Privacy Policy

Dupli-Spot ("we", "us", or "our") respects your privacy and is committed to safeguarding your personal data. This Privacy Policy explains how we collect, use, share, and retain information when you visit our website or use the Dupli-Spot experience, in accordance with Regulation (EU) 2016/679 ("GDPR"), the Italian Data Protection Code (Legislative Decree 196/2003 as amended by Legislative Decree 101/2018), and other applicable laws in force in 2025.

1. Data Controller

The data controller is Dupli-Spot. You can reach us at duplispot@soundniccolo.com.

2. Data We Process

Depending on how you use Dupli-Spot, we process the following categories of information:

• Account details such as email address, display name, and authentication timestamps.
• Spotify connection metadata, OAuth tokens, scopes, and refresh tokens stored via Supabase or local storage to keep your session alive.
• Track Lookup searches, batch lookups, and playlist actions recorded for history, analytics, and to provide quick access across devices when signed in.
• Product usage data, including pages visited, feature interactions, and errors logged to help us improve functionality.
• Anonymous usage analytics, including track and playlist lookup counts with temporary session identifiers stored in sessionStorage (automatically cleared when you close your browser tab). This data helps us understand how features are used and improve the service.
• Device, browser, language preferences, IP address, and session identifiers needed to deliver the service securely.
• Cookie and similar tracking data as described in our Cookie Policy.
• Local storage data such as cookie preferences, UI settings, search hints, and scan state saved on your device for a smoother experience.

3. Purpose and Legal Basis

We use the data above for purposes that include:

• Delivering the Dupli-Spot experience and fulfilling our contractual obligations to you (performance of a contract).
• Detecting fraud, abuse, and unauthorized access, or ensuring service integrity (legitimate interest).
• Complying with legal obligations, such as responding to lawful requests from authorities.
• Sending essential service messages and, subject to your consent, optional marketing or product update emails.

4. Data Sharing and Transfers

We share data only with trusted service providers who help operate Dupli-Spot. Key partners include Spotify (for authentication and playlist access), Supabase (data storage and user history), Vercel (hosting), and analytics providers. We do not sell your personal data. When data is transferred outside the European Economic Area, we rely on Standard Contractual Clauses or equivalent safeguards to keep your information protected.

6. Data Security

We implement technical and organizational safeguards such as TLS encryption, access controls, authentication monitoring, and regular security reviews. While we strive to keep your data safe, no system is completely immune to risk.

5. Data Retention & Storage

Data is retained only as long as necessary to fulfill the purpose it was collected for, to meet legal obligations, or to resolve disputes. Supabase stores user and connection metadata within the EU. Track Lookup history is kept for up to 24 months to deliver a cohesive experience; anonymous local history remains on your device until you clear it. Anonymous analytics data (lookup counts and session identifiers) is automatically deleted after 90 days. Spotify-related tokens are deleted when you revoke access or delete your Dupli-Spot account.

8. Your Rights

Under GDPR and Italian law, you have the right to access, rectify, erase, restrict, or object to our processing of your personal data, as well as the right to data portability. You may withdraw consent at any time without affecting the lawfulness of previous processing. To exercise your rights, contact us using the email above. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

7. Cookies and Tracking

We use cookies and similar technologies for essential platform functionality, analytics, and optional personalization. We also use sessionStorage to generate temporary anonymous session identifiers for usage analytics; these are automatically cleared when you close your browser tab. You can manage your cookie preferences in the Cookie Settings panel or through your browser. For full details, review our Cookie Policy.

9. Automated Decision-Making

We do not use personal data for automated decision-making that produces legal or similarly significant effects.

10. Children

Dupli-Spot is not intended for children under 16 years of age. We do not knowingly collect or retain personal data from minors. If you believe a child has provided us with data, contact us to request deletion.

11. Changes to This Policy

We may update this Privacy Policy to reflect legal, operational, or product changes. We will notify you of material changes through the app or other appropriate channels. Continued use of Dupli-Spot after an update indicates acceptance of the revised policy.

12. Contact

If you have questions or concerns about this policy, please write to duplispot@soundniccolo.com.