Privacy Policy

Last Updated: 31 July 2025

1. Introduction

Welcome to Drip App for Spotify ("the Service"), operated by Extra Paar Handen UG ("we", "us", "our"). We are committed to protecting your privacy. This Privacy Policy explains what personal data we collect from you, how we use it, and what rights you have in relation to it.

2. Data Controller

The entity responsible for processing your data (the "Data Controller") is:

Extra Paar Handen UG (haftungsbeschränkt)
Bocks Allee 9
32369 Rahden
Germany
Email: DripTool@beyondfreelancing.com

3. What Data We Collect and Why

When you connect your Spotify account, you authorize us to access and store certain information essential for the app's functionality. This includes:

• Spotify User Information: Your Spotify User ID, display name, email address, and profile image URL. We use this to create and manage your account, personalize your experience, and communicate with you.
• Spotify Authentication Tokens: We store encrypted access_token and refresh_token to securely interact with the Spotify API on your behalf. This is necessary to fetch your playlists and add tracks to your target playlists as part of the drip service. These tokens are stored encrypted at rest.
• Playlist and Track Information: We store information about your source and target playlists, including their names and IDs, as well as the list of tracks from your source playlist. This is the core data required to operate the drip schedules you configure.
• Notification Preferences: We store your chosen notification email address and your preferences for receiving emails (notify_on_drip, notify_on_complete, notify_on_updates) to send you transactional emails according to your settings.

4. Cookie Policy

Cookies are small text files stored on your device. We use cookies to provide and improve our Service.

• Strictly Necessary Cookies: We use a secure, HttpOnly session cookie named session_dripapp. This cookie is essential for the functionality of the Drip App. Its sole purpose is to identify your logged-in session and keep you authenticated as you navigate the application. For security during the initial login, we also temporarily use your browser's localStorage to store a state parameter (spotify_auth_state) to prevent Cross-Site Request Forgery (CSRF) attacks. This item is removed immediately after successful login.
• Tracking and Advertising Cookies: We do not use any cookies or local storage for tracking, analytics, or advertising purposes. Because the technology we use is strictly necessary for the service to function, we do not require your prior consent to place it.

5. Legal Basis for Processing

We process your data based on the following legal grounds under the General Data Protection Regulation (GDPR):

• Performance of a Contract (Art. 6(1)(b) GDPR): Most of our data processing is necessary to provide the service you signed up for, i.e., to create and execute your drip schedules.
• Consent (Art. 6(1)(a) GDPR): For sending you email notifications, we rely on the consent you provide by enabling the notification toggles in your settings. You can withdraw this consent at any time.
• Legitimate Interests (Art. 6(1)(f) GDPR): We may process data for security purposes or to improve our service, based on our legitimate interest to maintain a secure and functional application.

6. Data Sharing and Third Parties

We do not sell your personal data. We only share it with the following third-party service providers (sub-processors) who are essential for providing our service:

• Spotify: We interact with the Spotify API to access your data based on your authorization and to provide the core functionality of the app.
• Hetzner Online GmbH: Our application and database are hosted on servers provided by Hetzner. The servers are located in Helsinki, Finland (within the European Union), ensuring your data is protected under GDPR.
• Microsoft Outlook: We use Microsoft's services to send you transactional emails, such as drip notifications, if you have opted in.

7. Data Retention

We retain your personal data for as long as you have an active account with us. You can delete your account and all associated data at any time via the "Delete All My Data" button on the settings page. Furthermore, as a policy, data from inactive accounts will be deleted or anonymized after a period of one (1) year of inactivity.

8. Your Rights Under GDPR

You have several rights concerning your personal data:

• Right to Access: You can request a copy of the data we hold about you.
• Right to Rectification: You can correct inaccurate data (e.g., your notification email) in your settings.
• Right to Erasure (Right to be Forgotten): You can have your data permanently deleted using the "Delete All My Data" function in your settings.
• Right to Restrict Processing: You can request that we limit the processing of your data under certain conditions.
• Right to Data Portability: You can request a copy of your data in a machine-readable format.
• Right to Object: You can object to the processing of your data.

To exercise any of these rights, please contact us at DripTool@beyondfreelancing.com or use the tools provided on your settings page.

9. Data Security

We take the security of your data seriously and use appropriate technical and organizational measures, such as the encryption of sensitive data and secured (HTTPS) connections, to protect your data against loss, misuse, and unauthorized access.

10. Children's Privacy

Our service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have, we will take steps to delete such information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes. The "Last Updated" date at the top of this policy indicates when it was last revised.

12. Contact Us

If you have any questions about this Privacy Policy, please contact us at DripTool@beyondfreelancing.com.