Privacy Policy

Who Played (whoplayed.me) is a service for music producers that tells them when their unreleased tracks are played in public posts. It is operated by Who Played, Inc., a Delaware corporation (Delaware file number 10790770), HaHaskala Boulevard 17 B, Tel Aviv 6789037, Israel, which is responsible for your data (the “controller”). For anything in this policy, including a request to see or delete your data, write to hello@whoplayed.me.

We are appointing a representative in the EU and the UK and will name them here. Until then, write to hello@whoplayed.me.

Account: your email address, a password (stored only as a one-way hash), your artist or label name, and when you signed in. If you choose “Continue with Google”, Google tells us your name and email address and that the address is verified; we never receive your Google password or anything else from your Google account.

Tracks: the audio files you upload, an acoustic fingerprint made from them, and the details you type (title, artist, ISRC, remix and sample declarations). The fingerprint is a set of numbers that lets us recognise the track; it cannot be turned back into music.

Released catalogue: if you link your Spotify artist profile, the public list of your releases as Spotify’s official interface gives it (titles, artists, ISRC codes, release dates, cover art links, lengths), or the track list you paste. We never sign in to your Spotify account and never receive any audio from Spotify.

Protection agreement: the name you sign with, the time, and the text of the agreement you signed.

Profile photo: if you add one on your Account page; removed when you remove it or delete your account.

Promo sends: which DJs you sent a track to, how and when, and, if you import a promo list, the contact names and email addresses in it. This is information about other people (see section 5).

Access requests: if you sign up or ask for access, your email address, artist name, how many tracks you have out and how you send promos; deleted with your account, or on request.

Reports and requests: anything you tell us through “Report a problem”, our copyright form, or by email.

Payments: handled by our payment provider, Stripe; we never see or store your card number. We keep your plan, billing country and payment status.

Technical: our hosting provider keeps standard server logs (IP address, browser type, pages requested) for security and reliability.

Advertising: on a few public pages, and only as section 7 explains, the Meta Pixel tells Meta about your visit so we can see which of our ads work.

To run the service you asked for: recognising your tracks, watching the accounts you point us to, and showing you the results (contract). To keep the service secure, prevent abuse and fix problems (legitimate interest). To see which of our ads work (consent where the law asks for it; see section 7).

Emails. Some emails are needed to run your account and are always sent: confirming your address, resetting a password, and messages about your plan and payments. Summaries, play emails and getting-started tips are service emails too; you can turn summaries and tips off any time on your Account page or from the link in those emails (on the Free plan the play notices too; on a paid plan the email for each play found is part of what you pay for). News and offers are sent only if you ticked the box for them when you signed up or switched them on in your account (consent), and you can switch them off there or from any such email at any time. We keep when you agreed and the words you agreed to. We never sell data.

We look only at public posts on social platforms such as Instagram and TikTok: the public profiles of the DJs producers name, public posts that tag them or use their name, and the public accounts of venues, events and people they mention. We never log in to any social network ourselves to collect data and never access private accounts. Some listings of public posts come to us from third-party data providers.

For each public video we listen to the sound once, compare it with the fingerprints of registered tracks, keep the result and a link to the post, and delete the file within minutes. We keep the fingerprint of what we listened to (a set of numbers that cannot be turned back into sound), with the link and the date, for 90 days, so that a track registered later can be checked against recent posts. To test and improve accuracy we keep a small set of short audio samples on our own server for at most 90 days; they are never published or shared.

We do not copy or keep anyone’s videos. Results link to the post on the platform where it was published.

When a producer tells us they sent a track to a DJ, we store that DJ’s public name and account name, and a small public record about the account (verified badge, follower count, profile picture, and the public bio, from which we note a record label the DJ says they run) so producers pick the right one. When a play is found we store a link to the public post and who posted it. This information comes from the public posts themselves, from the producer who sent the track, and from the data providers listed in section 6.

We also keep a directory of DJs who perform publicly, so producers can find the right account quickly and plays can be recognised: the same public name, account name and public record, the music genres they are known for, and the public posts we listen to. DJs join it when a producer names them, or when we add widely booked public performers ourselves. When public posts show DJs together (a joint post, a DJ tagged in another’s video, a lineup), we note that link so we can suggest DJs who often play together. To find plays filmed by others we also look at public posts from places and events around these DJs, such as venues, festivals and event hashtags. We don’t keep pictures of anyone who isn’t a DJ: whoever filmed a play is shown by name only.

Profiling. To spend our checking where plays are likely, we rank how closely to watch each account (for example by how often it posts and how often plays are found there), and we group DJs by genre and by who plays together. This only decides where we look. We make no automated decisions about DJs that have legal or similarly significant effects on them.

What producers see and share. Results are shown only to the producer whose track it is. A producer may choose to share a recap card or a proof report (for example with a label or promoter) that names the DJs who played their track and links to the public posts; that is the producer’s choice. A producer on a paid plan may also send a private link (“Pitch with proof”) showing the plays they chose: each DJ’s public name, the date, the moment in the track and the link to the public post, never a picture. These pages open only through the link the producer shares, are kept out of search engines, count how often they are opened without cookies or anything about the visitor, and a DJ who opts out is removed from all of them. When a watched DJ publicly announces a gig, we may email the producers who sent that DJ a track, with a link to the announcement.

We rely on legitimate interest: a producer has a real interest in knowing where their own unreleased work was played, and DJs commonly expect and welcome credit for the music they play. We keep the impact on DJs small: we only use what they chose to post publicly, we never keep their videos, results are shown only to the producer whose track it is, and anyone can opt out at any time. You can object to this use whenever you like.

Anyone who prefers not to be watched or shown can write to hello@whoplayed.me (see the For DJs, artists and venues page). We may ask you to confirm the account is yours; then, within two working days, we stop watching the account, stop reporting its posts and delete the profile picture we keep. Plays a producer was already shown stay in that producer’s private history as their record of how their own work was used, unless the law requires us to remove them.

Data is processed by companies we use to run Who Played, each under its own privacy terms and only for the purpose named:

• Vercel (website hosting) · Supabase (database and file storage, in Frankfurt, Germany) · Hetzner (the servers that check public posts and keep our backups, in Finland and Germany)
• Resend (sending our emails) · Google Workspace (our company email, including opt-out and copyright requests sent to our address)
• Data providers that list public social-media posts for us, under contract (we name them on request)
• Anthropic (an AI assistant we use to run and maintain the service; it may see account and play data while helping us)
• Spotify (only if you link your artist profile: we ask its official interface for your public list of releases; nothing about you is sent to it but the artist link you chose)
• Stripe (payments) · Google (only if you choose to sign in with Google) · Cloudflare Turnstile (the “are you human” check on sign-up and our public forms; it sees your IP address and browser details to stop bots)

Some of these companies are outside the EU/EEA. Where EU or UK data is involved they rely on standard contractual clauses or equivalent safeguards.

We advertise on Facebook and Instagram, and use the Meta Pixel from Meta Platforms, our advertising partner, to see which ads bring people to Who Played. It runs only on our home page, the pricing page, the sign-up page and the plans page, and once on the first page after a sign-up; never on the pages of your account, your tracks, your plays or the DJs you send to.

What Meta receives: that one of those pages was visited (its address), and when you sign up, open the payment page or pay, that this happened, with the plan’s name and price; plus what any browser sends: IP address, browser and device type, and Meta’s cookies (_fbp on our site, and fr if you use Facebook or Instagram in the same browser). We never send your name, your email address, your tracks or anything about DJs, and we don’t use Meta’s “advanced matching”. Meta may link this to your Facebook or Instagram account and uses it under its own privacy policy. Meta is responsible for what it does with the data once it has it.

Legal basis and your choice. In the EU, the EEA, the UK and Switzerland (and wherever we can’t tell where you are), the pixel loads only after you press Accept on our cookie banner (consent); you can withdraw that at any time on the Cookie Notice page, or from “Cookie settings” at the bottom of every page. Everywhere else it is on by default and you can turn it off the same way, whenever you like (our legitimate interest in measuring our advertising, balanced by that choice). Meta’s cookies last about 90 days; your answer is kept for 12 months.

• Your account and tracks: for as long as your account exists. Revoke a track’s protection and its fingerprint is deleted; close your account and any card subscription is cancelled first, then everything except what the law requires us to keep (payment and invoice records, held by our payment provider) is deleted within 30 days.
• Fingerprints of public posts we listened to, and our accuracy samples: 90 days.
• Records of which public posts we have already checked (the link and the date, so a post is not checked twice): 180 days.
• Backups of the database and of your uploaded tracks: 14 days, on our server and as a second, encrypted copy on our own computer in Israel.
• DJ directory entries and the links between DJs: up to 12 months after the DJ was last relevant to the service (last named by a producer or last seen performing publicly), or until they ask us to remove them, whichever is sooner.
• Access requests that never became an account: 12 months.
• Refunds: to apply the one-refund-per-customer rule, we keep a one-way scrambled form (a hash) of the email address and card used for a refund, also after an account is deleted.
• Requests made through our forms: kept as a record of what we decided.
• Server logs: kept briefly by the hosting provider and then discarded.

You can ask to see the data we hold about you, correct it, receive a copy, restrict or object to its use, or have it deleted, and you can withdraw consent where we relied on it. Write to hello@whoplayed.me (subject “Privacy request”), or to Who Played, Inc., HaHaskala Boulevard 17 B, Tel Aviv 6789037, Israel; we answer within 30 days. You can delete your own account and everything in it at any time from your Account page. You can also complain to a data protection authority, such as the one where you live (in Israel, the Privacy Protection Authority).

Connections are encrypted (HTTPS). Passwords are hashed, never stored in the clear. Access to production systems is limited to the operator and protected by keys and two-factor login. Database rows are protected so that one account can never read another’s data.

Who Played is for people 16 and over. We do not knowingly collect data from anyone younger.

If this policy changes in a way that matters, we email account holders before the change takes effect and update the date at the top.