MusicSync ("we", "us", or "the Service") is a cloud-based music scheduling and playback platform operated from India. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using the Service you consent to the practices described below.
1. Who is the controller?
The controller of personal data processed through MusicSync is MusicSync, based in India, operating this Service at admin@musicsync.net. For any privacy-related questions, you may contact us at that address.
2. What we collect
2.1 Account and billing data
- Company name, contact name, email, phone number, role (tenant admin / manager / kiosk)
- Encrypted password hash (we never store plaintext passwords)
- Razorpay payment identifiers, subscription status and timestamps (we do not store card numbers, CVV, or UPI PIN — those are handled by Razorpay)
2.2 Operational data
- Store / kiosk metadata you create: names, locations, groupings, branding preferences
- Music-library metadata sourced from your connected Google Drive (file IDs, file names, mime types — never the audio content itself; audio streams directly from Drive to the kiosk)
- Playlists, dayparts, announcements, and play-history counters
- Kiosk heartbeats, current-track telemetry, and remote-command acknowledgments
- Feedback messages you submit in-app
2.3 Technical data
- Browser user-agent, IP address (retained for auth rate-limiting and abuse prevention)
- HttpOnly session cookies and a short-lived JWT stored in your browser
3. How we use your data
- To operate the Service (authentication, scheduling, kiosk sync, billing)
- To send transactional messages only (password-reset emails, webhook-triggered payment notifications, in-app alerts). We do not send marketing email.
- To comply with our contractual, tax, and legal obligations
- To detect, investigate, and prevent fraud or abuse
4. Legal basis (DPDP Act 2023 & GDPR)
We process your data on the basis of (a) contractual necessity — to deliver the service you signed up for; (b) your consent — for optional integrations such as Google Drive; and (c) our legitimate interests — in securing the Service and preventing abuse.
5. Sharing and sub-processors
We share data only with the minimum set of processors needed to deliver the Service:
- Razorpay Software Private Limited — payments
- MongoDB Inc. — hosted database storage
- Google LLC — Google Drive API (only for tenants who explicitly connect a Drive account)
- Namecheap / Private Email — transactional email delivery
- Hosting and CDN providers — to serve the web application
We never sell your data. We do not share data with advertisers.
6. Tenant isolation
MusicSync is a multi-tenant platform. All data you create is scoped to your tenant_id and cannot be accessed by other tenants or their users. Cross-tenant access is technically enforced on every API query.
7. Data retention
- Active account data — retained for the life of your account.
- Expired / cancelled accounts — data retained for up to 90 days to allow recovery; after that it is permanently deleted.
- Payment records are retained for 7 years to comply with Indian tax and audit law.
- Password-reset tokens expire 1 hour after issue and are single-use.
8. Your rights
You may at any time:
- Access, correct, or export the data we hold about you
- Request deletion of your account and associated data
- Withdraw consent for optional integrations (e.g., disconnect Google Drive)
- Lodge a complaint with the Data Protection Board of India or your local supervisory authority
Email admin@musicsync.net to exercise any of these rights. We will respond within 30 days.
9. Security
We use TLS in transit, bcrypt password hashing, HttpOnly + Secure cookies, scoped JWTs, role-based access control, and routine security monitoring. No system is perfectly secure — please keep your account password confidential.
10. Children
MusicSync is a B2B service and is not directed at individuals under 18. We do not knowingly collect data from minors.
11. Changes to this policy
We will post any material change to this policy on this page and notify tenant admins in-app. Continued use of the Service after an update constitutes acceptance.
12. Contact
Privacy questions: admin@musicsync.net.