PLAY IT / PRIVACY

Privacy Policy.

Effective: 17 October 2026

PLAY IT GROUP, CVR 42169048, Finlandsvej 69, 4. tv, 7100 Vejle, Denmark (“PLAY IT”, “we”, “us”) operates the PLAY IT website and live music-request service. This policy describes the data the current product actually uses.

1. Data we receive

• Account data: name, email, operational contact email, phone when supplied, DJ, venue, or Other profile details, business name, city, country, selected plan, request price, currency, logo, and account status.
• Authentication data: a scrypt password hash (not the password), hashed bearer session records, expiry, and login/logout metadata. Password-reset and email-verification records contain one-way token hashes and expiry.
• Social identity: when Google or Apple sign-in is used, the provider subject identifier, verified provider email, provider name, and limited profile name needed to create or link the same account. Apple may provide a private-relay address; the operational contact is collected separately when that address is unsuitable for room communication. We do not receive a social provider password.
• Guest request data: random guest identifier, venue room, song title, artist, artwork URL, amount, PaymentIntent identifier, request status, and lifecycle timestamps. Guests do not need a PLAY IT account.
• Payment and payout data: Stripe customer, subscription, connected-account, checkout, and webhook state. Stripe handles card and wallet details; PLAY IT does not store full card numbers.
• Acquisition and funnel data: first-party UTM/campaign parameters, landing path, anonymous acquisition identifier, role/auth/profile/onboarding event names, and timestamps. Values are normalized and limited to the fields needed for attribution and service operations; arbitrary request payloads are not retained.
• Newsletter and support: an email address and subscription/unsubscription timestamps when you join the newsletter or contact us.
• Technical data: IP address and request metadata in ordinary server, security, and payment-provider logs. Page analytics are described in section 2a.

2. Browser storage

The client-rendered customer and account flows use localStorage for the session token, venue/operator identity, pending payment recovery, guest identifier, selected language, and limited UI preferences. It is not a cookie and it is not a substitute for server authorization. Clearing storage can sign you out or remove local recovery state. The server remains authoritative for account sessions, payment, requests, and payouts.

2a. Analytics and your choices

• Cloudflare Web Analytics (always on): counts page views, referring sites, country, device type and page speed. It sets no cookies and stores nothing on your device; Cloudflare reports only aggregated figures to us.
• PostHog (only if you accept analytics): records which pages and buttons are used, including click maps and session replays in which every text field is masked. It stores identifiers named ph_* in a cookie and localStorage. Data is hosted in PostHog's EU region.
• Your choice is remembered in localStorage (privacy-choice) so we do not ask on every visit.
• Marketing: no advertising pixels are used at present; the switch stays off unless you turn it on.

Change your privacy choices at any time. Withdrawing consent stops PostHog and removes its identifiers from this browser.

3. Why we use it

• To create accounts, authenticate, recover passwords, and keep the correct venue room bound to the current session.
• To search songs, create and recover requests, display status, and operate the DJ queue.
• To create Stripe subscriptions, payment intents, captures, cancellations, refunds or releases, Connect onboarding, and payouts.
• To deliver QR codes, branding, dashboard reporting, support, security, fraud prevention, and service improvements.
• To send newsletter messages only when you subscribe, and to honour unsubscribe requests.
• To meet legal, accounting, tax, dispute, and payment-network obligations.

4. Legal bases and sharing

Depending on the context, processing is based on contract, legitimate interests in security, fraud prevention, acquisition measurement, and operation, legal obligations, or consent for optional newsletter, analytics and product-analytics choices. The signup analytics checkbox concerns optional browser product analytics; required account, security, onboarding, and aggregate funnel records may still be created to operate and protect the Service. We use these processors: Amazon Web Services (hosting, database and transactional email, EU region Frankfurt), Cloudflare (aggregated web analytics), PostHog (product analytics in the EU, only with consent), Stripe and Stripe Connect (payments and payouts), Spotify (song search and artwork) and Google or Apple when you choose to sign in with them. We share data with authorities or advisers only where the law requires it. We do not sell personal data.

5. Retention

We retain account, subscription, payout, request, and financial records for as long as needed to operate the Service, resolve disputes, meet legal and accounting obligations, and protect the platform. Session and reset records expire and are pruned. Newsletter records remain until you unsubscribe or request deletion, subject to lawful suppression records.

• Accounts: until you delete the account, then up to 30 days in backups.
• Payment, payout and accounting records: 5 years after the end of the financial year (Danish Bookkeeping Act).
• Song requests: as long as the account exists, because they form the venue’s request and payment history.
• Server and security logs: 90 days.
• Newsletter: until you unsubscribe.

6. International transfers and security

Our providers may process data outside the EEA under their own safeguards and contractual terms. We use HTTPS, hash passwords and bearer tokens, keep payment secrets server-side, validate OAuth state/nonce and provider identity tokens, and avoid returning raw secrets to browsers. No online system is risk-free; report suspected compromise to [email protected].

7. Your choices and rights

Subject to applicable law, you may ask for access, correction, deletion, restriction, portability, objection, or withdrawal of consent. Newsletter recipients can use unsubscribe. Contact us to exercise a right or ask which provider holds the relevant data. You may also complain to your local data-protection authority.

8. Children, venues, and guest responsibility

Account creation is for adults or the applicable age of majority. Venues and DJs must not submit guest or staff data they are not authorised to share. Guests should avoid placing unnecessary personal information in song notes or requests.

9. Updates and contact

We may update this policy when the Service or providers change and will publish the new effective date. Contact PLAY IT GROUP at [email protected] or Finlandsvej 69, 4. tv, 7100 Vejle, Denmark.