Privacy Policy
This policy explains how Book a playlist processes your personal data, in accordance with the General Data Protection Regulation (GDPR, Articles 13 and 14) and the French Data Protection Act. It is complemented by our legal notice and our terms of service.
1. Data controller & contact
The data controller is Côme Laurans, publisher of the Book a playlist service. For any question about your data or to exercise your rights, write to legal@bookaplaylist.com.
2. Data we collect
- Account: email address, display name, handle (@), avatar.
- Contributions: song proposals, notes (≤ 140 characters), reviews (out of 5), votes.
- Technical data: connection and security logs (IP address, timestamps), strictly for operating the service and preventing abuse.
- Third-party sign-in identifiers: OAuth identifiers passed when you sign in with Google, Apple or Spotify.
3. Purposes and legal bases (GDPR Art. 6)
| Processing | Purpose | Legal basis (Art. 6) |
|---|---|---|
| Account & authentication | Provide the service and secure access | Performance of a contract — 6(1)(b) |
| Contributions (proposals, notes, reviews, votes) | Core function of the service | Performance of a contract — 6(1)(b) |
| Security & abuse prevention | Protect the service and its users | Legitimate interest — 6(1)(f) |
| Transactional emails (via Resend) | Magic link, reset, account alerts | Performance of a contract — 6(1)(b) |
| Non-essential cookies | None to date | Consent — 6(1)(a) (not applicable currently) |
4. Retention periods
General rule: at most 30 days after you delete your account.
- Account & profile (email, OAuth identity, handle, avatar, bio): kept for the life of the account, then deleted no later than 30 days after account deletion.
- Contributions (proposals, notes, reviews, votes): kept for the life of the account, then anonymised (dissociated from your identity) no later than 30 days after deletion; anonymised content may be retained for community value and rankings.
- Encrypted backups: purged within the backup cycle (≤ 30 days).
This policy declares these periods. A self-service deletion and anonymisation mechanism will be offered soon; until then, any request is handled on receipt at legal@bookaplaylist.com.
5. Recipients and processors
We rely on the following providers, each for a specific purpose. We do not sell your data.
| Recipient | Role | Location / transfer |
|---|---|---|
| Supabase, Inc. | Database, authentication, storage | Data hosted in the EU — Frankfurt (eu-central-1); non-EU entity covered by SCCs |
| Vercel Inc. | Web hosting | United States — Standard Contractual Clauses (SCCs) |
| Resend | Transactional emails | United States — SCCs |
| OAuth sign-in; Google Books API; YouTube API (brand playlists) | United States — SCCs | |
| Apple | Sign in with Apple | United States — SCCs |
| Spotify | Listen links / embedded players; brand account | United States / EU — SCCs |
| Open Library (Internet Archive) | Bibliographic (book) data | United States |
Our web fonts are self-hosted: no data is sent to a third-party font service when you visit.
6. Transfers outside the European Union
Database data is hosted in the European Union (Frankfurt, Germany). Other providers located outside the EU process certain data under Standard Contractual Clauses (SCCs) approved by the European Commission.
7. YouTube and Google services
Book a playlist uses the YouTube API Services. By using the related features, you agree to the Google Privacy Policy. These services are used to maintain brand playlists on a dedicated YouTube account: the application accesses no personal YouTube data of visitors and requires no YouTube sign-in from you.
8. Your rights
Under the GDPR, you have the rights of access, rectification, erasure, objection, portability (export) and restriction of the processing of your data. To exercise them, write to legal@bookaplaylist.com. You may also lodge a complaint with the French supervisory authority, the CNIL (cnil.fr).
9. Cookies and local storage
Book a playlist does not display a consent banner: we use neither analytics (audience measurement) tools nor third-party advertising trackers. The storage used is as follows:
| Item | Type | Purpose | Status |
|---|---|---|---|
| sb-<project>-auth-token | First-party cookie (Supabase session) | Maintaining your session / authentication | Strictly necessary — exempt from consent (CNIL) |
| bap.authIntent | sessionStorage + localStorage (15-minute lifetime) | Preserve an internal navigation intent (never a URL) | Functional — no consent required |
In addition, some pages embed third-party players (Spotify, Apple Music)that may set their own cookies when you play a preview.
10. Minors
The service is reserved for people aged 15 and over (the age of digital consent in France, Data Protection Act, Article 45). We do not create accounts for people under 15.
11. Changes to this policy
We may update this policy. The version in force is identified by its last-updated date and version number, shown at the top of the page.