Privacy

This explains what Dazoo does with personal data when you visit dazoo.app or have an account. Short version: we collect what we need to run Dazoo, we don't sell data, we don't show ads, and we use no advertising cookies.

Who is responsible

KONUS – Christoph Wörndle, Römerstraße 46, 6103 Reith bei Seefeld, Austria (see the imprint). For anything about your data: privacy@dazoo.app.

What we process

• Visiting the website: our host receives technical data with every request (IP address, browser, time, the page asked for) to deliver the page and keep the service secure.
• Your account: your email address, and what you add to your profile: name, @handle, profile picture. Name, @handle and picture are public on your profile.
• Signing in with Google: Google tells us your name, email address and profile picture. We never see your Google password and get nothing else from your Google account.
• Emails: to send you a sign-in link or code, and once a welcome email when you create your account, your email address and name go to our email provider. No newsletter unless you ask for one.
• Waiting list and invites: if you join the waiting list, we keep your email address to tell you when there's a spot, and delete it when you ask or when Dazoo opens to everyone. If you use an invite code, we note which code you used.
• Paid plans: Stripe sells Pro and Premier for us as seller of record. Stripe receives your name, email address, billing address and payment details, calculates the VAT, and sends receipts, under its own privacy policy (stripe.com/privacy). We never see your card details; we store only a reference to your Stripe customer and subscription, and which plan is active until when.
• Usage counts: how many songs you start, join and cheer each month, so we can show what your plan has left.
• Profile pictures you upload are cropped and saved again in your browser before upload, which removes hidden photo data such as location.
• Your recordings: the video and sound of the songs you start and the parts you add (and a guide track, if you record one), with how they line up in time, and the versions made from them. Who can see them follows the song: everyone with its link, or everyone when a song is public. Your name is shown with your parts.
• What you add on songs: lyrics you write, your reactions (applause and emoji) and cheers (short video reactions) are shown with your name; claps and flags on cheers are counted. Cheers are video and sound and are checked like parts.
• Automated checks: so that nothing unlawful or sexual goes out, a few still frames of each part, its sound written out as text, and a short sound clip are checked automatically. Clear violations are held back; you get an email with the reason and can reply to appeal. Unclear cases are looked at by a person.
• Reports: if you report something, we store what you reported, the reason and your note, and your account if you're signed in (if you delete your account, the report stays without your name).
• Protection against abuse: on forms (waiting list, invites, reports, uploads, cheers) Vercel BotID checks signals from your browser to tell people from bots, and we count attempts per IP address to slow down abuse. We store only a scrambled form of the IP address (a salted hash) and delete it after a day.
• Your age: when you use an invite, you confirm that you are 16 or older; we note when.

Why, and on what legal basis

• To provide your account and Dazoo itself: our contract with you (Art. 6(1)(b) GDPR).
• To keep Dazoo secure, prevent abuse, and understand in aggregate how the site is used: our legitimate interests (Art. 6(1)(f) GDPR).
• Where the law requires us to keep data, for example for taxes: legal obligation (Art. 6(1)(c) GDPR).

Cookies and analytics

We only use cookies that are needed to keep you signed in. We count visits with our own installation of Umami (analytics.konus.at), which uses no cookies and stores no IP addresses or personal profiles (the IP address is used only to tell the country, then dropped); we only see totals such as visits per page, countries and devices. That is why there is no cookie banner.

Service providers

• Vercel (USA) hosts the website.
• Supabase stores accounts, profiles and pictures in a data centre in the EU (Frankfurt) and handles sign-in.
• Brevo (France) sends our emails, including notes to ourselves when something is reported or held back (with the song's title, never your email address).
• Cloudflare (USA, storage in the EU where available) stores videos and sound (R2).
• OpenAI (USA) checks still frames and the written-out sound of parts and cheers for content that isn't allowed, and writes out the sound. Through its API, data is not used to train models; OpenAI keeps it for up to 30 days to detect abuse, then deletes it.
• AudD recognises whether a part is a known recording (music recognition), from a short sound clip.

These providers process data only on our behalf and for these purposes. Google (if you sign in with Google) and Stripe (Ireland and USA; for paid plans, as seller of record) are independent controllers for their part, under their own privacy policies. Where data reaches countries outside the EU, this is covered by an EU adequacy decision (such as the EU-US Data Privacy Framework) or the EU standard contractual clauses.

How long we keep data

Account data stays as long as you have an account. You can delete your account at any time under Settings: your profile, parts, videos and sound, lyrics, reactions and cheers are deleted right away, and songs others joined go on with them; backups roll over within a few days after that. Parts and cheers held back by the checks are kept for 6 months so you can appeal, then deleted; what the checks found on parts that passed is cleared after 30 days; notes in reports are deleted 12 months after the report was handled. Our email provider and sign-in service keep technical logs (including your email address) for a short time. Stripe keeps its invoices for as long as tax law requires. Data we must keep by law we keep for as long as the law says.

Age

Dazoo is for people 16 and older.

Your rights

You can ask for access to your data, correction, deletion, restriction, a copy to take elsewhere, and you can object to processing based on our legitimate interests. Write to privacy@dazoo.app. You can also complain to a data protection authority, in Austria the Datenschutzbehörde.

Changes

We update this page when Dazoo changes and show the date at the top.