Privacy policy
Which personal data Houselist processes, why, and what rights you have.
Draft: this text has not been reviewed by a lawyer yet.
Controller
Modgift ApS, CVR DK46722779, Fenstenvej 10, DK-8300 Odder, is the controller. Write to [email protected] about anything to do with your personal data.
Clients: account and venue
When you create an account, we process your email address and what you enter about the venue: name, address on Houselist, logo, playlists and images. The purpose is to provide the service, and the legal basis is the contract with the client (GDPR Art. 6(1)(b)).
Clients: payment and invoices
For invoices we process the company name, CVR number, address, postcode and city, and invoice email. Card payments happen at our payment provider Frisbii; we never see or store card numbers. The legal basis is the contract and our bookkeeping obligations (Art. 6(1)(b) and (c)).
The audience on public pages
The audience has no account. Public playlist pages set no cookies, use no tracking and load nothing from anyone but Houselist until you tap a button yourself.
If you tap "Listen on Apple Music", the page loads Apple’s MusicKit and you sign in with Apple. What happens next is covered by Apple’s privacy policy.
Error log
If an error happens on the server, we store one line about it: the time, the address without query parameters, the status code, the country and the browser’s full user agent. We never store IP addresses, cookies or email addresses in the log. The purpose is to run and secure the service, and the legal basis is our legitimate interest in it working (Art. 6(1)(f)). The log is deleted after 1 year.
Protecting sign-in
The sign-in page uses Cloudflare Turnstile to keep bots out. Turnstile sees technical information about your browser. The legal basis is our legitimate interest in protecting the service (Art. 6(1)(f)).
Who we share data with
We use these processors and providers:
- Cloudflare: hosting, delivering the pages, the error log and Turnstile.
- Supabase: database and sign-in (EU, Ireland).
- Resend: emails with the sign-in link and code.
- Frisbii: subscriptions, card payments and invoices (Denmark).
- Google Workspace: email to and from us.
- Apple Music and TIDAL: playlists are published from Houselist’s accounts; the services get the playlist’s content, not the client’s personal data.
We never sell personal data.
Transfers outside the EU
Some providers (for example Cloudflare, Resend and Google) may process data in the United States. Transfers rely on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.
How long we keep data
- Account and venue: until the account is deleted. Deleting the account deletes the venue, playlists, images, logo and sign-in at once; the playlists are hidden on the streaming services.
- Invoices: 5 years after the financial year, as the Danish Bookkeeping Act requires. They are kept at Frisbii.
- Error log: 1 year.
- Database backups: overwritten within 7 days.
Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability, and you can object to processing based on legitimate interest. Clients can download their data as a ZIP and delete their account themselves. Write to us for anything else.
You can complain to the Danish Data Protection Agency (Datatilsynet), datatilsynet.dk.
Changes
If we change this policy materially, we tell clients by email.