Privacy Policy
Last updated: April 15, 2026
1. Data controller
The data controller for personal data collected through the Starify service (starify.pinc.be and its mobile-optimized interfaces) is:
Pinc Consulting SRL Avenue Louise 65/11 1050 Brussels, Belgium Company number (BCE/KBO): 0742.706.135 Email: starify@pinc.be
2. Data we collect
2.1 Data collected automatically (website and app visitors)
When you visit the Starify website or use the app, we automatically collect:
- IP address (anonymized);
- Browser type and version, or mobile device type and OS version;
- Pages or screens visited and duration of the visit;
- Referring website.
This data is collected through cookies and analytics tools in order to operate, secure and improve the Service.
2.2 Data you provide when creating an account
When you create an account or use the Service, we collect:
- Email address (required for account creation and sign-in);
- First and last name or display name;
- Profile picture (optional);
- Instrument, voice part or role in your band or choir (optional).
2.3 Content you create in Starify
When you use the Service, we store the content you create or upload, which may include:
- Audio files — clips, reference recordings and demos you upload and attach to songs. Audio files may indirectly contain personal data (voice recordings);
- Song metadata — titles, structures (intro / verse / chorus), tempos, keys, notes;
- Song lyrics — text you add to a song;
- Setlists, rehearsal dates and scheduling information;
- Comments and annotations you leave on songs or setlists.
This content is stored for the purpose of delivering the Service to you and the members you collaborate with.
2.4 Public band directory
Bands and choirs that use Starify are listed in a public directory accessible to visitors of starify.pinc.be.
- Free Band plan: the directory shows basic information about the band — typically the band name, location and a short description.
- Pro Band plan: the directory shows detailed information along with a contact option allowing visitors to reach the band.
Directory publication is enabled by default when you create a band. You can opt out at any time from your band settings; opting out removes the band’s listing from the directory within a reasonable delay but does not affect the band’s private workspace data.
Information published in the directory is considered public and may be indexed by search engines.
2.5 Collaborative data within a band or choir
Starify is collaborative by design. When you join or create a band/choir workspace:
- other members of that workspace can see your display name, profile picture, role and the content you share within the workspace (songs, setlists, audio clips, comments);
- depending on permissions set by the workspace administrator, members may also see the email address you used to accept an invitation.
Data shared within a workspace is visible only to members of that workspace, not to other Starify users or to the public.
2.6 Data collected via Paddle (payments)
When you subscribe to a paid plan, the payment is processed by Paddle.com Market Limited, acting as Merchant of Record. In this context, Paddle collects and processes:
- Payment information (credit card, PayPal or other payment method);
- Billing address;
- Email address;
- Country and tax information (for VAT calculation).
We do not have access to your full payment details (for example, your full card number). Paddle only provides us with the information necessary to deliver and manage your subscription: your name, email, country and order details.
The processing of your payment data by Paddle is governed by Paddle’s privacy policy.
3. Purposes of processing
We process your data for the following purposes:
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your user account | Performance of a contract (Art. 6(1)(b)) |
| Providing the Service (storing songs, audio, setlists, enabling collaboration) | Performance of a contract (Art. 6(1)(b)) |
| Processing orders, trials and renewals via Paddle | Performance of a contract (Art. 6(1)(b)) |
| Retention of billing data | Legal obligation (Art. 6(1)(c)) |
| Securing the Service and preventing abuse | Legitimate interest (Art. 6(1)(f)) |
| Improving the Service through analytics | Legitimate interest (Art. 6(1)(f)) |
| Sending service-related communications (account, billing, security) | Legitimate interest (Art. 6(1)(f)) |
| Sending marketing communications | Consent (Art. 6(1)(a)) |
| Publishing band listings in the public directory | Legitimate interest (Art. 6(1)(f)), with opt-out available |
4. Data sharing
We never sell your personal data. We share your data only with:
- Other members of your band or choir workspace, as described in Section 2.5;
- The general public, via the band directory, as described in Section 2.4 (only for bands that have not opted out);
- Paddle.com Market Limited (Merchant of Record), for payment processing, billing and tax collection. Paddle acts as an independent data controller for payment data. See Paddle’s privacy policy;
- Service providers (hosting, email delivery, analytics, error monitoring), strictly to the extent necessary to operate the Service and under data processing agreements compliant with the GDPR;
- Public authorities, where required by law.
All our service providers for content and account data are based in the European Union.
5. Data retention
| Type of data | Retention period |
|---|---|
| Account data (profile, credentials) | Duration of the account + 12 months after deletion |
| User content (songs, setlists, audio files, lyrics, comments) | Duration of the account; permanently deleted within 30 days after account deletion |
| Workspace membership data | Until you leave the workspace or the workspace is deleted |
| Public directory listing | Until the band opts out or is deleted |
| Billing data | 7 years (Belgian legal requirement) |
| Payment data (held by Paddle) | In accordance with Paddle’s retention policy |
| Server logs | 12 months maximum |
| Browsing data (cookies) | Maximum 13 months |
| Marketing communications | Until withdrawal of consent |
Audio files are stored encrypted at rest and deleted along with the rest of your content on account deletion.
6. Cookies
The Starify website uses cookies for the following purposes:
| Type of cookie | Purpose | Duration |
|---|---|---|
| Strictly necessary cookies | Operation of the Service, authentication, language preferences | Session or 12 months maximum |
| Analytical cookies | Audience measurement and Service improvement | 13 months maximum |
| Marketing cookies | Only with your explicit consent | 13 months maximum |
You can manage your cookie preferences at any time through the cookie banner or your browser settings. Refusing analytical and marketing cookies does not affect the core functioning of Starify.
7. International data transfers
Your account data and user content (including audio files) are hosted within the European Union.
Paddle, as Merchant of Record based in the United Kingdom, may process certain payment data in the United Kingdom, a country that benefits from an adequacy decision by the European Commission.
If transfers to other countries become necessary (for example, for a specific support tool), they will be safeguarded by appropriate measures in accordance with the GDPR (standard contractual clauses, adequacy decisions) and disclosed in an updated version of this policy.
8. Your rights
Under the GDPR, you have the following rights:
- Right of access: obtain a copy of the personal data we hold about you;
- Right to rectification: correct inaccurate or incomplete data;
- Right to erasure: request the deletion of your personal data;
- Right to restriction: request the restriction of the processing of your data;
- Right to data portability: receive your data in a structured, machine-readable format;
- Right to object: object to processing based on legitimate interest;
- Right to withdraw consent: withdraw your consent at any time, without affecting the lawfulness of prior processing.
To exercise these rights regarding the data we hold, contact us at: starify@pinc.be.
To exercise your rights regarding payment data held by Paddle, please refer to Paddle’s privacy policy or contact Paddle directly.
We will respond to your request within 30 days.
9. Security
We implement appropriate technical and organizational measures to protect your personal data:
- Encryption of data in transit (HTTPS/TLS);
- Encryption of data at rest, including audio files;
- Strict access controls and role-based permissions within workspaces;
- Hosting within the European Union;
- Regular backups and monitoring.
10. User-generated content and third-party rights
Starify allows you to upload content that may include material owned by third parties, such as copyrighted lyrics, sheet music or reference recordings. You are responsible for ensuring you have the necessary rights to upload and share this content with your workspace members.
The Terms of Use describe our notice-and-takedown procedure for rightsholders who believe their work has been uploaded without authorization.
11. Complaints
If you believe that the processing of your data does not comply with the GDPR, you may file a complaint with the Belgian Data Protection Authority:
Belgian Data Protection Authority (DPA) Rue de la Presse / Drukpersstraat 35 1000 Brussels, Belgium https://www.dataprotectionauthority.be contact@apd-gba.be
You also have the right to lodge a complaint with the supervisory authority of your country of residence.
12. Changes
We reserve the right to modify this Privacy Policy at any time. The date of the last update is indicated at the top of this page. In the event of a substantial change, we will notify you by email or through a visible notice on the Service.