Privacy policy

At myBeat / myBeat.io, we are conscious and responsible with your data. We only process information that is necessary to provide and improve our services, and we carefully handle any information we collect about you and your use of our services. We do not sell your personal data.

This Privacy Policy applies to your use of the website and services provided by myBeat and myBeat.io. The effective date of this policy is 15 October 2026. Any new version of this policy will supersede all previous versions.

myBeat.io V.O.F., registered with the Dutch Chamber of Commerce under number 93920393, is the controller of the personal data described in this policy.

This Privacy Policy outlines what data we collect about you, how we use it, and under what conditions we may share this data with third parties. We also explain how we store your data, how we protect it against abuse, and what rights you have with regards to the personal information you have provided to us.

If you have any questions about our Privacy Policy, email us at [email protected]. Our contact information is also available at the end of this policy.

• Account data: your email address, name or artist name, profile details and settings. You sign in with a code we email you.
• Your content: the music, artwork, video and messages you upload or send, and the replies, decisions and feedback on them.
• Payment data: your plan, invoices and payment status. Card and bank details are entered on Stripe's pages and stay with Stripe; we do not receive your full card number.
• Payout data: for inbox owners who connect Stripe, whether the Stripe account is connected and ready. Identity and bank details for payouts are handled by Stripe.
• Support conversations through our chat, email or support requests.
• Technical data: IP address, browser, operating system, a device identifier and how you use the website, as described under Automatically Collected Data.

Below you can read how we process your data, where we store it, what security techniques we use, and who has access to this data. The processors below process personal data on our behalf, under a data processing agreement, and only for the services they provide to us. We have taken appropriate technical and organizational measures to prevent the loss or unauthorized use of your personal information.

Our application and database run with our hosting providers in the European Union. Files you upload, such as music, artwork and videos, are stored with Amazon Web Services (S3 and CloudFront) in Frankfurt, Germany. Traffic to our website passes through Cloudflare, which protects the site against attacks and delivers it quickly.

Payments for subscriptions and paid Dropz submissions, refunds and payouts to inbox owners are processed by Stripe. Stripe processes your name, email address, billing address and payment details, and for payouts the identity and bank details Stripe asks the inbox owner for. Stripe is also responsible for some of this data itself, for example to prevent fraud and meet its legal obligations; see Stripe's privacy policy for more information.

Subscriptions taken out earlier through Mollie are still billed by Mollie. Mollie processes your name, address, city, and payment information such as your bank account or credit card number for those subscriptions. We no longer take new payments through Mollie.

• Resend: sends our account and service emails, such as sign-in codes, receipts and notifications.
• Amazon Web Services (SES, Ireland): sends the promo emails our users send to their own contacts.
• Mailchimp: our mailing list (see Marketing below).
• Intercom: the support chat. When you are signed in, Intercom receives your name, email address, plan and basic account details so our team can help you.
• PostHog (EU): usage statistics and error reports (see Automatically Collected Data).
• Google Analytics (Google Ireland Limited): usage statistics, only with your consent (see Automatically Collected Data). Google LLC in the United States may also process this data, under the EU-U.S. Data Privacy Framework.
• Upstash: fast storage for search, rate limits and background jobs.
• Stream: the in-app notifications.
• Better Stack: our system status. Its status widget loads from Better Stack on some of our pages.
• Slack: internal alerts to our team, which can include your email address or user id, for example when you send feedback or a submission needs attention.
• Giphy: the GIF search in the Creative Suite. Your search terms and IP address go to Giphy directly from your browser when you use it.
• Push services: if you turn on push notifications, they are delivered through your browser's push service (for example Google, Apple or Mozilla).

When you fill in your profile, we look up the artist or label names you search for in SoundCloud, Discogs and Resident Advisor. Only the search terms are sent, not your personal details.

Some of these processors are based in the United States or can access data from there (Stripe, Intercom, Mailchimp, Resend, Cloudflare, Stream, Slack, Giphy and Google). Where personal data leaves the European Economic Area, the transfer is covered by the EU-U.S. Data Privacy Framework where the processor is certified under it, or by the European Commission's Standard Contractual Clauses.

If you import contacts to send promo emails, you decide who is on that list and why, and we process those contacts on your behalf. You confirm when importing that you may email them. Every promo email has an unsubscribe link, and we keep unsubscribes so that person is not emailed again.

We use your data for the purposes of our services. This means that the processing purpose is always directly related to the task you have assigned us: running your account, delivering what you send to the inboxes you choose, handling payments and payouts, answering support questions, keeping the service secure and preventing abuse, and meeting our legal obligations, such as keeping invoices. We process your data because it is necessary to perform our agreement with you, because we have a legitimate interest (security, preventing fraud and abuse, and improving our services), because the law requires it, or because you gave consent.

When you send music to an inbox, the owner and team of that inbox see your name, email address, profile and what you sent them. Apart from that, and from the processors listed above, who work on our behalf, we only share your data with others when the law requires it. These third parties are all bound by confidentiality on the basis of their agreement with us, an oath, or legal obligation.

By creating an account you agree to receive product and marketing emails from myBeat, as set out in Article 18 of our Terms, and we tell you so on the sign-up screen. When you create an account, or export a video in the Creative Suite while signed in, we add your email address to our mailing list at Mailchimp, with a tag for what you use. We send these emails on the basis of our legitimate interest in telling our users about myBeat.

You can opt out at any time with the unsubscribe link in every marketing email, or by emailing [email protected]. Opting out does not stop the emails we need to send to provide the service, such as sign-in codes and receipts.

When you join the waitlist for a product that is not out yet, we only add you to the news list if you tick the box for it.

We do not send your purchases or account details to Meta (Facebook) or other advertising networks.

Your IP address, browser, operating system and device identifier are personal data, and we treat them that way.

When you sign in, send a submission or render a video, we record your IP address, browser, the country your connection comes from and a device identifier. The device identifier is calculated in your browser from its settings and stored in a cookie. We use these records to secure accounts and to prevent fraud and abuse, such as bans being evaded (legitimate interest).

With your consent (see Cookies), PostHog, in the EU, collects statistics on how visitors use our website, such as the pages viewed and buttons clicked, and may record how a page is used (session replay). Without your consent, PostHog stores nothing on your device and only receives a report when an error occurs on a page. We use this to find problems and improve our services. PostHog does not receive your name or email address from us.

With your consent, we also use Google Analytics, provided by Google Ireland Limited, to count visits and see which pages are viewed. It sets cookies that tell one browser from another and keep track of a visit. We have switched off Google signals and ad personalization, and we use Google Analytics only for statistics, never for advertising. Google Analytics does not log or store your IP address, and does not receive your name or email address from us. Without your consent, it does not load at all and receives nothing. For more, see Google's privacy policy and how Google uses information from sites that use its services.

When you first visit myBeat we ask for your cookie choice. Cookies and similar technologies, such as your browser's local storage, that are not needed to run myBeat are only used with your permission. If your browser sends Global Privacy Control, we treat that as a no. You can change or withdraw your choice at any time in Cookie settings, which you also find in the footer of our pages and in your account menu. Our Cookies page lists every cookie by name, who sets it and how long it lasts.

• Session cookie: keeps you signed in and your session secure.
• Your cookie choice: remembered for 12 months, after which we ask again (sooner if we add a new kind of cookie).
• Device cookie: stores the device identifier described above, for one year, for account security and to prevent fraud and abuse.
• Preferences: what your browser remembers for you, such as the app you last opened, a notice you closed or the layout of the editor.
• Support chat: Intercom loads only when you open the chat. From then on it uses cookies so your conversation continues across pages and visits; when you sign out we end the chat session.
• Payments: checkout and payouts run on Stripe's own pages, where Stripe's cookie policy applies. Stripe sets no cookies on mybeat.io.

• PostHog: only after you accept, cookies and local storage that recognise a returning browser, so we can see how myBeat is used (pages viewed, clicks and session replays) and improve it.
• Google Analytics: only after you accept, cookies that recognise a returning browser and keep track of a visit, for one year, so we can count visits and see which pages are viewed. Google signals and advertising features are off.

Without your consent, PostHog stores nothing on your device and only receives a report when an error occurs, so we can fix it. Google Analytics does not load at all. When you withdraw your consent, we stop the analytics straight away and delete its cookies.

We do not use advertising or marketing cookies. Rejecting or withdrawing consent never limits your access to myBeat. You can also block or delete cookies in your browser settings, but without the session cookie you cannot sign in.

We will keep your data for as long as you are a client of ours. This means that we will keep your customer profile until you indicate that you no longer wish to use our services. If you inform us of this, we will also consider it a request to be forgotten. On the basis of applicable administrative obligations, we must keep invoices with your (personal) data; we will therefore keep this data for as long as the applicable term runs, which in the Netherlands is seven years. However, employees no longer have access to your client profile and the documents we have produced as a result of your assignment.

• Uploads that are not finished or not used are deleted after 7 days.
• Videos rendered in the Creative Suite are deleted after 30 days.
• Files attached to feedback are deleted after 60 days; the written feedback stays with the submission.
• Submissions, sign-in records and device records are kept for as long as your account exists.

Under the applicable Dutch and European legislation, as a data subject, you have certain rights with regard to the personal data processed by or on behalf of us. We explain below what these rights are and how you can exercise them. Send your request to [email protected] or through our support page. In order to prevent abuse, we will, in principle, only send copies of your data to your already known e-mail address. In the event that you wish to receive the data at a different e-mail address or by post, for example, we will ask you to identify yourself. We keep a record of completed requests, and in the case of a request to be forgotten, we maintain anonymized data. You will receive all copies of your data in the machine-readable data format that we use within our systems.

You always have the right to inspect the data that we (have) process(ed) and that relate to your person or can be traced back to you. You can make a request to that effect to us. You will receive a response to your request within 30 days. If your request is granted, we will send you a copy of all data, together with an overview of the processors who have this data, stating the category under which we have stored this data.

You always have the right to have the data that we (have) process(ed) and that relate to your person or can be traced back to you, adjusted. You can make a request to that effect to us. You will receive a response to your request within 30 days. If your request is granted, we will send you a confirmation at the e-mail address we have on file that the data has been adjusted.

You have the right to have your account and the personal data we hold about you deleted, unless we have to keep it by law, such as invoices. Ask us at [email protected] or through our support page; we handle your request within 30 days and confirm it at the e-mail address we have on file.

You always have the right to limit the data that we (have) process(ed) and that relate to your person or can be traced back to you. You can make a request to that effect to us. You will receive a response to your request within 30 days. If your request is granted, we will send you a confirmation at the e-mail address we have on file that the data will no longer be processed until you lift the restriction.

You always have the right to have the data that we (have) process(ed) and that relate to your person or can be traced back to you, performed by another party. You can make a request to that effect to us. You will receive a response to your request within 30 days. If your request is granted, we will send you copies of all data about you that we have processed or that have been processed by other processors or third parties on our behalf. In all likelihood, we will no longer be able to continue the service in such a case, because the secure linking of data files can no longer be guaranteed.

In certain cases, you have the right to object to the processing of your personal data by or on behalf of myBeat and/or mybeat.io. If you object, we will immediately stop processing your data while we handle your objection. If your objection is well-founded, we will provide you with copies of the data we process or have processed on your behalf, and then permanently stop processing. You also have the right not to be subject to automated individual decision-making or profiling. We do not process your data in such a way that this right applies. If you believe that this is the case, please contact us. Where we process your data based on your consent, you can withdraw that consent at any time; this does not affect processing that took place before.

You have the right at all times to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, if you suspect that we are using your personal data in the wrong way. We would appreciate the chance to answer your concern first at [email protected].

We reserve the right to change our privacy policy at any time. However, you will always find the most recent version on this page. If the new privacy policy affects the way we process data already collected about you, we will notify you of this by email.