Privacy Policy

SpotiMP3 offers metadata lookup and personal audio backup tools. Free use does not require an account. Prime uses an email-based account to manage access.

This policy explains what we collect, why, how long we keep it, and what rights you have. It applies to the SpotiMP3 website and services.

Information you give us:

• Links you paste: we send the submitted URL to our processing backend to identify metadata and prepare available audio matches from separate sources. Spotify links are not used to obtain Spotify audio.
• Account details, only if you go Prime: your email address, sign-in verification records and session details, so your plan follows you across devices. We do not ask for your Spotify password or Spotify account sign-in.
• Payment records: Ko-fi and its payment providers handle payment details. We store the payment email, transaction identifier, amount, currency, tier and subscription indicator to manage Prime and accounting. We do not receive your full card number through this integration.
• Activity records: signed-in accounts store their last activity time. Download-history records, including records imported from our earlier service, can contain a user identifier, source link, track details, format and download date.
• Anything you send us: if you contact us for support or to report a copyright issue, we keep that correspondence so we can respond.

Information collected automatically:

• Basic technical data such as browser type, device type, approximate region, and pages visited, used to keep the Service running and to understand roughly how it is used.
• Server logs, including IP address, which are generated automatically and used for security, abuse prevention, rate limiting, and diagnosing faults.

We do not knowingly collect special categories of personal data, and we ask that you do not send them to us.

We use the information we collect for the purposes below. Where the UK GDPR or EU GDPR applies to you, the legal basis for each purpose is noted alongside it.

• Provide the Service — look up metadata, process permitted backup requests and deliver available files. Legal basis: performance of a contract.
• Operate paid plans — manage your subscription, payments and access. Legal basis: performance of a contract.
• Keep the Service secure — prevent abuse, fraud and automated scraping, and enforce rate limits. Legal basis: our legitimate interests.
• Improve the Service — understand aggregate usage so we know what to fix and build. Legal basis: our legitimate interests, or your consent where required.
• Support — respond to your questions and reports. Legal basis: our legitimate interests.
• Comply with the law — meet legal obligations and respond to valid legal requests. Legal basis: legal obligation.

We do not sell your personal information, and we do not share it with third parties for their own independent marketing.

Authentication cookies maintain your signed-in session and protect the sign-in process. You can block them in your browser, but account features may then stop working. Your display theme preference is stored in your browser; the language is selected through the page URL.

The public website uses Umami analytics to understand page visits and general usage. The admin dashboard is excluded from this analytics integration. Browser requests to our analytics host can include technical information such as browser and network details.

Most browsers let you block or delete cookies in their settings. Blocking essential cookies may stop parts of the Service working.

We use hosting and processing providers to serve pages, identify metadata and prepare files; Resend to send sign-in emails; Ko-fi and its payment providers for payments; and Umami for analytics. When revenue reporting is configured, RevTrack receives the transaction identifier, amount, currency, date and donor name or tier for payment reporting. Third-party payment providers may process information under their own policies.

Loading external assets, such as language flag images, also sends the asset host a browser request containing network information. The Service also links to third-party websites we do not control. This policy does not cover them, and we are not responsible for their practices — please read their own privacy policies.

Copyright notices and review requests may include names, contact details, signatures, links and statements of rights. We use these to investigate reports, notify affected users where possible and maintain records of our response. Relevant information may be shared with the affected user, the complainant, our processing providers or advisers where needed to address a report or legal claim. A statutory counter-notice may have to be forwarded to the original complainant with its required identifying details.

We may disclose information where required by law or reasonably necessary to establish, exercise or defend legal claims. Please provide only information relevant to your report.

Retention depends on the purpose of the record, whether an account or support request remains active, operational and security needs, and applicable legal obligations. We do not specify a single deletion period for every type of data.

• Processing data and archives: used to prepare and deliver results. Storage and caching can occur on processing infrastructure; we do not promise immediate deletion after a download.
• Server logs and activity records: used for operations, security and diagnostics. Contact us for information about records associated with your account or request.
• Account and billing records: kept while needed to provide paid access and resolve payment issues, and where required for tax, accounting or legal obligations.

We use reasonable technical and organisational measures to protect your data, including encryption in transit and restricted access to systems.

No method of transmission or storage over the internet is completely secure. Contact us if you suspect that your account or personal data has been compromised. This limitation does not remove our data-protection obligations.

The Service is available worldwide, and your data may be processed in a country other than your own, including countries whose data-protection laws differ from those where you live.

You can contact us for information about the providers, processing locations and transfer arrangements relevant to your data. Applicable law may require safeguards for international transfers; this notice does not itself provide consent to a transfer or replace those safeguards.

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• ask us to correct data that is inaccurate or incomplete;
• ask us to delete your data;
• object to, or ask us to restrict, certain processing;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent; and
• complain to your local data-protection authority.

To exercise any of these rights, contact us using the details below. We will respond within the time required by applicable law. Free use does not require an account, so we may need a submitted link, approximate request time or other proportionate information to locate a record and verify your request. Please do not send an identity document unless we explain why it is necessary.

The Service is not directed at children, and we do not knowingly collect personal data from anyone under 16, or under the age of digital consent in their jurisdiction if higher.

If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this policy from time to time. When we do, we will revise the "last updated" date at the top of this page, and material changes will take effect when posted.

We will provide additional notice or request consent where applicable law requires it. Merely continuing to use the Service is not treated as consent to processing that requires your consent.

For privacy questions or requests concerning your data, email [email protected].