Privacy and GDPR

Data controller

Name: Charles Kamau

Email: Music@kamau.dk

Personal data currently processed

Account: username, password hash, account status, creation and approval dates, and other account dates stored by the service.

Login and security: last login time and last login IP address.

Music usage: plays and listened seconds that may be linked to an approved user account.

Visitor logs: IP address, time, page path, HTTP method, user agent, device type, crawler classification, referrer, result and, when available, the related user ID.

IP rules: IP address, rule type, optional redirect URL and creation time when an administrator creates a block or redirect rule.

Local device storage: language, theme and welcome preferences, plus encrypted music data for saving data and a non exportable cryptographic key when data saving downloads are used.

Purposes

The implementation uses this data for account management and authentication, security and access control, music playback and personal music features, usage statistics, visitor and abuse monitoring, and administrative functions requested by the site owner.

Legal basis

The current code does not record or declare the GDPR Article 6 legal basis for each processing activity. The applicable legal basis for each purpose must be confirmed by the controller before this text is treated as a final legal assessment.

Recipients and processors

The current code does not identify the hosting, backup, email or other processors. The controller must confirm and document their identities, technical access and processing agreements.

Transfers outside the EU or EEA

The current documentation does not establish whether transfers outside the EU or EEA occur. This must be confirmed based on the actual relationships with hosting, backup, email and other providers.

Retention

The current implementation does not have an automatic retention schedule for accounts, plays or visitor events. Account data remain until the account is deleted or otherwise removed. Login IP addresses remain with the account until deletion. Plays and visitor events remain until an administrator deletes them or resets the relevant data. Rejected account requests are not automatically deleted. Backups remain until an administrator deletes them. The persistent login cookie is set for 30 days. Language, theme and welcome cookies are set for up to one year. Browser local storage remains until the user or browser removes it or the application removes it.

The administrator can read private messages and live chat messages – also messages a user has deleted or withdrawn – until they are deleted automatically (private messages after 30 days, live chat after 7 days).

Your rights

Depending on the circumstances and the applicable GDPR rules, you may have rights of access, rectification, erasure, restriction of processing, objection and data portability, and to withdraw consent where processing is based on consent. You may also lodge a complaint with a competent data protection authority.

For requests concerning your personal data, contact Music@kamau.dk.

In Denmark you can contact Datatilsynet. You can also contact the competent authority in the country where you live or work, or where you believe an infringement occurred.

Information we need from you

For an account, the service requires a username and password. The answer to the security question is also required during login and registration as an anti abuse measure. If these required data are not provided, an account cannot be created or used.

Profiling and automated decision making

The current implementation does not use profiles for marketing or significant automated decisions about users. The visitor system technically classifies device type and crawler status from the user agent for visitor logging and security administration.

Source of the data

Account information is provided by the user. Login IP, visitor log data and device or crawler classification are generated on the server from the request. Playback data are generated when the service records playback activity.

Update

This notice was updated on 1 October 2026. Information about the controller, processors, legal bases, transfers and any exact retention schedule must be completed after the actual facts are verified.