Privacy Policy

Last updated: 17 August 2026

This Privacy Policy explains how Chillhop Music B.V. (“Chillhop”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you use our websites, apps and related services.

Please read this policy together with our Terms of Service. Additional terms apply to the Chillhop Creators programme and, where relevant, the Chillhop Music App.

1. Who we are

The data controller is:

Chillhop Music B.V.
Piet Heynsplein 7
3024 RH Rotterdam
The Netherlands
Chamber of Commerce (KvK): 69576610
VAT: NL857925374B01

Privacy contact: [email protected]
General contact: [email protected]

We decide why and how personal data is processed across the Chillhop Platforms described below. We do not sell your personal data.

2. What this policy covers

This policy applies to personal data processed in connection with the following properties and services (together, the “Chillhop Platforms” or the “Service”):

chillhop.com — our main website, music catalog, livestreams, community features and account area;
chillhop.city — our interactive web experience (including versions that are still under development);
app.chillhop.com — our web application and the authentication layer used by our mobile applications;
our official mobile applications that sign in through the same login API; and
related features that use the same Chillhop account, including playlists, likes, livestream presets, the Chillhop Creators programme, community programmes such as Pen Paws, in-product chat, and contact or newsletter forms.

shop.chillhop.com is operated as a separate webshop on a different platform and has its own terms and privacy notice. A Chillhop account on our Platforms is not the same as a shop account, even if you use the same email address.

This policy does not apply to third-party websites, apps or platforms that we do not control, including YouTube, Twitch, Spotify, Apple, Google, or social networks you use to sign in or share content.

3. Shared login and user statistics

The Chillhop Platforms use one shared login API and one shared user-statistics system.

If you create or use a Chillhop account on any of chillhop.com, chillhop.city, app.chillhop.com or a related mobile app, that account works across those Platforms. We store and process the following as a single account record:

your account profile (such as name, email address, avatar and preferences);
authentication data (including login codes, session tokens and linked sign-in providers);
your playlists, likes, presets and similar saved content;
creator status and linked YouTube or Twitch channels, if you join Chillhop Creators; and
user statistics — information about how you use the Platforms, including listening and playback activity, play counts, tracks or stations you interact with, session length, features you use, device or app type, referring Platform (for example whether you signed in from chillhop.com, chillhop.city or app.chillhop.com), and similar usage metrics.

We combine these statistics across the Chillhop Platforms so that your account, preferences and listening activity can follow you from one property to another, and so we can operate, secure, personalise and improve the Service as a whole. We do not treat each site as a separate, isolated user database.

Because this is one service operated by one controller, using any Chillhop Platform after you have an account means we may process your account data and user statistics in connection with the other Chillhop Platforms as well.

4. Personal data we collect

The data we collect depends on how you use the Service. We do not require you to create an account to browse publicly available pages, but many features need an account.

4.1 Data you give us

Account data — name, email address, password or email login code, marketing preference, avatar, and any profile information you choose to add.
Communications — messages you send through contact forms, support emails, feedback, reports, Pen Paws postcards, and in-product chat.
Creator data — if you join Chillhop Creators, information needed to verify eligibility and connect your channels, including YouTube or Twitch account identifiers, channel or video metadata made available through those platforms’ APIs, and accreditation information you provide.
Newsletter data — email address and related subscription settings if you sign up for marketing emails.
Programme data — information you submit for community programmes, contests, surveys or similar activities, as described at the time of collection.

4.2 Data we collect automatically

Usage and user statistics — as described in section 3, including pages or screens viewed, playback and interaction events, timestamps, and feature use across the Chillhop Platforms.
Technical data — IP address, approximate location derived from IP, browser type and version, device type, operating system, language, referring URL, and similar log data.
Cookie and similar data — identifiers stored on your device for authentication, security, preferences, analytics and, where you consent, advertising. See section 6.
Security data — information used to detect abuse, including reCAPTCHA signals and unusual login or traffic patterns.

4.3 Data from third parties

Sign-in providers — if you connect Apple, Google, YouTube, Twitch or another supported provider, we receive the identifiers and profile information that provider shares with us (typically a name, email address and account ID).
Analytics and advertising partners — aggregated or pseudonymous reports from tools such as Google Analytics / Google Tag Manager, if you have allowed those cookies.
Email service providers — delivery, open and similar engagement data from our email platform (currently Klaviyo) for messages we send.

We do not ask you to send us special-category data (such as health, political opinions or biometric data) and we ask you not to include that kind of information in forms or chat.

5. How we use personal data

We process personal data only where a legal basis under the GDPR (and, where applicable, the UK GDPR) applies.

Purpose	Examples	Legal basis
Provide the Service	Create and authenticate your account; keep you signed in across Chillhop Platforms; save playlists, likes and presets; operate livestreams, catalog, city and app features	Contract (GDPR Art. 6(1)(b))
Shared user statistics	Record listening and usage activity on one Platform and make it available on the others; show your history and preferences; understand how the Service is used	Contract, and legitimate interests in operating a unified service (Art. 6(1)(b) and (f))
Creators programme	Link YouTube/Twitch, verify use of our music, administer the licence	Contract (Art. 6(1)(b))
Security and abuse prevention	Login protection, reCAPTCHA, fraud and scraping detection, enforcing our terms	Legitimate interests (Art. 6(1)(f)); legal obligation where applicable
Communications about the Service	Login codes, password resets, account notices, material policy updates	Contract and/or legitimate interests
Marketing emails	Newsletters and promotional messages if you opted in	Consent (Art. 6(1)(a)); you may withdraw at any time
Analytics	Google Analytics / Tag Manager to understand traffic and improve the Service	Consent for non-essential cookies (Art. 6(1)(a)); otherwise legitimate interests where consent is not required
Advertising measurement	Advertising tags loaded via Google Tag Manager, only if you allow advertising cookies	Consent (Art. 6(1)(a))
Legal, tax and claims	Keep records, respond to lawful requests, establish or defend legal claims	Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f))

Our legitimate interests include running a secure music service, understanding how our Platforms are used, preventing misuse of our catalog, and growing a lawful audience. We do not use your data for automated decisions that produce legal or similarly significant effects about you.

You may withdraw consent at any time, for example by changing cookie settings, unsubscribing from marketing emails, or contacting us. Withdrawal does not affect processing that already took place, or processing that we continue on another lawful basis (such as keeping your account so the Service still works).

6. Cookies and similar technologies

We use cookies, local storage and similar technologies on the Chillhop Platforms.

6.1 Types we use

Strictly necessary — sign-in and session cookies, security tokens, load balancing, and storage of your cookie choice. These are required for the Service to work.
Preferences — remember settings such as theme or player state.
Analytics — Google Analytics via Google Tag Manager (container GTM-5RDJ2FV), used to measure visits, playback and feature use. Typical cookies include _ga, _gid and related Google identifiers.
Advertising — advertising or measurement tags that may be loaded through Google Tag Manager if you allow advertising storage. These may include Google advertising cookies.

6.2 Consent

When you first visit, we ask whether we may use non-essential cookies. Analytics and advertising storage stay off until you allow them. You can refuse. Refusing non-essential cookies will not stop you from browsing, but some measurement and personalisation will not run.

On chillhop.com this choice is stored locally in your browser (for example as cookieResponded / cookieGranted) so we do not ask on every page load. Clearing site data will reset that choice.

6.3 Managing cookies

You can also delete or block cookies in your browser. Blocking all cookies may prevent sign-in and other features from working. Helpful guides:

Google’s privacy policy is at https://policies.google.com/privacy. You can opt out of Google Analytics collection via the Google Analytics opt-out browser add-on.

We share personal data only as described in this policy.

Across Chillhop Platforms — as one controller, we use the shared login API and user-statistics system so your account works on chillhop.com, chillhop.city, app.chillhop.com and related apps.
Service providers (processors) — companies that host, analyse or send communications for us, under contract and only on our instructions. These currently include hosting providers, Google (Analytics, Tag Manager, reCAPTCHA, YouTube API), Klaviyo (email), and infrastructure or security vendors we use to run the Service.
Sign-in and connected platforms — Apple, Google, YouTube or Twitch, if you choose to connect them. Their use of your data is governed by their own policies.
Payment providers — if you buy something from us directly, we share only what is needed to process the payment. Purchases on shop.chillhop.com are handled by that shop and its payment providers (for example PayPal or Shopify Payments) under that shop’s notices.
Professional advisers and authorities — lawyers, insurers, accountants, or public authorities where required by law or to protect rights, safety or the Service.
Business transfers — if we reorganise, merge, or transfer assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards.

We do not sell personal data. We do not rent your email list. We do not allow third parties to contact you from a Chillhop enquiry unless you have asked us to make that introduction, or another legal basis applies and we tell you at the time.

If you post or send content that is visible to other users (for example a public display name, avatar, chat message or Pen Paws postcard), that content is shared with the people who can see that feature. Do not post information you want to keep private.

8. International transfers

We are established in the Netherlands. Some of our providers — including hosting, Google and Klaviyo — process data in the United States and other countries outside the European Economic Area and the United Kingdom.

Where we transfer personal data out of the EEA or UK, we rely on an adequacy decision where one exists or on appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where required), together with additional measures where appropriate.

You can ask us for more information about these safeguards by writing to [email protected].

9. How long we keep data

We keep personal data only as long as needed for the purposes in this policy, including legal, tax and accounting duties.

Account, profile, playlists, likes, presets and user statistics — for as long as the account exists. If you delete your account, we delete or irreversibly anonymise this data within a reasonable period, except as set out below.
Login codes, session tokens and security logs — for a short period needed to authenticate you and investigate abuse.
Support and contact messages — for as long as needed to handle your request and for a limited period afterwards for follow-up and record-keeping.
Marketing lists — until you unsubscribe or your address becomes invalid, and for a short suppression period so we can honour the opt-out.
Creator and licence records — for the life of the licence and for as long as we need them to show what was licensed and to handle claims.
Legal and financial records — for the period required by Dutch law (often up to seven years for certain records).

Backups may take additional time to expire. We may retain limited information where we must do so to comply with law, resolve disputes, enforce our terms, or prevent abuse (for example an email address on a block list after a serious violation).

10. Security

We use technical and organisational measures appropriate to the nature of the data, including HTTPS, access controls, hashed or tokenised credentials where applicable, and staff access limited to what is needed. No method of transmission or storage is completely secure. You are responsible for keeping your email account and any password under your control, and for signing out on shared devices.

If we become aware of a personal-data breach that is likely to result in a high risk to you, we will notify you and the competent authority as required by law.

11. Your rights

If the GDPR or UK GDPR applies to you, you have the right to:

access the personal data we hold about you;
rectify inaccurate or incomplete data;
erase data in certain cases (including by deleting your account in the Service where that function is available);
restrict processing in certain cases;
object to processing based on legitimate interests, and to object at any time to processing for direct marketing;
data portability, where processing is based on consent or contract and is carried out by automated means;
withdraw consent where processing is based on consent; and
lodge a complaint with a supervisory authority.

You can update much of your account information while signed in. You can delete your account through the account-deletion flow in the Service, or by emailing us. Deleting your account on any Chillhop Platform deletes the shared account used on the others.

To exercise any other right, email [email protected] from the address on your account and tell us what you want. We may need to verify your identity. We will respond within the time required by law, normally one month.

These rights are not absolute. We may refuse a request where the law allows, for example where we must keep data for a legal claim or where the request is manifestly unfounded or excessive.

Our lead supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), https://www.autoriteitpersoonsgegevens.nl. You may also complain to the authority in your EU or UK country of residence or work.

12. Additional information for US residents

If you live in California or another US state with a comprehensive privacy law (including the CCPA/CPRA), this section applies in addition to the rest of this policy.

In the last 12 months we have collected the categories of personal information described in section 4, including identifiers, commercial or account information (if you use paid or licensed features), internet or electronic activity (user statistics and usage data), audio information you choose to upload or play in connection with the Service, and inferences drawn from usage to operate and improve the Service. We collect this information from you, from your device, and from the partners listed in section 4.3, and we use it for the purposes in section 5.

We do not sell personal information for money. We do not use or disclose sensitive personal information for purposes that require a right to limit under the CPRA. If you allow advertising cookies, some advertising or measurement tags may be treated as “sharing” or “targeted advertising” under US state law. You can opt out of that activity by refusing advertising cookies in our cookie notice, by using industry tools such as the Digital Advertising Alliance opt-out, and by emailing [email protected] with the subject line “US privacy request”.

You may request to know, access, correct or delete personal information, and you will not be discriminated against for exercising these rights. You may use an authorised agent if state law allows; we will need proof of authorisation. We will verify requests using your account email and additional information if needed.

Nevada residents may also request that we not sell covered information by emailing the same address. We do not sell covered information as Nevada law defines that term.

13. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you are under 16, do not create an account or send us personal data. If you believe a child has given us personal data, contact [email protected] and we will delete it.

14. YouTube API Services

If you use Chillhop Creators or otherwise connect a YouTube account, our API client uses YouTube API Services. By using that feature you also agree to the YouTube Terms of Service and Google’s Privacy Policy.

We use the API to connect your channel, read the channel or video information needed to operate the programme, and help us understand whether our music is used as required. You can revoke the client’s access at any time in your Google security settings. Revoking access or unlinking the account may end your ability to use the Creators programme.

15. Changes

We may update this policy to reflect changes to the Service, the Chillhop Platforms, or the law. We will post the updated policy on this page and change the “Last updated” date. If a change is material, we will give additional notice that is reasonable in the circumstances, such as a notice in the Service or an email to the address on your account. The updated policy applies from the date it is posted, unless a later date is stated.

16. Contact and complaints

Questions, requests or complaints about this policy or our use of personal data:

Chillhop Music B.V.
Attn: Privacy
Piet Heynsplein 7
3024 RH Rotterdam
The Netherlands
[email protected]

If you are not satisfied with our response, you may lodge a complaint with the Autoriteit Persoonsgegevens or another competent supervisory authority.