This policy explains what data the Muzylo service (website, web app, mobile apps and players) processes, why, and for how long. Questions: [email protected].
The short version
- Reference tracks you upload are deleted within 24 hours of feature extraction. They never enter the catalog, are never logged and are never used for training.
- Card numbers are handled by the payment provider; we never see them.
- The website uses no advertising or analytics cookies. The mobile apps use no advertising identifiers and don't track you across other companies' apps or websites.
- You can delete your account in the app, on the web or by email: here's how.
- Accounts, venues and playback history of muzylo.tech customers are stored in the EU. Venues in Russia are served by muzylo.ru, which stores their data in Russia. What passes between the two regions is described under Between our regions.
What we process
- Account: email address, name (if given), role in the organisation.
- Sign in with Apple, Google or VK ID: your user id at that provider, your email address and your name if you choose to share it. Apple may give us a private relay address (@privaterelay.appleid.com) that forwards to your email. We never receive your password for these services. For Sign in with Apple we keep a refresh token, encrypted, only to revoke Muzylo's access at Apple when you delete your account. We don't store Google or VK tokens.
- Organisation and venues: name, legal name and address (if given), venue type, time zone, opening hours, zones.
- Sign-in sessions: the IP address and the browser or app version (user agent) of each session, for security.
- Player operation: device status (online/offline), cache size, playback events (which track, when, in which zone), likes and dislikes, vibe changes and any text you type to steer the music.
- References: uploaded audio, only until musical features (tempo, key, genre, instruments) are extracted; the features are kept, the audio is deleted.
- Billing: plan, subscription status, amounts and dates. Card data is processed by YooKassa (Russia) or Paddle, our reseller and merchant of record, which receives your email, country and payment details for the purchase and handles them as an independent controller.
- In-app purchases: a subscription bought in a mobile app is sold and billed by the App Store (Apple), Google Play (Google) or RuStore. The store sends us transaction and subscription ids, the product, status, renewal dates and price. We never receive your card or store payment details.
- Support: your conversations with our team.
Why
- To keep the music playing: stations, schedules, queues, offline cache.
- For compliance: playback history with rights-record ids is evidence that the Muzylo catalog was playing.
- For billing, support, security and abuse prevention.
- To improve the service: we record product events (sign-up and its method, setup steps such as the venue type and mood chosen, player pairing, checkout and subscription changes) under your account and organisation ids, without your name or email, in PostHog, a product analytics service with servers in the EU. They are not used for advertising.
Mobile apps
- On the device: the app keeps tracks for offline playback in its own storage, its sign-in key in the system's secure storage (Keychain or Keystore), and your region and language choice. Signing out removes the sign-in key, and uninstalling the app removes all of it from the device.
- Region: on first launch the app uses the device's region and time zone to choose muzylo.ru or muzylo.tech. This happens on the device.
- No tracking: the apps contain no advertising SDKs, don't use advertising identifiers (IDFA, Android advertising ID) and don't track you across other companies' apps or websites. They don't ask for access to your location, contacts, camera or microphone.
The certificate verification page
Anyone who scans a certificate's QR code can open its verification page and see the licence status, venue name, plan, territories and validity. No other account data is shown there.
Retention
- Reference audio: no more than 24 hours.
- Playback events: 400 days (so playback can be evidenced for the past year). When an organisation is deleted, its playback history is deleted with it, apart from the evidence record for licensing claims (next item).
- Evidence for licensing claims about the organisations that are closed, stored under internal ids only, without names, email addresses, IP addresses, devices or anything you typed: which Muzylo tracks played in which venue and zone, when, in which country and under which rights record, kept for 400 days from each play, as for a venue that is still open; and the rights records of the organisations' own tracks and the status and dates of their compliance certificates, kept for 3 years from the deletion (the general limitation period for claims, for example under Article 196 of the Russian Civil Code). We keep it on the basis of our legitimate interest in answering claims by collecting societies such as RAO and VOIS about the time Muzylo covered the venue, and use it for nothing else. Then it is deleted. A check of a closed organisation's certificate (its QR code) shows it as revoked.
- Sign-in sessions, with their IP address and user agent: up to 30 days while the account exists; deleted with the account.
- Product analytics events: while the account exists; when the account is deleted we delete them from PostHog with the account's profile.
- Apple refresh token: while Sign in with Apple is linked; on account deletion it is revoked and deleted.
- Payment records: while the organisation exists; after it is closed, with the organisation's name, legal name, tax id and country, until 1 January of the eleventh year after the year of payment, then deleted.
- Account data: while the account is active, then deleted or anonymised, except where the law requires us to keep it (e.g. billing records).
Deleting your account
You can delete your account in the app (the Account tab → Delete account), in the web app (Account → Delete account) or by emailing [email protected] from your account's address. What is deleted at once and what is kept, and for how long, is on the Delete your account page. If the deletion closes an organisation you own and you signed in more than 15 minutes ago, we ask for a 6-digit code emailed to your account's address. When the account is deleted, we email a confirmation to that address. A subscription bought in an app store must be cancelled in the store: deleting the account doesn't cancel it.
Who we share data with
Only the processors the service can't run without: hosting and content delivery, file storage, email delivery, payment providers and venue search on the map (Yandex Maps in Russia, Google Places elsewhere), product analytics (PostHog, EU). We don't sell data or share it with ad networks.
When you sign in with Apple, Google or VK ID, or buy a subscription in the App Store, Google Play or RuStore, that provider processes your data under its own terms as an independent controller.
Between our regions
Muzylo runs as two separate services: muzylo.ru for venues in Russia (data stored in Russia) and muzylo.tech for venues everywhere else (data stored in the EU). Your account, organisation, venues, playback history and payments are stored only in your account's region. Only the following passes between muzylo.tech and muzylo.ru:
- Finding your account at sign-in. If you sign in on one region (by email or with Apple, Google or VK ID) and it has no account for your email address, it asks the other region whether the account is there. It sends only a keyed hash of the address (a pseudonymous code computed with a key that only our two regions hold), your language and where the sign-in link should open: not the address itself, not your IP address and nothing about Apple, Google or VK ID. The other region can match the code only against addresses it already holds. If the account is there, that region emails you a sign-in link and code itself; if not, it can't tell which address was asked about and keeps nothing. Basis: our legitimate interest in letting you sign in from either site, with the data pseudonymised (GDPR art. 6(1)(f)).
- Your sign-in code. If you type the code from that email on the site where you started, that site passes the code, with the same keyed hash, to the region that sent it, which checks it and signs you in there. Same basis.
- Moving to the right region. If you set up a venue that the other region serves and continue there, the other region collects your sign-up from us when its page opens in your browser or app: your email address, language and the venue details you entered (such as the name, address, type, opening hours and map listing). This is the only case where your email address itself is sent, and only after you continue. Your account on the region you left is then deleted unless an organisation, an invitation or a team membership keeps it. Basis: steps you asked for to set up your subscription (GDPR art. 6(1)(b)). For a move from muzylo.tech to muzylo.ru, Russia has no EU adequacy decision and the transfer relies on GDPR art. 49(1)(b) (necessary for those steps); a move from muzylo.ru to muzylo.tech follows our cross-border transfer notification to Roskomnadzor (Federal Law 152-FZ, art. 12).
- App store notices. The App Store, Google Play and RuStore send subscription notices to one of our regions; a notice about an organisation of the other region is forwarded to it unchanged. Notices carry organisation and transaction ids and prices, not names or email addresses. Basis: performing the subscription (GDPR art. 6(1)(b)).
Your rights
You can request a copy of your data, correct or delete it, or withdraw consent: email [email protected]. For users in Russia we process data under Federal Law 152-FZ; for users in the EU, under the GDPR.
Cookies
See Cookies for cookies and local storage.
Changes
If this policy changes materially, we'll tell you in advance by email or in the app.