Deutsch | English

Privacy Policy

Version of 2 November 2026 (version 2026-11-02.2). This English text is a translation for your convenience; in case of doubt the German version (“Datenschutzerklärung”) prevails.

Change compared with the version of 31 October 2026: section 10 (preview player for curators) was added.

1. Controller

Niclas Koenigsbuescher, Senftenberger Ring 26, 13435 Berlin, Germany. Contact: info@playlistdock.com. We have not appointed a data protection officer as this is not legally required.

PlaylistDock is intended exclusively for persons aged 18 or over. If we find that a person under 18 has sent us data, we delete it.

2. Overview: what data we process and why

The following sections describe each processing activity by group of persons and feature: purpose, legal basis (GDPR), recipients and retention. An overview of retention periods is in section 14.

3. Artists: submitting a song

What data. You submit without an account. We process:

• the Spotify track link, your email address and your optional message to the curator (max. 500 characters);
• your statement whether AI was used in creating the song;
• the uploaded cover image (section 4);
• your confirmation of age (18+), rights and terms, with time and terms version;
• optionally: a submission code, consent to the YouTube promo (with audio file and, if applicable, monetisation permission, section 8), the box for PlaylistDock updates, and which Follow Gate links you clicked before submitting (section 9);
• technical data: your IP address (for submission limits and abuse protection), a daily-changing, non-traceable visitor hash (see section 12) and – only if you allowed analytics in the cookie banner – a random visitor ID;
• publicly available Spotify data about the track and artist that we retrieve via the Spotify Web API and store: title, artist name, popularity, duration, release date, genres, follower count, Spotify cover image;
• the curator’s decision with their message, the result of our automatic check whether the track is live on the playlist and of later removal checks, and, where applicable, your rating (section 6) and stream report (section 7).

Purpose and legal basis. Carrying out your submission, delivering the decision, checking the placement, creating the graphics and videos under section 4: Art. 6(1)(b) GDPR (contract or pre-contractual measures). IP address, visitor hash, limits and abuse protection, and platform analysis: Art. 6(1)(f) GDPR (legitimate interest in operating, securing and improving the service). Updates box and YouTube promo: Art. 6(1)(a) GDPR (consent).

Recipients. The curator of the playlist you submit to sees the track with Spotify indicators, your message, the AI statement, the Follow Gate statement and – after a placement – your voluntary rating. The curator does not see your email address. We send you the curator’s decision (acceptance or decline with message) by email.

Record of the accepted version. With every submission we store the version numbers of the Terms and the Privacy Policy that applied at that moment and that you confirmed (Art. 6(1)(f) GDPR, proof of the contractual basis).

Retention. Email address, IP address, message, visitor hash and technical identifiers are automatically anonymised 180 days after the curator’s decision (or after submission if no decision was made). Uploaded files are deleted after the same period. Track, Spotify, decision and rating data without personal reference (including the text of the curator’s message) are kept for statistics. Please therefore do not write sensitive data in the message to the curator or in comments.

No changes, but deletion on request. A submission cannot be changed or withdrawn within the service (Terms, section 6). Your right to erasure and withdrawal remains unaffected: write to info@playlistdock.com and we will delete your personal data or cover image early unless legal reasons prevent us.

Obligation to provide data. Email address, track link, cover image, AI statement and confirmations are required to submit; without them no submission is possible. All other details are voluntary.

4. Cover image: what happens to it

Mandatory. The cover image is mandatory with every submission. We read the file, check type and content, fully re-encode it on our server and remove all embedded metadata (e.g. EXIF data such as location or device information). If needed the image is downscaled to at most 2,500 pixels. Only this re-encoded copy is stored. Persons or content depicted may be personal data; please only upload images for which you hold the rights (and, if applicable, consents).

Purposes (Art. 6(1)(b) GDPR). The image is used together with title and artist name for: (a) creating the “Your track is live” graphic and – where available – the story video for you; (b) providing the placement graphic and creating weekly recap graphics and playlist reels for the curator you submitted to, who may use them to promote their playlist, including publicly (e.g. Instagram); (c) with your express consent, the YouTube video (section 8). No other use or disclosure takes place. We do not use the Spotify cover for this.

Who sees it. Your uploaded cover is not shown on our public pages (directory, home page). Created graphics are reachable through personal, non-guessable links (link in your email or in the curator’s interface). We as operator also have access. If you or the curator publish a graphic, it is public; we have no influence on it afterwards.

Retention. Deletion of the cover image 180 days after the curator’s decision (or after submission if no decision was made). Created videos (story videos) are in a non-public directory and deleted after 45 days at the latest. If a YouTube promo is declined, we delete the files uploaded for it after a grace period of three days. On request we delete the image earlier at any time.

5. Emails to artists

We send you – exclusively to the address given at submission – the following emails, each to perform the contract (Art. 6(1)(b) GDPR): the curator’s decision (acceptance, decline, “not placed”) with the link to the graphic/video and; the confirmation that your track is live (with links to graphic, story video and to the rating); the message “Your track was discovered” when another curator adds your track to their playlist via “Discover” (we use the email address of your original submission; the curator does not receive it, Art. 6(1)(b) and (f) GDPR); the one-time request for a stream report (section 7); if this feature is switched on, a one-time reminder about your free story graphic a few days after the placement, provided you have neither retrieved it nor rated the curator yet (no further one afterwards; you can object by message at any time, Art. 6(1)(b) and (f) GDPR); notes on the YouTube promo. To improve this flow we count, per placement, whether the story graphic page and the rating page were opened (without IP address and without visitor data; Art. 6(1)(f) GDPR). The Spotify links in the “live” email go through a redirect on our server that counts whether the link was clicked (Art. 6(1)(f) GDPR; we use this for statistics). You receive marketing emails (e.g. our newsletter with tips for musicians, recently placed songs, the curator charts and labelled affiliate recommendations; we put it together by hand and send it irregularly) only if you ticked the updates box (Art. 6(1)(a) GDPR); every email contains an unsubscribe link and you can withdraw at any time. Links in the newsletter go through a redirect on our server that only counts, per link and day, whether a click happened – without your email address and without your IP address, using only the daily-changing visitor hash from section 12 (Art. 6(1)(f) GDPR; we use this for statistics and to choose better content); these counts are deleted after 13 months. We only see them in summary (clicks per issue and per link). We do not measure whether you open an email; the newsletter contains no tracking pixel. The newsletter may feature recently placed tracks (title, artist name, playlist and Spotify link – public information, no cover, no email address); if you do not want that, send us a short message (Art. 6(1)(f) GDPR, right to object under Art. 21 GDPR at any time). Affiliate links are labelled “Anzeige/Ad”: if you click one, our server forwards you to the merchant after counting; from there the merchant’s own privacy notice applies, and the merchant may set cookies to credit us a commission for a purchase. For delivery records we store recipient address and subject for 180 days.

6. Ratings

After a placement you can voluntarily rate the curator from 1 to 5 stars and optionally comment (max. 750 characters). The comment is visible to the curator concerned and to us; publicly only the average star rating of a playlist is shown. Legal basis: Art. 6(1)(b) and (f) GDPR. The rating is submitted via a personal link without an account and is kept without personal reference after the submission is anonymised (section 3).

7. Stream report (voluntary)

About 20 days after a confirmed placement we ask you once by email to voluntarily report your stream numbers and the period (7, 14 or 28 days), optionally with a screenshot from Spotify for Artists. We use the information for internal analysis (effect of playlists), not publicly. Legal basis: Art. 6(1)(a) (consent by submitting) and (f) GDPR. Please do not upload screenshots containing personal data of third parties. The screenshot is deleted 180 days after the curator’s decision; the email address in the log of report requests after 180 days.

8. YouTube promo (optional)

If you expressly consent when submitting, we upload audio file (up to 25 MB) and cover image and create a visualizer video from them, which we publish on a YouTube channel operated by us, with monetisation if separately permitted. Until then the files are stored on our server and, on success, transmitted to YouTube (Google Ireland Limited, Ireland, possibly Alphabet Inc., USA). The published video is publicly viewable on YouTube and subject to the terms and privacy policy of YouTube/Google. Legal basis: Art. 6(1)(a) GDPR (consent); you can withdraw it at any time with effect for the future by email, and we then remove the video promptly. Without the tick no YouTube upload takes place. Retention of the uploaded files: 180 days after the curator’s decision; if the YouTube promo is declined, after a three-day grace period.

9. Follow Gate (Spotify linking)

Some curators voluntarily ask artists to follow or save them, a playlist and/or a song on Spotify before submitting (“Follow Gate”). This happens exclusively via ordinary links that open the respective public Spotify page in a new tab – exactly as if you typed the link into the address bar. There is no Spotify login through PlaylistDock, and PlaylistDock never gains access to your Spotify account. We only store which of these links were clicked before submitting (one yes/no value per link, together with the submission) – an unverified statement of your browser, not a confirmation by Spotify. The submission works regardless; clicking is never a requirement. Legal basis: Art. 6(1)(b) GDPR. Retention: as for the submission (section 3).

10. Curators

Application and account. We process name, email address and playlist link, the confirmation of age (18+) and terms, and optionally later your Instagram link. After approval, login is by magic link (no password): for this we store a hashed one-time token with expiry time and a session cookie. Legal basis: Art. 6(1)(b) GDPR.

Playlist data and proof. We retrieve public playlist data via the Spotify Web API (name, description, follower history, track lists) and store it over time. To prove control, our system reads a one-time code from the public playlist description. From this we derive playlist indicators (activity, acceptance rate, response time, removals, weekly scores, rankings, awards). These data primarily concern the playlist but may indirectly be traceable to you as curator. Legal basis: Art. 6(1)(b) and (f) GDPR (quality assurance, prevention of abuse and fraud, operation of the platform).

Settings and use. We store your settings (genres, stance on AI songs, capacity limits, vacation mode, notifications, marketing consent), your decisions with messages, your optionally uploaded playlist cover and usage events in your account (e.g. pages viewed, decisions; 13 months). Messages that breach the feedback rules are detected technically and blocked; we log time, type of violation and the affected text excerpt (13 months; Art. 6(1)(f) GDPR).

Preview player (30 seconds). In the inbox you can tap “Preview” to hear a song for 30 seconds, independent of the embedded Spotify player. For this our server asks Deezer (Deezer SAS, France) for the preview clip link using the song’s ISRC, a public recording code; if Deezer does not have the song, we ask Deezer and Apple (iTunes Search, Apple Distribution International Ltd., Ireland) with the song title and artist name instead. No personal data is sent. Only when you tap “Preview” does your browser load the clip directly from the servers of Deezer or Apple; technically that provider then receives your IP address and browser identifier. Without a tap your browser makes no connection to Deezer or Apple. Legal basis: Art. 6(1)(b) and (f) GDPR (performing the curator role, efficient review of submissions). The link is cached for up to four hours; we do not store the audio.

Public display. Name, playlists (name, cover, description, public indicators), optional Instagram link, awards/rankings (e.g. “Curator of the Week”, also on the home page) and the average artist rating of your playlists may be shown publicly. Artists receive the name of your playlist and, if applicable, your Instagram link in placement emails.

Surveys. You may voluntarily take part in curator surveys (reaction and optional comment). Legal basis: Art. 6(1)(a) and (f) GDPR.

Proof of consent and change notices. We store which version of the Terms and the Privacy Policy you confirmed and when (version number, time, how it was confirmed – application or later confirmation – and a non-reversible hash of your IP address). For material changes we inform you by email in advance and log the sending (whether and when the notice was sent). Legal basis: Art. 6(1)(b) and (f) GDPR (proof of the contractual basis). These records are deleted together with the account.

Emails. Operational emails (login link, new submissions, reminders, daily/weekly summaries, notes on capacity and pauses, playlist approvals, ranking notices) are contract performance (Art. 6(1)(b) GDPR). Promotional emails only with consent (Art. 6(1)(a) GDPR), withdrawable at any time via the unsubscribe link.

Retention. Curator data is kept as long as the account is active; you can delete it at any time in your profile. This deletes the account, login tokens and your uploaded playlist cover; playlists are detached from the account. Declined applications are anonymised 180 days after the decision. Magic-link tokens are deleted 7 days after expiry.

11. Discover

When the “Discover” feature is active, curators see a chart of tracks confirmed on playlists via PlaylistDock (title, artist name, popularity, genres, Spotify cover; no email address). If a curator adds a track, we inform the artist by email (section 5). Legal basis: Art. 6(1)(b) and (f) GDPR (how the service works, the artist’s interest in additional reach). You can object to the use of your email address for this at any time under section 17.

12. Audience measurement, security, cookies

Audience measurement. We count page views using a daily-changing, non-traceable value derived from IP address, browser identifier and date. Nothing is stored on or read from your device (no cookie, no local storage), and the same visit cannot be linked across two days or with other websites. This gives us rough visitor numbers and time on site without identifying individuals. We delete page views after 13 months. Legal basis: Art. 6(1)(f) GDPR.

Origin of visitors. To understand how artists and curators find PlaylistDock, we record the origin of every page view: the hostname of the referring website (without path or search terms), a source or campaign label contained in the link (src, utm_source, utm_medium, utm_campaign; only short labels of letters, digits, hyphen and underscore) and, if no referrer is sent, whether your browser identifies itself as the in-app browser of a platform (e.g. Instagram, TikTok) – only the platform name is stored, not the browser identifier. When a visitor submits a song or applies as a curator, we attach the origin of their first visit to that record (source, hostname, landing page, campaign label): without your analytics consent only via the daily-changing visitor hash, i.e. for visits on the same day; with analytics consent via the random identifier (pd_vid) for up to 30 days back. This data contains no real names and no search terms. Legal basis: Art. 6(1)(f) GDPR (understanding how the platform is found).

Security monitoring. To protect against abuse (automated spam submissions, faulty file uploads, bot activity) we log security-relevant events together with the IP address and the page called, such as failed form checks or rejected uploads; automated accesses (e.g. crawlers) are logged with IP address and browser identifier. Individual IP addresses may be blocked in case of abuse. These logs are deleted automatically after 90 days. To protect against automated mass requests (bots, crawlers) we briefly count requests per IP address; if a limit is clearly exceeded, we temporarily reject further requests from that IP address. Rate-limit data (IP address) is deleted after 1 day. Legal basis: Art. 6(1)(f) GDPR.

Cookies. Strictly necessary are the session cookie (pd_sess; for curator login and for technically necessary feedback such as the confirmation after a submission; lifetime up to 30 days) and the cookie that stores your cookie choice (pd_consent; valid until you close the browser, after which you are asked again). Only with your consent do we set or load (1) third-party embeds (Spotify players that may set their own cookies) and (2) analytics – a random identifier not linked to your real name (pd_vid, 12 months) used to count returning visits. Without consent neither is loaded or set. You can change your choice at any time via the cookie settings. Legal basis: Art. 6(1)(a) GDPR, section 25(1) TDDDG (section 25(2) no. 2 TDDDG for necessary cookies). No third-party tracking, no advertising cookies.

13. Other features and services

Playlist authenticity. To assess whether a playlist shows signs of artificial growth, we evaluate publicly available Spotify data on playlists (follower history, track list, metadata) over time. This primarily concerns data about playlists as such; the curator of a playlist may be indirectly identifiable. We do not make decisions with legal or similarly significant effect (e.g. removing a curator) solely by automated means (no case of Art. 22 GDPR); automatic pauses due to inactivity or overload can be lifted by you at any time and you can contest them with us. Legal basis: Art. 6(1)(f) GDPR.

Spotify. To display playlist and song data we use the Spotify Web API with the client-credentials flow (app login without user reference). No personal data of curators or artists is transmitted to Spotify, only public Spotify IDs. We load embedded Spotify players only with your consent; data (including your IP address) is then transmitted to Spotify AB (Sweden). When you click links to Spotify, Spotify’s terms apply.

Contact form and email. If you contact us via the contact form or by email, we process your email address, your optional name and the content of your message to answer your request. The contact-form message is delivered to us by email and is not additionally stored in a database of the website; for abuse prevention your IP address is processed briefly (1 day) for rate limiting. Legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or its preparation, otherwise Art. 6(1)(f) GDPR. We delete the request once it is finally dealt with and no statutory retention duties apply.

14. Retention periods at a glance

• Submission (email, IP, message, visitor identifiers): anonymised 180 days after the decision or submission
• Cover image, audio file, stream screenshot: deleted after 180 days (YouTube files after 3 days if declined)
• Created story videos: 45 days at most
• Email delivery log; email address in stream-report requests: 180 days
• Declined curator applications: anonymised after 180 days; active accounts until deletion
• Usage events in curator accounts; blocked feedback attempts; audience-measurement page views: 13 months
• Security logs and logs of automated accesses: 90 days
• Login links: 7 days after expiry; rate limiting (IP): 1 day
• Click counts of newsletter links (no email address, no IP): 13 months
• Record of the confirmed Terms/Privacy version and send log of change notices (curators): until the account is deleted; for submissions only the version number, with no personal reference after anonymisation
• Analytics identifier (only with consent): 12 months (cookie), data 13 months
• Origin of the first visit on submissions and curator applications (source, hostname, landing page, campaign label): same as the record itself (submissions: personal reference removed after 180 days; curators: until account deletion); origin of individual page views: 13 months

15. Recipients and processors

IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, processes personal data on our behalf as our hosting provider (server operation) and email service (sending and receiving emails), on the basis of a data processing agreement under Art. 28 GDPR. The servers are located in the EU/Germany. Other recipients are the parties named in this text: the respective curator (sections 3, 4, 6), Spotify AB (section 13), and, with your consent, Google Ireland Limited/YouTube (section 8). For transfers to the USA (Google/YouTube only) this provider relies on the EU-US Data Privacy Framework or standard contractual clauses. No further disclosure, sale or use for third-party advertising takes place.

16. Automated decisions

There is no solely automated decision-making including profiling within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. The automatic check whether a track is live, abuse detection (limits, bot protection) and playlist indicators serve operation and quality assurance.

17. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object at any time, on grounds relating to your particular situation, to processing we base on legitimate interests (Art. 6(1)(f) GDPR) (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)) without affecting the lawfulness of processing carried out until then. You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information. Requests to info@playlistdock.com. Where data has already been anonymised (section 3), we can no longer attribute it to a person.

18. Changes

We update this policy when features or the legal situation change. The version published at the time applies; the date is shown at the top.