Privacy Policy

About this policy

Lushhh Productions AB, trading as SoundMe (“SoundMe,” “we,” “us,” or “our”), provides background music for businesses through a browser-based player. This Privacy Policy explains how we collect and use personal information, who receives it, how long we keep it and the rights you have.

This policy applies to soundme.io, the SoundMe browser player, subscriptions and communications with us. It covers website visitors, account users, business owners and people acting on behalf of our business customers. Information about a company is personal information only where it relates to an identifiable individual.

1. Who We Are

Lushhh Productions AB is the controller responsible for the personal information described in this policy under the EU General Data Protection Regulation (GDPR) and applicable Swedish data protection law.

Address: Agavägen 26, 181 39 Lidingö, Sweden
Email: privacy@soundme.io
Phone: +46 70 324 56 36
Website: https://soundme.io

You can contact us using these details with questions or requests concerning your personal information.

2. Information We Collect

2.1 Information you provide

Depending on how you use SoundMe, we collect the following information:

• Account and contact information — name, email address, telephone number where supplied, and information needed to authenticate your account (such as a password, stored only as a secure hash, or a passkey). Purpose: create and manage your account, authenticate access and communicate with you.
• Business and location information — business name, venue type, business address, billing details and subscribed locations. Purpose: set up your subscription and identify the premises covered by your licence.
• Service preferences and settings — music preferences, playlist selections, player settings and branding materials you submit. Purpose: configure the Service for your business.
• Support correspondence — messages, requests and information you provide when contacting us. Purpose: respond to enquiries and resolve problems.
• Communication and consent preferences — marketing choices and records of consent or withdrawal. Purpose: respect your choices and maintain consent records.

If you provide information about another person, such as a colleague who will use the player, ensure that you are entitled to share it and make this policy available to them.

2.2 Information generated through use of the Service

• Subscription and transaction records — plan, subscription status, trial and renewal dates, invoice details, payment status and transaction references. Purpose: manage subscriptions, provide access and maintain billing records.
• Playback and service activity — tracks or playlists served or played, session timing, player interactions and account or location identifiers. Purpose: deliver playback, troubleshoot issues and administer licensed use.
• Browser and technical information — IP address, browser type, operating system, device type, request timestamps and error or security logs (including sign-ins and new devices). Purpose: deliver audio and website content, maintain security and diagnose faults.
• Cookie and similar technology information — session identifiers, authentication information and saved preferences; optional identifiers only where enabled with your consent. Purpose: maintain browser sessions and preferences and support the uses explained in Section 5.

Playback records can relate to an identifiable person when linked to an account, device or business contact, even if the music is played for an entire venue.

Standard music playback does not require access to your microphone, camera, contacts, photo library or precise device location. The business address you provide and an approximate location inferred from an IP address are separate from precise device location.

2.3 Payments and information from other sources

Subscriptions are purchased through SoundMe’s website or under a separate business agreement. We use billing and payment information to process subscriptions and keep financial records.

Payments are processed by Stripe (Stripe Payments Europe, Ltd., Ireland). You enter your card or other payment details directly on Stripe’s secure payment page; Stripe collects and processes them as an independent controller under its own privacy policy. SoundMe never receives or stores full card numbers or security codes. From Stripe we receive your billing name and address, your VAT number where you provide it, the card brand, the last four digits and the expiry date, and the status and references of payments, subscriptions and invoices.

If you choose to sign in with Google, we receive your name, email address and Google account identifier from Google. We may also receive account or business contact information from the organisation that arranges your access to SoundMe.

Information necessary to create an account, provide the subscription or issue legally required invoices must be supplied for those purposes. If it is not provided, we may be unable to provide the relevant service. Optional marketing consent is not required to subscribe.

3. Why We Use Information and Our Legal Bases

We process personal information for the purposes and on the legal bases below. Where a contract is with a company rather than with you personally, we generally rely on legitimate interests to administer the relationship with that company and its authorised users, rather than treating you as a party to that contract.

• Create accounts, provide the browser player, stream music and administer subscriptions — performance of a contract with you, including steps you request before entering into it (Article 6(1)(b)); or legitimate interests in providing the service to your organisation (Article 6(1)(f)).
• Provide support and send necessary service, account and billing notices — performance of a contract with you, or legitimate interests in supporting and communicating with our business customers and their users.
• Maintain access controls, prevent fraud and investigate misuse — legitimate interests in protecting the Service, our business and its users.
• Diagnose technical faults and improve service reliability — legitimate interests in maintaining a functioning and reliable service; consent where the method used requires it.
• Maintain records of licensed playback and address licensing enquiries or disputes — legitimate interests in administering licences and establishing, exercising or defending legal claims.
• Use optional advertising measurement technologies — consent (Article 6(1)(a)), as explained in Section 5.
• Send optional email marketing — consent, or another lawful basis where applicable law permits such communication; you can object or unsubscribe at any time.
• Keep accounting records and comply with binding legal requirements — legal obligation (Article 6(1)(c)).

Where we rely on legitimate interests, we assess those interests against your rights and reasonable expectations. You may object to processing based on legitimate interests as explained in Section 9.

SoundMe uses automated playlist selection and music tags to deliver music suited to the selected service settings. Playlist selection does not in itself make a decision about you that has legal or similarly significant effects.

4. Who Receives Personal Information

We share information only where there is a lawful basis and where it is relevant to the purpose of the disclosure. Recipients are:

• Hosting and data storage: OVH (servers in Germany) and IDrive e2 (storage in the EU) — to store account information, operate the website and player and deliver music streams.
• Payments and billing: Stripe — to process payments, administer subscriptions and issue invoices.
• Email delivery: Resend — to deliver service, account and support emails and, where you have agreed, newsletters.
• Sign-in: Google — only if you choose to sign in with your Google account.
• Advertising measurement: Meta — only with your consent, as described in Section 5.
• Professional advisers and authorities: where necessary for legal advice, accounting, compliance with law or the establishment, exercise or defence of legal claims.

Providers acting as our processors must process personal information under our instructions and appropriate data processing agreements. Some recipients, such as payment providers or authorities, may act as independent controllers for particular purposes and explain those activities in their own privacy notices.

If your account is managed by your employer or another business customer, information needed to manage your access and its subscription may be available to that organisation’s authorised administrators.

If SoundMe is involved in a merger, acquisition or sale of its business, relevant personal information may be disclosed to advisers and a prospective or actual successor where lawful and necessary, subject to appropriate confidentiality and data protection safeguards. We will provide any notices required by applicable law.

5. Cookies, Analytics and Advertising

SoundMe’s website and browser player use cookies, local storage and similar browser technologies. These technologies support login sessions, security, playback and the choices you make within the Service.

Strictly necessary (always on): a cookie that remembers your cookie choice (12 months); sign-in cookies that keep you signed in and protect your account (session, up to 30 days); and a device cookie that recognises a known device so we can warn you about sign-ins from new ones (30 days). The player also keeps your settings, such as volume, design and audio output, in your browser’s local storage.

Advertising measurement (only with your consent): the Meta Pixel (cookies _fbp and _fbc, up to 90 days) and our own cookie that remembers which page and campaign brought you to us (30 days). If you gave this consent before signing up, we also report sign-ups, trial starts and first payments to Meta from our servers, so that Meta can measure our ads. These reports contain your email address, name and billing city, postcode and country only in hashed (encrypted one-way) form, together with your IP address, browser information and the cookie identifiers above. Without your consent, nothing in this group runs and nothing is sent to Meta.

We do not use third-party analytics tools. Usage statistics, such as how much music is played, are calculated in our own systems.

Simply visiting the website or accepting this Privacy Policy does not constitute consent. You can reject optional tracking and withdraw consent as easily as you give it: open cookie settings. Details are in our Cookie policy. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Declining optional tracking does not prevent use of the core music service.

You can also manage cookies through your browser. Blocking technologies necessary for login or playback may prevent those functions from working. Browser cookie deletion alone does not necessarily communicate an opt-out to every third-party service.

You may stop marketing messages by using the unsubscribe link in the message or contacting SoundMe. We may still send necessary account, security and billing communications.

6. International Transfers

SoundMe is operated by a company established in Sweden. Our servers are located in Germany, and music files and other stored data are kept in the European Union.

Some of our providers, or companies in their groups, are based in the United States or can access data from there: Stripe (payments), Resend (email delivery), Google (only if you sign in with Google) and Meta (only with your consent). Where we transfer personal information outside the European Economic Area, we use a lawful transfer mechanism: the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the recipient is certified under it, or otherwise the European Commission’s Standard Contractual Clauses, together with additional safeguards where necessary. Corresponding safeguards apply where required under UK or Swiss law.

You may contact us for information about relevant transfers and a copy of applicable safeguards, subject to necessary redactions to protect confidential information or other persons’ rights.

7. How Long We Keep Information

We retain personal information for the purposes described in this policy and delete it or make it genuinely anonymous when it is no longer needed:

• Account and business contact information — while your account and subscription are active, and for 12 months after your subscription ends (or, if you never had a paid subscription, 12 months after your last sign-in). After that, only information necessary for outstanding obligations, required records or specific disputes is retained.
• Playback records and service preferences — on the same basis: while needed to deliver the relevant feature or administer licensed use, and no longer than 12 months after your subscription ends, subject to specific legal or dispute-related retention.
• Invoices and other statutory accounting records — until the end of the seventh year after the calendar year in which the relevant financial year ended, as required by Swedish accounting law.
• Support correspondence — until the enquiry and necessary follow-up are complete, and no longer than 12 months after your subscription ends; relevant parts may be retained longer where needed for a related contractual issue or legal claim.
• Technical server logs — 14 days. Security logs (sign-ins and new devices) — together with your account data as above; relevant logs may be retained while a specific investigation or claim remains unresolved.
• Marketing and consent records — while used for the relevant permitted purpose; evidence of consent and withdrawal may be kept as necessary to demonstrate compliance. A minimal suppression record may be retained to respect an unsubscribe request.

Where records are needed for an actual or reasonably anticipated legal claim, retention is limited to the relevant information and the applicable claim or limitation period. Such retention does not justify keeping every account or playback record indefinitely.

Residual copies in backups are removed through the applicable backup replacement cycle and are not used for ordinary service operations after deletion. If a backup is restored, applicable deletion requests are reapplied.

8. Closing Your Account and Requesting Deletion

You can request account closure or deletion of personal information by contacting SoundMe using the details in Section 13. If account deletion controls are available in your account, you may also use them.

We will assess your request and delete information that we no longer have a lawful reason to retain. Some information may need to be kept for accounting, outstanding payments, legal obligations or specific legal claims as explained in Section 7.

Cancelling subscription renewal and requesting deletion are separate actions. To stop future renewals, cancel through the subscription controls provided by SoundMe or contact us under our Terms of Use. When handling an account closure request, we will clarify any remaining subscription or billing obligations.

9. Your Rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• Obtain confirmation of processing and access to your personal information.
• Have inaccurate information corrected and incomplete information completed.
• Request deletion of personal information.
• Restrict processing in certain circumstances.
• Object to processing based on legitimate interests, including related profiling.
• Object to direct marketing at any time.
• Receive information you provided in a structured, commonly used, machine-readable format, and have it transferred to another controller where the requirements for portability are met.
• Withdraw consent at any time when processing is based on consent, without affecting the lawfulness of earlier processing.
• Obtain the protections applicable to decisions based solely on automated processing that produce legal or similarly significant effects.

You can exercise these rights using the contact details in Section 13. We may request information reasonably necessary to verify your identity or authority to act for someone else.

Under the GDPR, we normally respond without undue delay and within one month of receiving a request. If an extension is permitted because of the complexity or number of requests, we will explain the reason within the first month. Requests are normally free of charge; any refusal or charge must meet the conditions in applicable law.

You can complain to Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection, at https://www.imy.se. You may also complain to another competent supervisory authority, including one in the EU/EEA country where you live, work or believe an infringement occurred. Where UK or Swiss data protection law applies, you may contact the relevant authority there.

Other jurisdictions may provide additional privacy rights. Where those laws apply to SoundMe and your information, we will handle requests in accordance with them. Nothing in this policy limits rights that applicable law gives you.

10. Security

We are responsible for implementing appropriate technical and organisational measures to protect personal information against unauthorised access, unlawful processing, accidental loss, destruction or damage. Measures must reflect the nature of the information and the risks involved.

Access to personal information is limited to people and providers who need it for their authorised tasks. You are responsible for keeping your own account credentials confidential and informing us promptly if you suspect unauthorised access.

No system is completely secure. If a personal data breach occurs, we will assess it and notify the relevant authority and affected individuals where required by applicable law.

11. Children

SoundMe is a service for businesses and organisations and is not directed to children. Children visiting a venue are not required to create an account or provide personal information to hear the venue’s music.

If you believe that a child has provided personal information to SoundMe inappropriately, contact us so that we can investigate and take appropriate action, including deletion where required.

12. Changes to This Policy

We may update this policy to reflect changes to the Service, our processing activities or applicable law. The date at the top identifies the latest revision.

We will communicate material changes through the Service or using relevant account contact details as appropriate. Where new processing requires consent, we will request it before starting that processing. Continued use alone does not provide consent where the law requires a specific choice.

13. Contact

For privacy questions, requests or complaints, contact:

SoundMe — Lushhh Productions AB
Agavägen 26
181 39 Lidingö
Sweden

Email: privacy@soundme.io
Phone: +46 70 324 56 36
Website: https://soundme.io