website and investigate automated or abusive traffic. Our own visitor measurement respects the browser signals Do Not Track and Global Privacy Control. Those signals do not, by themselves, control Google or Spotify. Technical server and security logs may still be needed to operate the website.
Forms, sign-ins and API requests use automated security checks and rate limits. These can temporarily reject a request or limit access. Our visitor bot classification is used for statistics and does not itself block visitors. If a security check causes a problem, contact us so we can review it.
6. API accounts
If you request API access, we keep your account association, project name, project URL and purpose, API-key information and usage records. We store API-key hashes rather than the full secret key.
API statistics include the requested resource, time, response status, response time, amount of data returned and a hashed IP identifier. They help us provide usage reports, enforce limits and investigate misuse. Detailed API request logs are kept for 30 days and daily usage totals for 366 days, with scheduled cleanup. Revoking a key stops future use but does not immediately erase its usage history.
7. Cookies, Google services and music players
Cookies needed for the website
- PHPSESSID: a session cookie used for account sessions, form security, temporary website state and temporary state for our own visitor measurement. It is set for the browser session; browser session-restore settings can affect when it disappears.
- __Host-gg_listener: a secure sign-in cookie that lasts up to 30 days after signing in. Signing out revokes the relevant login.
Blocking these cookies may prevent sign-in or forms from working. You can remove stored cookies through your browser settings.
Google Tag Manager and AdSense
We use Google Tag Manager to manage website tags and Google AdSense to support advertising. Loading Google services can send Google information such as your IP address, browser information and the page you visit. Google and other advertising providers may place or read cookies and similar identifiers.
Advertising cookies can allow Google and its partners to show personalised ads based on earlier visits to GrooveGauge and other websites. Optional tracking requires consent where applicable. Creating an account, subscribing to the newsletter or continuing to browse does not in itself give that consent.
If a Google privacy message is presented, it explains the available choices and participating advertising providers. You can also manage Google ad personalisation in My Ad Center. Turning off personalised ads there is not the same as blocking every cookie or withdrawing every website permission. Browser controls can block or remove cookies, including third-party cookies.
Read how Google uses information from partner websites and Google's cookie information. The exact third-party cookies and their duration depend on the services loaded, your choices and the provider's settings.
Spotify and external links
Pages can contain Spotify players. When an embedded player loads, your browser connects to Spotify, which can receive your IP address and browser information and use its own cookies or identifiers. If you are signed in to Spotify, Spotify may associate activity with your account. See Spotify's privacy policy. Other external links take you to services with their own privacy policies.
8. Why we may use your data
We use the information needed to provide the account, saved music and API services you request. Newsletters rely on consent. Optional tracking also requires consent where applicable. Our legitimate interests include securing and maintaining the website, understanding its use, preventing duplicate or unwanted emails, handling music submissions and carrying out editorial work. These interests must be weighed against your privacy, and you can object to processing based on them. We may also need to retain or disclose information to meet a legal obligation or handle a legal claim.
Your music preferences influence recommendations and newsletter selections. We do not use them to make solely automated decisions that have legal or similarly significant effects on you.
9. Who can receive information?
Access is limited to the people and technical services needed to operate GrooveGauge, including hosting, email delivery, maintenance and editorial tools. Google, Spotify and other services you visit or load can process information as described above and in their own privacy policies. We may also disclose information where legally required or necessary to protect the website or deal with a dispute. Our public music API provides editorial and music information, not subscriber lists or private account profiles.
External providers may process information outside the European Economic Area, including in the United States. Google explains its use of adequacy decisions, the EU–US Data Privacy Framework and standard contractual clauses in its international transfer information. Spotify describes its international processing and safeguards in its privacy policy. You can contact us for information about the services involved in handling your data.
10. How long we keep information
Retention depends on the purpose of the record, whether you still use the service, whether an enquiry or dispute remains open, and any applicable legal requirements. Apart from the technical periods stated in this policy, we do not currently apply one fixed automatic deletion period to every record.
- Account and music choices: kept until you delete your account. Account deletion removes the profile and saved music choices, but separate newsletter, email, API and security records can remain for their own purposes.
- Newsletter records: used while you are subscribed. Consent evidence, delivery history and suppression records can remain after unsubscription to handle complaints, show how a subscription was managed and avoid unwanted messages.
- Submissions and correspondence: kept to assess music, manage follow-up and document editorial work. Moving a submission to the editorial trash is not permanent deletion.
- Our own visitor statistics: kept for website analysis and investigation of technical problems or misuse. These records currently have no fixed automatic deletion period. Separate authentication and API security counters have shorter cleanup periods; for example, sign-in rate counters and API rate counters are removed after two days.
- Short-lived links: newsletter confirmation links expire after 24 hours; account verification and password-reset links normally expire after 30 minutes. Expiry stops a link from working and does not mean every associated record is erased at that moment.
If you believe information is no longer needed, you can ask us to delete it. We will assess what can be removed and explain any information that must be retained. Copies in email systems, logs or backups may follow separate retention cycles; deleting an active record is not a promise of immediate removal from every backup.
11. Your rights and contact
Subject to the conditions in data-protection law, you can ask to access, correct or delete your personal data, restrict its use, receive a portable copy or object to processing based on legitimate interests. You can withdraw consent at any time; this does not change the lawfulness of processing before withdrawal.
Email info@groovegauge.com with your request. We may need proportionate information to verify that it concerns your data. Please do not send an identity document unless we explain why one is necessary. We normally respond within one month. If a lawful extension is needed because a request is complex or numerous requests have been made, we will explain that within the first month.
You can complain to the Dutch Data Protection Authority or your local data-protection authority.
12. Changes to this policy
We may update this policy when the website or our use of data changes. The date above shows the latest update. If a change requires a new choice or consent, publishing an updated policy does not replace that choice.
