Privacy Policy

setlist.id is operated by Skylight Studio LLC, which is the data controller for the information described here. Questions, or any request below, go to play@setlist.id.

What We Collect, and Why

• Your account: email address and a hashed password. Needed to give you an account at all, so we process it to perform our contract with you.
• Your use of the service: the URLs you submit, your job history, and your set allowance and usage. Same basis: it is the service.
• Billing: your plan, trial status, renewal date and invoice history. Card details are handled by Stripe and never reach us. Same basis.
• Analytics: how the site is used, described in the next section. We rely on our legitimate interest in understanding and improving the product.

Analytics and Session Recording

We use PostHog. What it does depends on where you are.

In the EU, EEA, UK and Switzerland: PostHog runs in cookieless mode. It stores nothing whatsoever on your device, and your activity is never linked to your account, even when you are signed in. Session recording is off, and our servers send no analytics about your purchases or your mixes. Because nothing is stored on your device, there is no cookie banner to show you.

Everywhere else: PostHog sets cookies, and once you sign in your activity is linked to your account. It collects pages viewed, clicks, your browser and device, an approximate location from your IP address, referrer, performance data and errors, and records a replay of your session. What you type into form fields, passwords included, is masked; other content on screen is not.

We do not use any of this for advertising, and we do not sell your data.

Cookies

• One to keep you signed in. Required for the service to work.
• One, kept a year, recording only that an account exists on this browser so returning visitors land in the app rather than the marketing site. It does not identify you and is cleared when you delete your account.
• PostHog's analytics cookies, which as above are not set at all in the EU, EEA, UK or Switzerland.

Who Processes Your Data

• ACRCloud: audio fingerprints derived from your mixes are sent to ACRCloud's automatic content recognition API to identify tracks, and may be processed under their own privacy policy. See acrcloud.com.
• Stripe: payments and card details.
• PostHog: analytics and session recording.
• Postmark: your email address, to send sign-in, verification and password-reset email.
• Vercel (site hosting), Hetzner (our servers and database) and Cloudflare (DNS and SSL).

Where Your Data Goes

Our servers and our analytics are in the United States, so using setlist.id from elsewhere means your data is transferred there. For visitors in the EU, EEA and UK, those transfers are covered by the standard contractual clauses in our providers' data processing agreements.

How Long We Keep It

• Account data and job history: while your account is active.
• Session recordings: 30 days.
• Analytics events: up to 7 years.

Deleting your account removes your account data and cancels any subscription. Analytics already collected is not purged automatically, so email us and we will delete it.

Your Rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. Where we rely on your consent you can withdraw it at any time. Email play@setlist.id and we will action it.

If you are in the EU, EEA or UK and you think we have got something wrong, you can also complain to your national data protection authority.

Changes

We may update this policy. Changes are posted here with a new date.