Privacy policy
Draft. This text must be reviewed by a lawyer before the service launches.
Version 2026-10-23
Data controller
Divivity is responsible for the processing of personal data in the service Divivity Soundscape. We comply with the General Data Protection Regulation (GDPR).
What we store
- Email address and password (the password is stored encrypted as a hash, never in plain text).
- Sign-in and sessions: a random key, the time of sign-in and when the session expires, and IP addresses in the server operating logs.
- Usage: which channels and filters you listened to, when and for how long, linked to the account, plus your own choices and weekly schedule.
- Subscription: plan, status and renewal date, and a customer number at Stripe. Card details are handled by Stripe and are not stored by us.
- Email: when you request a new password we send an email with a link that is valid for one hour.
- Contact: what you write to us in email.
- Problem reports: if you send a report from the player we save your comment and technical details about the device and playback, linked to the account.
Why and legal basis
To create and run the account, let you sign in and listen, and handle payment and subscription (basis: contract). To meet accounting and tax rules (basis: legal obligation). To protect the service against misuse and intrusion, prevent accounts from being shared, and understand how the service is used so we can improve it (basis: legitimate interest). We do not sell personal data and do not use it for advertising or for automated decisions that affect you.
Cookies and browser storage
We only use necessary cookies: sid, which keeps you signed in, and lang, which remembers the language you chose. We also store some choices (such as the selected channel) in the browser local storage so the player works. This is necessary for the service and therefore needs no consent. We use no cookies or tools for tracking, third-party analytics or advertising, so no cookie banner is shown. If we add such things later, we will ask for your consent first. We count page views on the public pages, but only save the number per day and page, nothing about the visitor.
How long we keep data
Account details are kept as long as the account exists, and deleted at the latest twelve months after the subscription ended, unless you ask for earlier deletion. Sessions are deleted when they expire or when you sign out. Usage statistics and sign-in history are kept for 13 months and then deleted. Data required by accounting law (such as invoice records at Stripe) is kept for seven years.
Who processes data for us
The server runs at a cloud provider within the EU/EEA (Hetzner). Stripe handles payments and is independently responsible for its own processing under its own privacy policy. An email service company (Resend) sends our system emails, such as the password reset link. These companies may only process the data for our purposes and on our instructions, or for their own legal obligations. If data is transferred to countries outside the EU/EEA, this is done under the European Commission standard contractual clauses or other safeguards required by the GDPR.
Your rights
You have the right to know what data we hold about you and to get a copy, to have incorrect data corrected, to have data deleted, to restrict processing, to object to processing based on legitimate interest, and to receive the data you provided in a common format. Contact us and we will help, normally within one month. You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.
Security and incidents
The connection is encrypted, passwords are stored as hashes and access to the server is restricted. If a security incident affects your personal data, we will notify you and IMY in the way and within the time the GDPR requires.