New — automated music scheduling is now live on every planSee how it works
Legal

Privacy Policy

Last updated 6 June 2026

This Privacy Policy explains how Soundwaves (“we”, “us”, “our”) collects, uses, and protects personal data when you use our platform, websites, and services (the “Service”), and the rights you have over your information. We act as a data controller for the account and marketing data described below, and as a data processor for personal data contained in the content you broadcast through the Service.

1. Information we collect

Information you give us

  • Account data — name, email address, password, and organisation or station details when you register.
  • Billing data — plan selection and billing contact details. Card details are handled by our payment processor; we do not store full card numbers.
  • Content and configuration — the stations, audio, images, schedules, and settings you create in the Service.
  • Support and communications — messages you send us and your preferences.

Information we collect automatically

  • Usage and device data — IP address, browser and device type, pages viewed, and actions taken, collected through cookies and similar technologies. See our Cookie Policy for detail.
  • Log and diagnostic data — technical logs used to operate, secure, and troubleshoot the Service.

2. How we use your information

We use personal data to:

  • provide, operate, maintain, and improve the Service;
  • create and manage your account and process payments;
  • communicate with you about your account, security, and changes to the Service;
  • provide customer support;
  • monitor for, detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service;
  • comply with legal obligations and enforce our agreements; and
  • send marketing communications where you have consented or where we are otherwise permitted to, and you can opt out at any time.

3. Legal bases

Where data protection law such as the UK GDPR applies, we rely on the following legal bases: performance of our contract with you (to provide the Service); our legitimate interests (to secure, improve, and market the Service, and to prevent abuse); your consent (for certain cookies and marketing); and compliance with legal obligations.

4. How we share information

We do not sell your personal data. We share it only as needed:

  • Service providers — hosting, storage, content delivery, payment processing, email, and analytics providers who process data on our behalf under appropriate agreements.
  • Legal and safety — where required by law, or where we reasonably believe disclosure is necessary to protect our rights, our users, or the public, or to investigate abuse or unlawful activity.
  • Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

5. International transfers

We and our service providers may process personal data outside your country. Where we transfer data internationally, we use appropriate safeguards such as standard contractual clauses or transfers to territories with an adequacy decision.

6. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service. After your account closes, we delete or anonymise personal data within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, prevent abuse, or enforce our agreements.

7. Security

We use technical and organisational measures designed to protect personal data, including encryption in transit, access controls, and monitoring. No system is completely secure, so we cannot guarantee absolute security; you are responsible for keeping your account credentials confidential.

8. Your rights

Depending on your location, you may have the right to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us at [email protected]. You also have the right to complain to your local data protection authority — in the UK, the Information Commissioner’s Office (ICO).

Where we process personal data within content you broadcast on behalf of a station, the station operator is the controller of that data; please direct requests about it to the relevant operator.

9. Children

The Service is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

10. Changes to this Policy

We may update this Policy from time to time. If we make material changes we will take reasonable steps to notify you. The “Last updated” date above indicates when this Policy was last revised.

11. Contact

For any privacy questions or requests, contact us at [email protected].