Privacy Policy

Controller

Numele firmei tale, Strada, cod poștal, oraș, Belgia, is the data controller for personal data processed through Xanawave. Contact: info@xanawave.com.

What we collect

• Account data: name, email, password (hashed), country, timezone.
• Billing data: plan, invoices and payment identifiers. Card details are handled by our payment provider and never reach our servers.
• Content: the audio files, artwork and text you upload.
• Technical logs: IP address and browser type, kept for security and abuse prevention.
• Listener statistics: we store counts and aggregated country data, not individual listener identities.
• Listener interactions: song requests and track reactions are stored with a one-way hash of IP and browser, so we can prevent duplicates without keeping the address itself.

Why we process it

To provide the service you asked for (contract), to bill you and meet accounting duties (legal obligation), to keep the platform secure and prevent abuse (legitimate interest), and to send service messages such as trial reminders and outage alerts.

Who else is involved

We use processors to run the service: our hosting provider, our payment provider, our email delivery provider, and — where you use the AI voice feature — a speech synthesis provider that receives the text you submit. We do not sell personal data.

How long we keep it

Account and content data are kept while your account is active and for 30 days after closure. Detailed listener statistics are kept for 30 days and then aggregated. Invoices are kept for as long as accounting law requires.

Your rights

You may request access, correction, deletion, restriction, portability, or object to processing, by writing to info@xanawave.com. You can also lodge a complaint with the Belgian Data Protection Authority.

Cookies

We use only cookies that are necessary to run the site: a session cookie and a security token. We do not use advertising or tracking cookies.

Where your data is stored

Xanawave runs on servers located in the United States, operated on our behalf by our hosting provider. This means your account details, your uploaded audio and the statistics generated by your station are stored and processed in the United States.

These transfers are covered by the European Commission's standard contractual clauses agreed with our hosting provider, together with technical measures including encryption in transit (HTTPS on every connection) and encrypted backups.

Other processors we rely on — payment, email delivery and, where you use the AI voice feature, speech synthesis — may also process data in the United States under the same safeguards.