1. Who We Are
The data controller is Steven Birring trading as Stackbase / FreqBlog. ICO registration number: CSN0293296.
This policy covers all products operated via freqblog.com and its subdomains: the freqblog.com website and the Music Metadata API (api.freqblog.com).
Contact us at [email protected] for any privacy-related queries.
2. What We Collect
| Data | Why we collect it | Legal basis (UK GDPR) | Retention |
|---|---|---|---|
| Email address & name | Music API account creation; to contact you about your account or service changes; to deliver purchased products | Contract performance (Art 6(1)(b)) | Duration of account + 12 months |
| API keys & usage logs | To issue and manage Music API keys. Each API call records the endpoint, timestamp, HTTP status and the query parameters you sent (for example a track title, artist name or ISRC), plus a one-way hash of the query. Used for rate limiting, abuse detection, answering your support questions, and service monitoring | Contract performance / Legitimate interests (Art 6(1)(b)/(f)) | 60 days rolling for request logs; key data held for duration of subscription + 12 months |
| Origin IP address | One IP address per API key — the address seen at signup, or on the first authenticated call for keys created through checkout — is recorded against that key, to detect abuse and to identify a single person operating multiple free accounts. | Legitimate interests (Art 6(1)(f)) | Held for the life of the key |
| Request IP address | The IP address of each authenticated API call is recorded against that call, to detect abuse and to identify an API key that has been leaked or shared — one key being used from many unrelated networks. It is also used to derive an approximate country for fraud review. It is not used to profile you, to target advertising, or for any purpose other than security and abuse prevention. | Legitimate interests (Art 6(1)(f)) | 60 days rolling, deleted with the request log |
| Webhook destination URL | If you configure a webhook, the destination URL you supply is stored against your key so we can notify it. The signing secret is derived per delivery and is never stored. | Contract performance (Art 6(1)(b)) | Until you change or remove it, or the key is deleted |
| Subscription records | Subscription ID, billing email address, plan tier, status and billing-period dates — to run your subscription, apply the right quota, and handle renewals and cancellations | Contract performance (Art 6(1)(b)) | As required by UK tax law (7 years) |
| Uploaded audio files (API) | To analyse a file you send to /analyze, or identify a clip you send to /identify. The audio is held only in memory or a short-lived temporary file while it is processed. For /identify, an audio fingerprint (a short numeric summary, not the audio) and the clip’s duration are sent to AcoustID to find the matching recording. |
Contract performance (Art 6(1)(b)) | Deleted as soon as processing completes, before the response is sent |
| Billing information | To process subscription and one-off payments. Card details are handled directly by Stripe — we never see or store card numbers. | Contract performance (Art 6(1)(b)) | As required by UK tax law (7 years) |
| Email preferences & delivery records | Whether you have unsubscribed from tips and usage emails, and the delivery events our email provider reports for messages we send you (sent, delivered, delayed, bounced, marked as spam), with the subject line and bounce reason. Used to honour your opt-out, to stop emailing addresses that bounce or complain, and to keep our email deliverable | Legal obligation to honour opt-outs (PECR) / Legitimate interests (Art 6(1)(c)/(f)) | Opt-outs and bounce/complaint suppressions are kept for as long as we hold your address, so we never email you again by mistake; delivery events 12 months |
| How you found us | The website that referred you to freqblog.com (its hostname only, e.g. google.com — never the full page address) or the campaign tag on the link you followed (e.g. utm_source=chatgpt.com), recorded against your API key when you sign up or subscribe. Used only to understand which channels bring us customers | Legitimate interests (Art 6(1)(f)) | Held for the life of the key |
| Abuse and multi-account checks | Signals derived from the data above — signup and request IP addresses (including the network an IPv6 address belongs to), signup timing, email-address patterns, request patterns such as which tracks or artists are requested, and quota usage — to detect one person operating several free accounts or a leaked key. See “Automated account checks” below | Legitimate interests (Art 6(1)(f)) | Follows the underlying data. If a free-signup ban is applied, the email address is kept on the ban list until the ban is lifted; an IP-address ban expires after 90 days |
| Email enquiries | To respond to messages you send to [email protected] | Legitimate interests (Art 6(1)(f)) | 12 months |
We do not collect payment card details (handled by Stripe), phone numbers, or any other personal data beyond the above.
Emails we send
We send three kinds of email to the address on your API key:
- Account and billing emails — your key, sign-in and verification messages, receipts, payment problems, security notices and changes to these terms. These are part of the service and can’t be switched off while you have an account.
- Track notifications — a summary of tracks we’ve analysed or added for you. Switch them off any time under Notifications on your dashboard.
- Tips and usage reminders — a short series of getting-started emails after you sign up, reminders when you’re close to or at your monthly quota (which may mention our paid plans), and occasional help emails when your requests are failing in a way we can see how to fix. Every one of these carries a one-click unsubscribe link, and unsubscribing doesn’t affect your key or the emails above. We send these because you signed up for the service, on the basis of our legitimate interests and the “soft opt-in” in regulation 22 of the Privacy and Electronic Communications Regulations.
Automated account checks
The free tier allows one key per person. To enforce that, an automated check looks for one person running several free accounts — for example, a key that reaches its monthly limit followed immediately by another account starting the same work from the same network. When the check is confident, it may revoke the free keys involved and stop that email address from creating new free keys. It never acts on a paid key or on an account linked to one, and it does not ban by IP address on its own.
If you think a check has got it wrong, email [email protected]. A person will review it, and we’ll restore your access if it was a mistake. You can also object to this processing (see Your Rights).
3. Cookies
The freqblog.com website uses a small number of cookies. We ask for your consent before any non-essential cookies are set, via the banner shown on your first visit.
| Cookie | Purpose | Type | Retention |
|---|---|---|---|
__cf_bm | Cloudflare bot management / DDoS protection | Strictly necessary | 30 minutes |
_ga, _ga_* | Google Analytics 4 — aggregated page-view and traffic-source statistics. Set only after you click “Accept” on the cookie banner. | Analytics (consent) | Up to 2 years |
| Session cookie | Keeps you signed in to your dashboard / account area (api.freqblog.com/dashboard). Set on the api.freqblog.com domain, not on freqblog.com. | Strictly necessary | Session |
fb_utm_*, fb_ref (browser session storage, not a cookie) | Remembers the campaign tag or referring website you arrived from, so it can be attached to your API key if you sign up or subscribe later in the same visit. Set only after you click “Accept” on the cookie banner, and cleared if you withdraw consent. Nothing is sent to us unless you sign up or subscribe. | Attribution (consent) | Until you close the tab |
You can withdraw analytics consent at any time by clicking the “Cookie settings” link in the footer, or by clearing your browser cookies for this domain. Declining does not affect the service.
4. Who We Share Data With
We do not sell, rent, or share your personal data with third parties for marketing purposes. Data may be shared only in the following circumstances:
- Payment processors — when card billing is enabled, payments are handled by Stripe, Inc. Your card details go directly to Stripe; we never see or store them. See Stripe's Privacy Policy.
- Infrastructure providers — our servers are hosted by Hetzner Online GmbH in Helsinki, Finland (EU). Hetzner processes data only as necessary to provide hosting services under their Data Processing Agreement.
- Analytics — where you have given consent, Google Analytics 4 (Google Ireland Ltd) records aggregated traffic statistics. We use IP anonymisation and do not use Google’s advertising features. Data is processed in the EU under Google’s Standard Contractual Clauses.
- Network & security — freqblog.com and api.freqblog.com are served through Cloudflare, Inc., which terminates TLS and filters malicious traffic. Cloudflare therefore processes the IP address and request metadata of every visit. See Cloudflare's Privacy Policy.
- Email — all the emails described above are delivered by Resend, which processes your email address and the message content, and reports delivery events (delivered, bounced, marked as spam) back to us. See Resend's Privacy Policy.
- Audio identification — when you call
/identify, an audio fingerprint and the clip’s duration (not the audio, and nothing that identifies you) are sent to AcoustID to look up the recording. - Uptime monitoring — UptimeRobot probes our public health endpoints from outside our network. It receives no customer data; it is listed here for completeness.
- Backup storage — daily archives are encrypted on our own server with
agebefore upload, then stored on Google Drive. Google holds only ciphertext and cannot read the contents. - Legal obligation — if required by law, court order, or regulatory authority.
5. International Transfers
Your data is stored on servers located within the EU (Hetzner, Finland). Some of the processors listed above are US-based and may process data outside the UK/EEA under Standard Contractual Clauses: Google Analytics 4 (only where you have consented), Cloudflare (which routes and filters traffic through its global network), Stripe (payments), and Resend (transactional email). Our off-host backups are encrypted on our own server before upload, so the storage provider holds ciphertext only. We do not transfer personal data outside the UK or EEA for any other purpose.
6. Your Rights
Under UK GDPR you have the following rights regarding your personal data:
To exercise any of these rights, email [email protected]. We will respond within 30 days at no charge.
7. Complaints
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK's data protection authority:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113
8. Changes to This Policy
We may update this policy from time to time. We will notify active API users by email before material changes take effect. The "last updated" date at the top of this page will always reflect the current version.
9. Contact
For any privacy-related questions, contact us at [email protected].