Privacy Policy

1. Who is responsible (controller and processor)

Iloomify works with two kinds of responsibility under the GDPR.

• Iloomify as controller. For your account and profile data, sign-in and security, the operation of the platform, our own records, payments on the platform side and support, the controller is [COMPANY LEGAL NAME], [REGISTERED ADDRESS], KvK no. [KVK NUMBER]. Contact privacy@iloomify.io.
• The creator as controller, Iloomify as processor.When you submit to a creator, that creator decides why and how they use the personal data you share with them (your submission, your handle or display name, any message, and their reaction or feedback). For that data the creator is the data controller and Iloomify acts as the creator's processor, processing it only to provide the Service and on the creator's instructions, under the data processing terms in our Terms and Conditions. Creators are responsible for having a lawful basis for using their fans' data and for answering their fans' requests, and Iloomify will help them do so.

If you are a fan and want to exercise your rights over data a creator holds about you, you can contact the creator, or contact us and we will pass your request on. For data where Iloomify is the controller, contact privacy@iloomify.io.

2. What data we collect

Account & profile data

• Email address and a hashed password (we never store your password in plain text).
• Display name, and, if you choose to provide them, country, language, music genres and an avatar image.
• For creators: your public handle, bio, prices/tiers and live status.

Submission data

• The tracks you submit: link, title, artist, the platform you watch on and your handle there, any message you add, and any image/audio/video you upload. Submissions can be made with or without an account.

Payment data

• Payments are processed by Stripe. We receive and store the amount, currency, status, payment method type and Stripe identifiers, but not your full card number, which is handled directly by Stripe as a separate controller/processor.

Other data

• Ratings you give or receive, badges, and in-app notifications.
• Messages you send us via the contact form (name, email, subject, message).
• Technical data needed to run and secure the Service, such as your IP address, device/browser information and basic logs.

3. How and why we use your data

• To create and run your account and the submission queue.
• To process payments and creator payouts.
• To show your submission to the relevant creator and operate the public queue.
• To moderate content, prevent fraud and abuse, and keep the Service secure.
• To respond to your messages and provide support.
• To comply with legal, accounting and tax obligations.

4. Legal bases (GDPR Art. 6)

• Performance of a contract: to provide the Service you signed up for (accounts, submissions, payments, payouts).
• Legitimate interests: to secure the Service, prevent fraud and abuse, and improve the product, balanced against your rights.
• Legal obligation: to keep financial records and respond to lawful requests.
• Consent: where we ask for it (for example optional profile details); you can withdraw consent at any time.

5. Cookies

We use a small number of strictly functional cookies and do not use third-party advertising trackers:

• iloomify_token: a secure, httpOnly cookie that keeps you signed in.
• NEXT_LOCALE: remembers your language choice.
• Stripe may set its own cookies when processing a payment, as described in Stripe's privacy policy.

6. Who we share data with

We do not sell your personal data. We share it only with:

• The creator you submit to: your submission, your chosen handle/display name and any message you include are shown to that creator.
• Stripe: to process payments and payouts.
• Our hosting and infrastructure providers: who store and serve the application on our behalf under data-processing agreements.
• Authorities: where we are legally required to, or to protect our rights and users.

7. International transfers

Some providers (such as Stripe) may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

8. How long we keep data

• Account and profile data: for as long as your account exists, then deleted or anonymised.
• Payment and transaction records: kept as long as required by law (in the Netherlands, financial records are generally retained for 7 years).
• Contact messages and logs: kept only as long as needed for the purpose they were collected.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten"), subject to legal retention duties;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw any consent you gave, without affecting prior processing.

To exercise any of these, email privacy@iloomify.io. You also have the right to lodge a complaint with your data-protection authority. In the Netherlands, the Autoriteit Persoonsgegevens.

10. Security

We protect your data with measures appropriate to the risk, including encryption of traffic in transit (HTTPS) and strong, industry-standard hashing of passwords. No system is perfectly secure, but we work to keep your data safe and will notify you and the relevant authority of a personal-data breach where the law requires.

11. Children

The Service is not intended for children under 16 (or under 18 for creator/payout features). We do not knowingly collect data from children below these ages; if you believe a child has given us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new "last updated" date and, for material changes, take reasonable steps to notify you.

13. Contact

Privacy questions or requests: privacy@iloomify.io or via the contact form.