Legal

Privacy Policy

Version 1.3 · In force from 23 October 2026 (new: seller pages and messages to sellers, the feedback form)

This policy covers VinylDesk Collector, VinylDesk DJ and VinylDesk Sales (on the web and in our Android app), VinylDesk Pay and vinyldesk.com — together "VinylDesk", one account and one service.

Who is responsible for your data (the controller): VinylDesk, Amerstraat 27, 4535 CK Terneuzen, The Netherlands, billing@vinyldesk.com, Chamber of Commerce (KvK) 66743214, VAT number NL001769761B12.

What we collect

• Account data: your email address and a securely hashed password. We never store your password in plain text.
• Sign in with Google (Android app): if you choose "Continue with Google", Google tells us your email address, your name and a Google account identifier, and confirms that you are who you say you are. We never receive your Google password and we do not ask for any other Google data. An account made this way has no password until you ask for one with "Forgot password".
• Collection & listing data: the records, tracks and sale items you add or sync — titles, artists, condition, genre, and photos you upload of labels, sleeves or listings.
• Discogs data: if you connect your Discogs account, we sync your existing Discogs collection and wantlist so you can browse and use it inside VinylDesk.
• Billing data: if you subscribe on the website, payment is handled directly by our payment processor, Stripe — VinylDesk does not see or store your full card details. If you buy a plan or AI Credits in the Android app, Google Play takes the payment; we receive from Google the purchase reference, the plan, the period and its status (active, cancelled, refunded), never your card or bank details.
• Usage data: basic technical logs (like error reports and IP addresses in server logs) needed to operate, secure and troubleshoot the service.
• Checkout records: what you ordered, the consent you gave at checkout (with time, IP address and browser), your billing country (for VAT), payments, refunds and withdrawals.
• Support: the messages you send us.
• Feedback: what you write in the feedback form on vinyldesk.com/feedback/ (and your name and email address if you fill them in), so we can improve VinylDesk.

Why we use it (legal basis)

• To provide VinylDesk to you (your account, your data in the apps, syncing, AI features you choose, subscriptions and payments) — performance of our contract with you.
• To keep invoices, payments, VAT and checkout records — legal obligation (Dutch tax law requires us to keep these for 7 years).
• To keep VinylDesk secure and working (server logs, preventing abuse) — our legitimate interest in a safe, reliable service.

Seller pages and messages to sellers

• If you switch on your shop (Sales > My shop), we publish on vinyldesk.com: your shop name, your town and country, the records you offer with their photos, details, condition and price, what you write about yourself and about shipping, and only the contact details you choose to show (email address, phone, WhatsApp). If you sell as a trader, the law requires us to also show your business name, trade register number, VAT number (if given) and business address. Your account email address is never shown. We do this to provide the shop you asked for (performance of our contract with you); switch the shop off and your page disappears from our site within about 15 minutes. Search engines may keep a copy for a while.
• If you send a seller a message ("I want this record"), we store your name, email address, message and any offer, and email them to the seller so they can answer you directly. The seller then has your email address and handles it under their own responsibility. We keep the message for 12 months to deal with problems and abuse, then delete it. Legal basis: carrying out your request (and our legitimate interest in preventing abuse).
• Conversations. After the first message, buyer and seller can write to each other in the VinylDesk app or, for the buyer, through a private link in the email we send. We store these messages with the conversation and send each new message to the other side by email and, if they use the app, as a phone notification. If you have a VinylDesk account with a confirmed email address that is the same as the one you gave as a buyer, the conversation also appears in your app. The buyer never sees the seller's email address through us.
• If you report a shop or a record, we store your report and, if you give it, your email address, to look into it and answer you. We don't tell the seller who reported them.
• The seller pages set no cookies and use no trackers.

How photos are used for AI features

When you use an AI-assisted feature (identifying a record or grading its condition), the photo you provide for that action is sent securely to our AI provider (Anthropic) to be analysed, and the resulting text (artist, title, condition, etc.) is returned to VinylDesk. Photos used only for identification or grading are not permanently stored by that process — a photo you separately choose to save with a record or listing is stored as part of your own collection/listing data, the same as any other photo you upload.

The Android app: camera, microphone and card payments

• Camera: used to scan barcodes and label QR codes and to take record photos. Scans are read on your phone; a photo only leaves your phone when you use an AI feature (see above) or save it with a record or listing.
• Microphone: used only when you tap "Record" in the DJ app to measure a track's BPM and key. The audio is analysed on your phone, is never uploaded and is not stored.
• BPM and key lookup: to look up a track's BPM and key, VinylDesk sends only the artist and title to GetSongBPM and Audiometa. No account or personal data is sent.
• Card payments with SumUp (Sales): if you take card payments at checkout, you sign in to your own SumUp account inside the app and the payment runs through SumUp's software. For this SumUp asks for Bluetooth (to reach your card reader) and for your phone's location (SumUp requires it to accept card payments). VinylDesk never sees card details; we only store that the sale was paid by card, the amount and SumUp's transaction code.
• Shared BPM/key catalogue: when those services don't know a track, VinylDesk can suggest the BPM and key other VinylDesk DJs stored for the same artist and title. Only those two values are shared, never who stored them or anything else from your crate.

Who we share data with

• Stripe — payment processing for subscriptions and AI Credit purchases on the website.
• Google Firebase Cloud Messaging — to deliver phone notifications in the Android app (for example a new message from a buyer or seller). Only a device code and the text of the notification pass through it.
• Google — if you use "Continue with Google" (it confirms who you are), and if you buy in the Android app (Google Play is then the seller and takes the payment, under Google's own terms and privacy policy).
• Anthropic — AI-assisted identification and condition grading, as described above.
• Discogs — only if you connect your own Discogs account, to sync your collection/wantlist.
• Discogs Wrapped — on www.vinyldesk.com/wrapped you can enter a Discogs username. We then read that public collection from Discogs, keep the result (the numbers and the card) for 24 hours so it loads quickly when shared, and count how many cards are made. No account, no email address and no cookie are involved.
• GetSongBPM and Audiometa — artist and title only, to look up a track's BPM and key in the DJ app.
• SumUp — only if you take card payments in the Sales app with your own SumUp account. The payment is between you, your buyer and SumUp, under SumUp's own terms and privacy policy.
• Spotify — artist and title only, to find the album for the player in the DJ and Collector apps. When you use the player, it is loaded from Spotify, under Spotify's own privacy policy.
• Our hosting and email providers — to run our servers and send account and billing emails, on our instructions only.
• We do not sell your data, and we do not use it for advertising.

Some of these providers (such as Stripe and Anthropic) are based in the United States. Where data leaves the EU, it is protected by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

• Your account and app data: for as long as you have an account. When you delete your account, it is deleted straight away (see below).
• Payments, invoices, VAT records, checkout consents and withdrawals: 7 years, as required by Dutch tax law — after account deletion without your name or email address.
• Messages to sellers and reports about shops: 12 months.
• Server logs: only as long as needed for security and troubleshooting.

Cookies

This site (including the seller pages, the record search and the feedback form) does not set any cookies and does not use tracking or advertising cookies. When you sign in to VinylDesk or to our checkout (pay.vinyldesk.com), we use a single, essential session cookie to keep you signed in, and the checkout remembers your language choice in your browser. Our payment processor, Stripe, may set cookies on the checkout to prevent fraud and process your payment. If you choose “Continue with Google” to sign in, Google's sign-in button is loaded from Google, which then acts under Google's own privacy policy. None of these require a consent banner because they are strictly necessary for the service you ask for.

Your choices

You can edit or delete your collection/listing data from within each app, disconnect your Discogs account at any time, and cancel your subscription in VinylDesk Pay, or in Google Play if you bought it there.

Under the GDPR you have the right to access your data, to have it corrected or deleted, to receive a copy in a common format, to restrict or object to its use, and to withdraw any consent. Email us to use these rights; we answer within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Deleting your account

You can delete your account yourself at any time: in the Android app under Settings → Delete account, or on the web at pay.vinyldesk.com (sign in, then "Delete account" at the bottom). You can also email us. In the app, an account that was made with Google and has no password is confirmed by choosing the same Google account once more. Deleting your account permanently removes your account and all data in Collector, DJ and Sales, including photos, and stops any subscription; a plan bought in Google Play is cancelled for you. Payment records are kept, without your name or email address, for as long as tax law requires.

Contact

Questions about this policy or your data: billing@vinyldesk.com.

Changes

If we change this policy in a way that matters for you, we email you before the change takes effect.