Privacy Policy
Last updated 5 November 2026
Soundhype is a music-marketing tool. Record labels and artists use it to publish songs, run advertising campaigns, reply to their audience on Instagram, and measure what listeners do afterwards. This policy explains what personal data we handle, why, and what you can ask us to do about it. It covers several different groups of people, and the answers are not the same for each.
Who we are
The controller of the personal data described here is HMG B.V., trading as Soundhype. You can reach us about anything in this policy at privacy@soundhype.com.
Where a label or artist uses Soundhype to process data about their own listeners, they decide why that happens and we act on their instructions. For our own account holders, and for the security and operation of the service, we are the controller.
If you have a Soundhype account
Accounts are invite-only. We store your name, email address, a hashed password, which organisations you belong to and your role in them, and your session records so you stay signed in.
We also apply per-address and per-IP rate limits to sign-in, sign-up and password-reset requests to stop abuse. Those counters hold a salted hash, not your IP address or email in readable form, and they are held only in memory.
If you connect your accounts to Soundhype
To publish, advertise and reply on your behalf, Soundhype connects to the platforms you choose. Every connection goes through that platform's own approval screen, which shows what you are granting, and you can disconnect at any time under Settings → Connections.
| Platform | What we store and why |
|---|---|
| Meta (Facebook and Instagram) | Your Facebook user id and name, an access token, and the Facebook Pages, Instagram professional accounts and ad accounts you let Soundhype manage. We use them to publish Reels, create and report on ad campaigns and, when you switch on Auto DMs for an Instagram account, to read the comments and messages it receives and reply to them. Permissions we ask for: pages_show_list, pages_read_engagement, pages_manage_metadata, business_management, instagram_basic, instagram_content_publish, instagram_manage_comments, instagram_manage_messages, ads_management and ads_read. |
| TikTok | Your account id, display name, profile picture, follower counts and tokens, to send videos to your TikTok account and report on how they perform. |
| Spotify, Deezer, YouTube Music and Apple Music | Your account id, name and tokens, to read and update the playlists you manage in Soundhype. |
Access tokens are encrypted before they are stored and are never shown in the app. We keep a copy of connected accounts' profile pictures so the app can display them. We only use this data to provide the features you use; we do not use it to build profiles of people or to advertise to them.
If you open a listen link
A listen link is the page a fan reaches from an advert or a shared link. Opening one does not require an account and does not, by itself, tell us who you are.
| What we record | Why |
|---|---|
| A random view identifier | So one visit's page view and button click count once rather than twice. It is generated per visit and is not linked to a person. |
| Which platform button you pressed | To measure which streaming services listeners choose. |
| The hostname that referred you | Only the domain, never the full address of the page you came from. |
| Advertising click identifiers and campaign tags in the link (such as fbclid, ttclid and utm_*) | To attribute a visit to the advert that produced it. |
We do not store your IP address against these records.
Advertising pixels on listen pages
When the label running a campaign has configured them, listen pages load the Meta (Facebook/Instagram) pixel and the TikTok pixel. These are set by those companies, can set cookies or similar identifiers in your browser, and let them measure and target advertising. They are third-party controllers for that activity and their own privacy notices apply.
If you connect Spotify on a listen page, we may also send a server-side conversion event to Meta containing a hashed version of your email address and Spotify user id, together with your IP address and browser user-agent. Hashing means Meta cannot read the original values, but it can match them to an existing profile.
If you connect Spotify to a listen page
Connecting is optional and is how a pre-save or follow actually happens. Spotify asks you to approve it and shows you what you are granting. If you approve, we receive and store:
| What we receive | Why |
|---|---|
| Your Spotify user id, display name, email address, country and account type | To recognise you as a listener of that artist and to attribute the connection to a campaign. |
| The permissions you granted, and access and refresh tokens | To carry out the action you asked for — saving a track, following an artist — and to keep measuring afterwards. Tokens are encrypted before they are stored. |
| Your recently played tracks, and whether you have saved the track or follow the artist | To show the label how many real listens a campaign produced. |
You can disconnect at any time from your Spotify account under Apps, which immediately stops any further access. Ask us and we will delete the records we hold about your connection.
If you submit a video through an artist portal
Submission links are shared by a label. If you submit, we store the name and email you enter, the video you upload, and the status of your submission, so the label can review it and use it in their campaigns.
If you comment on or message an Instagram account that uses Soundhype
Labels and artists can switch on automatic direct messages (“Auto DMs”) for their own Instagram professional accounts. When someone comments a chosen keyword under one of their posts, or sends the account a message, Soundhype sends a direct message — and, if the account set one up, a short public reply — through Instagram's official API.
| What we receive from Instagram | Why |
|---|---|
| Your Instagram-scoped user id and username | To send the reply to the right person, and to make sure each person gets a message only once. |
| The text of your comment or message, the post it was on and when you wrote it | To check it against the keywords the account chose, and to show the account what its automation did. |
| Whether the reply was sent | So the account can see the results and retry a message that failed. |
We only keep comments and messages that match one of the account's automations, for 90 days. The raw notifications Instagram sends us are deleted within 30 days. The account owner decides what is sent and is responsible for this data; Soundhype processes it on their behalf. To have your data removed, ask the account owner or follow the steps under “Data from Facebook and Instagram, and how to delete it” below.
Who else sees this data
| Recipient | What for |
|---|---|
| Spotify | Authorising your connection and carrying out saves and follows. |
| Meta and TikTok | Publishing, advertising delivery and measurement, including pixels and conversion events, and — for Auto DMs — sending messages and replies on Instagram. |
| presave.io | Pre-save campaign pages, where a campaign uses one. |
| Resend | Sending transactional email such as invitations and password resets. |
| ElevenLabs | Transcribing lyrics from songs uploaded to Soundhype. |
| Hetzner | Hosting and file storage. Our servers, database and files are in the EU. |
| Amazon Web Services | Rendering campaign videos. |
We do not sell personal data. Some of these providers are outside the EEA; where that is so, transfers rely on the European Commission's standard contractual clauses or an adequacy decision.
Why we are allowed to do this
For account holders, we process data to perform our contract with you, and for our legitimate interest in keeping the service secure. For listeners, connecting Spotify is based on the consent you give in Spotify's own approval screen. Advertising pixels and conversion events are based on consent where the law requires it. Campaign measurement that does not identify you rests on the legitimate interest of the artist in understanding their own campaign. For Auto DMs, the account owner relies on their legitimate interest in answering people who comment on or message them, and Soundhype acts as their processor.
How long we keep it
Account and organisation records are kept while the account is open. Listener connections and the measurements attached to them are kept while the artist's campaign reporting needs them, and are deleted on request. Anonymous listen-page events are retained for campaign reporting. Auto DM records are deleted after 90 days, and raw notifications from Instagram within 30 days. Access tokens are kept until you disconnect the platform or ask us to delete them. Backups are retained on a rolling basis and are overwritten in turn.
Data from Facebook and Instagram, and how to delete it
You can stop Soundhype using your Facebook and Instagram data, and have it deleted, at any time:
- Disconnect in Soundhype. Settings → Connections → Disconnect. Soundhype stops using that connection straight away, including any automatic Instagram messages that ran through it.
- Remove Soundhype on Facebook. Facebook → Settings & privacy → Settings → Apps and websites → Soundhype → Remove. This withdraws every permission you gave Soundhype.
- Ask us to delete the data. Email privacy@soundhype.com with the subject “Data deletion request”, from the address on your Soundhype account. If you don't have an account — for example you commented on or messaged an Instagram account that uses Soundhype — include your Instagram username instead.
We then delete the access tokens and the Facebook Page, Instagram account, ad account and message records we hold about you, and confirm by email within 30 days. Data that Meta itself holds, such as ad delivery records, is covered by Meta's privacy policy.
Your rights
If you are in the EEA or the UK you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent you can withdraw it at any time without affecting what came before. Write to privacy@soundhype.com and we will respond within one month. You can also complain to your national data protection authority.
Changes
If we change this policy we will update the date at the top of this page, and tell account holders directly where the change is significant.