Privacy Policy

BeatLink.io is operated by BeatHub, a micro-entreprise registered in France, acting as data controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 (the "GDPR") with respect to the personal data of all Users of the Platform.

2.1 — Data You Provide Directly

2.2 — Data Collected Automatically

2.3 — Data Received from Third Parties

Google OAuth: If you register or sign in using Google, we receive your name, email address, and profile picture URL as provided by Google. We do not receive your Google password.

Stripe (payment processor): We receive confirmation of subscription status, payment method type (e.g., "card ending in 4242"), and billing cycle. We do not receive or store your full card number, CVV, or complete banking details. Those are handled exclusively by Stripe, Inc. under its PCI DSS-compliant infrastructure.

IP geolocation: We use a third-party service to detect your approximate country of residence at the point of registration based on your IP address, for the sole purpose of pre-filling the country field.

We process your personal data only where a valid legal basis exists under Article 6 of the GDPR.

3.1 — Performance of a Contract (Art. 6(1)(b))

The following processing is strictly necessary to provide the Service you have subscribed to:

• Creating and managing your account and user profile
• Delivering scan results and contact lookup features
• Managing your subscription, billing cycle, and usage quota
• Sending transactional emails relating to your account (e.g., payment confirmations, quota alerts)
• Processing cancellation and account deletion requests

3.2 — Legal Obligation (Art. 6(1)(c))

We process certain data to comply with applicable legal obligations, including:

• Retention of billing and transaction records pursuant to French commercial law (Article L123-22 Code de commerce — 10 years)
• Responding to lawful requests from courts or competent supervisory authorities

3.3 — Legitimate Interests (Art. 6(1)(f))

We process certain data on the basis of our legitimate interests, having conducted a balancing assessment to verify that those interests are not overridden by your rights and freedoms:

You have the right to object at any time to processing based on legitimate interests. See Section 8 for how to exercise this right.

3.4 — Consent (Art. 6(1)(a))

The following processing is based solely on your freely given, specific, and informed consent:

• Sending marketing emails, newsletters, tips, and product updates

This section specifically addresses the personal data of third-party artists that is surfaced through the Contact Lookup feature of BeatLink.io.

4.1 — Nature of the Data

The Service aggregates contact information — including social media profile URLs and publicly disclosed email addresses, Spotify listener data, and YouTube presence — that has been made publicly accessible by the individuals concerned on social platforms, music streaming services, and video-sharing platforms.

4.2 — Legal Basis

The processing of this third-party data by the Publisher, for the purpose of providing the Contact Lookup feature, is based on legitimate interest (Art. 6(1)(f) GDPR): enabling music producers to identify and contact artists in a professional prospecting context, using only data that the artists themselves have voluntarily made public.

A Legitimate Interest Assessment (LIA) has been conducted. Key findings:

• The data is strictly limited to professional contact information voluntarily disclosed on public platforms
• The processing serves a proportionate, commercially recognized B2B prospecting purpose
• The data does not include sensitive categories within the meaning of Article 9 GDPR
• Artists retain full control over their public information and may remove it from source platforms at any time

4.3 — User Responsibility as Independent Data Controller

4.4 — Rights of Artists Whose Data Appears on the Platform

Any individual whose contact information appears on the Platform may submit a request for erasure, rectification, or objection by contacting us at contact@beatlink.io. We will process such requests within 30 days and will remove or correct data where legally required.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, subject to mandatory legal retention obligations.

Upon expiry of the applicable retention period, data is permanently and irreversibly deleted or anonymized such that it can no longer be associated with any identifiable individual.

We use a limited number of trusted third-party service providers ("sub-processors") to operate the Service. Each sub-processor is engaged under a data processing agreement ensuring an equivalent level of protection to that required by the GDPR.

Some sub-processors listed in Section 6 are located outside the European Economic Area (EEA), including in the United States. Where personal data is transferred to a third country, we ensure an adequate level of protection through one or more of the following mechanisms:

• Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914/EU)
• Transfers to recipients in countries recognized by the European Commission as providing an adequate level of data protection
• Other transfer mechanisms permitted under Chapter V of the GDPR

You may request information about the specific transfer mechanisms applicable to our sub-processors by contacting contact@beatlink.io.

If you are located in the European Economic Area, you have the following rights with respect to your personal data:

How to Exercise Your Rights

Submit your request to: contact@beatlink.io

We will respond within 30 days of receipt. In cases of complexity or volume, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it. We may ask you to verify your identity before processing your request. We will not charge a fee for reasonable requests.

Right to Lodge a Complaint

You have the right to lodge a complaint with the competent supervisory authority. In France:

9.1 — Cookies We Use

9.2 — Managing Cookies

You may control or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will prevent you from accessing authenticated areas of the Service. For guidance on managing cookies, visit allaboutcookies.org.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of all data in transit using TLS 1.2 or higher
• Encryption of data at rest on our hosting infrastructure
• Role-based access control — internal access to personal data is limited to those who need it to operate the Service
• Password hashing using industry-standard cryptographic algorithms — passwords are never stored in plaintext
• Regular security reviews and dependency updates
• Strict data minimization — we collect only what is strictly necessary for the purposes described in this Policy

The Service is not directed at individuals under the age of 18 years. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal data without appropriate consent, please contact us immediately at contact@beatlink.io. We will delete such data promptly upon verification.

The Service may contain links to third-party websites, platforms, and services — including Spotify, YouTube, and social media platforms. This Privacy Policy does not apply to those third-party services. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party services. We encourage you to review the privacy policy of every service you access through BeatLink.io.

We reserve the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or the Service. In the event of a material change, we will notify registered Users by email and update the "Last updated" date at the top of this Policy at least 30 days before the change takes effect.

Continued use of the Service following notification of a material change constitutes acceptance of the revised Policy. If you do not accept the changes, you must cease using the Service and may request deletion of your account.

The current version of this Policy is always accessible at beatlink.io/privacy.

For any question, request, or complaint relating to this Privacy Policy or the processing of your personal data: