Privacy Policy

Draft — pending legal review. Written to reflect GDPR / Spanish LOPDGDD expectations. The operator's legal entity, address and (if required) DPO contact must be inserted, and this must be reviewed by a lawyer before launch.

1. Who we are

The data controller is the operator of takethecrown.live (legal entity and registered address to be inserted). Contact: privacy@takethecrown.live.

2. What we collect

• Email address and artist/handle name — when you add a track or buy a placement.
• Track links you submit and the title/artist you enter.
• Payment metadata from Stripe (amount, currency, payment status, Stripe customer and payment identifiers). We do not receive or store your full card number.
• A session identifier cookie (lfm_sid) used only to deduplicate plays and outbound clicks. It is not used for advertising.
• Your IP address at the time of a purchase, kept for fraud prevention and to evidence acceptance of the terms.
• Aggregate usage analytics (page views, play counts). We aim to keep these privacy-preserving and cookieless.

3. Why, and our legal basis

• To provide the service (run your placement, show your panel, produce your receipt) — performance of a contract.
• To take payment and prevent fraud — contract and legitimate interest.
• To email you about your reigns and the weekly countdown — our legitimate interest in operating the service; you can opt out at any time. Any broader marketing is sent only with your consent.
• To comply with legal obligations (accounting, responding to rights complaints).

4. Who we share it with

• Stripe — payment processing. Stripe is an independent controller for its own fraud and compliance purposes; see stripe.com/privacy.
• Our hosting and email providers — as processors, under contract.
• Authorities or claimants — where legally required, or to handle a rights complaint.

We do not sell personal data.

5. What is public

The artist/handle name shown on a crown or in the Hall of Fame, the track, the amount paid, and the plays/clicks for that reign are displayed publicly on the site and in shareable receipts. Your email and IP are never shown.

6. Retention

Account and reign records are kept while the service operates and for as long as needed for accounting and legal claims (generally up to 6 years for invoicing records under Spanish law). Session identifiers and raw IP logs are kept for a shorter period (target: 12 months) and then deleted or aggregated.

7. Your rights

You can request access, correction, deletion, restriction, portability, and object to processing based on legitimate interest, by emailing privacy@takethecrown.live. You can also complain to the Spanish data protection authority (AEPD) or your local authority. Deletion may be limited where we must keep invoicing records.

8. Cookies

We set one essential first-party cookie (lfm_sid) to make play and click counts honest. It requires no consent banner because it is strictly necessary for a feature you use. If we later add non-essential analytics or any third-party cookies, we will ask for consent first.

9. International transfers

Some providers (e.g. Stripe) may process data outside the EEA under appropriate safeguards such as the EU Standard Contractual Clauses.

10. Changes

We will post any material change on this page before it takes effect.