Privacy Policy

1. Who is responsible

Xania Media, Rue du Général Fleury 29, 7700 Mouscron, Hainaut, Belgium, VAT BE0875444103, is the controller of the personal data described here. Contact us at info@xanawave.com or +32 488 03 76 04.

Two different relationships exist on this platform, and it matters which one you are in. When you hold an account with us, we are the controller of your data. When your listeners interact with your station — a song request, a heart on a track, a question during a live show — you are the controller of that data and we process it on your behalf.

2. What we collect from account holders

Account details: your name, email address, password (stored hashed, never readable), time zone, country, and any company name, VAT number and billing address you provide for invoices.

Content you upload: audio files and their metadata, artwork, station names and descriptions, playlists, schedules, recordings of live shows, and the text of any voice announcements you generate.

Usage data: which pages you open, what you change, and when. Server logs record your IP address, browser and the time of each request.

Payment data: we never see or store your card number or bank details. Our payment provider handles those. We keep the payment reference, the amount, the date and the invoice.

Support conversations: what you write to us, and the technical context attached automatically to a ticket — your plan, station status, track count and hours used — so we can answer without asking you to repeat it.

3. What we collect from listeners

Listeners can use a station without an account and without identifying themselves. We collect:

Anonymous listening statistics: how many people are connected, for how long, and which tracks played. These feed the station's audience figures.

Song requests: the track requested and, if the listener chooses to type them, a name, a dedication and a short message. The IP address is stored briefly to prevent one person flooding a station with requests.

Reactions: a heart on a track, recorded against the track, not the person.

Questions during live shows: the question, an optional name, and a technical fingerprint used only for rate limiting.

Names and messages a listener types are shown publicly on the station page and in the station's mobile app, because that is the point of a dedication. We say so on the form.

4. Why we process it, and on what legal basis

To provide the service — running your station, storing your files, showing your page. Legal basis: performance of our contract with you.

To bill you — subscriptions, invoices, VAT. Legal basis: contract, and our legal obligation to issue and keep invoices.

To keep the platform working and secure — logs, abuse prevention, rate limiting, monitoring. Legal basis: our legitimate interest in a service that stays up and is not abused.

To contact you about your service — an outage, a station that stopped, hours running low, an invoice. Legal basis: contract. These are not marketing and you cannot unsubscribe from them while you hold an account.

To improve the service — aggregated usage patterns, never individual snooping. Legal basis: legitimate interest.

We do not sell personal data. We do not profile you for advertising. We do not use your audio to train anything.

5. How long we keep it

Account and content: while your account is open, and 30 days after it closes. Backups age out within 6 months.

Invoices and payment records: 7 years, as Belgian tax law requires.

Listening statistics: detailed snapshots for 90 days, then aggregated figures without any identifier.

Server logs: 30 days.

Song requests and live-show questions: as long as the station keeps them; station owners can delete them at any time.

Support tickets: 2 years, because the same question often comes back.

6. Who else is involved

Running this service means relying on a few other companies. Each one handles only what it needs to:

InterServer — the servers the platform runs on, including your audio files and the database. Located in the United States.

Mollie — payments, subscriptions and mandates. Netherlands. They receive your name, email and payment details; we never see the card itself.

Our mail server — outgoing email, operated by us on hosting in the United States. Receives your email address and the content of what we send you.

OpenAI — only if you use AI voice announcements, the virtual presenter or language detection, or when ElevenLabs does not answer on the Imaging page. It receives the text to be spoken and, for language detection, a short excerpt of the track.

ElevenLabs — only if you make sounds with a voice on the Imaging page, and only the text to be spoken.

Open-Meteo — only if you enable weather in the virtual presenter, and only your station's city coordinates. No personal data.

MyRadioApp — only if you build a mobile app. Receives your name, email, station names and stream addresses so the app can be created in your own name.

Some of these are in the United States. Transfers there rely on the European Commission's standard contractual clauses. We are candid about this because you should be able to weigh it: if that matters to your listeners, tell them.

7. Your rights

Under the GDPR you may ask us to show you the data we hold about you, correct it, delete it, restrict what we do with it, or send it to you in a portable form. You may object to processing based on legitimate interest, and withdraw consent where consent is what we relied on.

Write to info@xanawave.com and we will answer within one month. We will not charge you for it, and we will not make it difficult.

If you think we have handled your data badly, you may complain to the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, or to the authority in the country where you live. We would prefer you told us first.

8. If you run a station here

Your listeners' data belongs to you, and we process it on your instructions. In practice this means you decide whether to enable song requests, whether to take questions during a live show, and what happens to what people send you.

That comes with duties on your side: your listeners should be able to find out how you handle their data, and if a listener asks you to delete a dedication, you should be able to do it — the panel lets you.

If you need a formal data processing agreement, ask and we will provide one.

9. Security

Traffic is encrypted with HTTPS. Passwords are hashed and cannot be read by anyone, including us. Two-factor authentication is available and we recommend it. Backups are encrypted. Access to production systems is limited to those who need it.

No system is perfect. If a breach affects your personal data, we will tell you and the supervisory authority as the law requires, and we will tell you what actually happened rather than hiding behind language.

10. Cookies

We use very few, and none for advertising. Details are in our Cookie Policy.

11. Children

The service is not intended for children under 16. We do not knowingly collect their data. If you believe a child has given us personal data, tell us and we will remove it.

12. Changes

When this policy changes we update the date above. If a change materially affects how we handle your data, we email you before it takes effect.