Legal
Privacy Policy
Last updated: 18 September 2026
Spruv helps independent artists get their music onto curated Spotify playlists. This policy explains what personal data we collect when you use spruv.net, why we collect it, who we share it with, and the rights you have. We keep it as short and plain as we can.
1. Who we are
Spruv is run by Jonas Böös, a private individual in Sweden. He is the data controller for the personal data described here.
Questions about privacy go to hello@spruv.net.
2. What we collect
a) When you submit a track
- Your artist name and email address.
- The Spotify link to your track, and any other links you give us (website, Instagram, TikTok, shop).
- What you tell us about the music: genre, mood, influences, language, country, description, bio, and how the music was made (for example, AI-assisted).
- A profile photo, if you upload one.
b) When you have an account
- Your email address and sign-in details. Passwords are handled by our authentication provider, and we never see them in plain text.
- When you signed up and last signed in.
c) Information we fetch from Spotify about your music
Public information from Spotify about your artist profile and tracks: artist ID, profile image, follower count, popularity, genres, and recent releases. This is information Spotify already shows publicly.
d) If you connect your Spotify account
Your Spotify user ID, display name and email address, used only to match your Spotify account to your Spruv profile. You can disconnect at any time, and we then delete the stored connection.
e) Communication
Messages and feedback you send us, replies from our curators, and a record of the emails we send you and whether they were delivered.
f) Activity on Spruv
Your submission's status, which playlists it has been placed on and when, and referrals.
g) Technical information
Our hosting providers process your IP address and basic request data (such as browser type and the page requested) to deliver the site and keep it secure. We use a small amount of browser storage to keep you signed in and remember simple settings. See section 9.
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Reviewing your submission, placing your track on playlists, and telling you the outcome | Performance of a contract (the service you asked for) |
| Running your account and your artist dashboard | Performance of a contract |
| Adding and removing your track on our Spotify playlists | Performance of a contract |
| Showing your public artist page on spruv.net | Performance of a contract |
| Curator notes, internal ratings, and improving how we match music to playlists | Legitimate interest in running a good curation service |
| AI-assisted summaries and playlist suggestions (see section 4) | Legitimate interest in handling submissions efficiently |
| Keeping the site secure and preventing abuse | Legitimate interest |
| Keeping records we are required by law to keep | Legal obligation |
We do not sell your personal data, and we do not use it for advertising. We only email you about your submissions and your account. We do not send newsletters or marketing emails; if we ever start, we will ask for your separate consent first.
4. AI and human decisions
We use AI models to help us summarise submissions and suggest which playlists might fit a track. Every placement decision is made by a human curator. No decision about you or your music is made by automated means alone.
The AI services receive the information about your music described in section 2(a) and 2(c). They do not receive your password.
5. Who we share it with
Service providers who process data on our behalf, under data processing agreements:
- Lovable (Lovable Cloud): website hosting, database and authentication. The database is stored in the EU (Ireland).
- Cloudflare: delivering the website and protecting it from attacks. It sees your IP address and basic request data.
- Resend: sending emails.
- AI model providers, reached through Lovable's AI gateway: currently Google's Gemini models, for the purposes in section 4.
Spotify. To place your track on our playlists we send Spotify the track's ID. Our playlists are public on Spotify.
The public. Your artist page on spruv.net is public. It can show your artist name, photo, bio, links and the playlists your track is on. Your email address is never shown publicly.
Search engines. When a public page changes, we tell search engines such as Bing (through IndexNow) that the page has been updated. Only the page address is sent.
Authorities, if the law requires it.
6. Transfers outside the EU/EEA
Our database is stored in the EU (Ireland). Some of our providers are based in, or process data in, the United States, including Cloudflare, Resend and the AI model providers. When your data leaves the EU/EEA, it is protected as follows:
- Cloudflare and Resend are certified under the EU-US Data Privacy Framework. Resend also includes the European Commission's Standard Contractual Clauses in its data processing agreement.
- Lovable is based in the EU. It uses the European Commission's Standard Contractual Clauses with its own providers outside the EU/EEA, including the AI model providers.
7. How long we keep it
- Accounts and placed tracks: while your account is active. If you ask us to delete your account, we delete your data within 30 days.
- Submissions that were not selected: 24 months, so we can recognise a resubmission and keep curation fair, and then we delete them.
- Records of emails we sent you: 24 months.
- Server logs: as long as our hosting providers keep them, normally no more than 30 days.
- Records we must keep by law (for example bookkeeping, if payments are ever introduced): as long as the law requires.
8. Your rights
Under the GDPR you have the right to:
- get a copy of the personal data we hold about you,
- have incorrect data corrected,
- have your data deleted,
- restrict or object to how we use it, including anything based on legitimate interest,
- receive your data in a portable format,
- withdraw any consent you have given, at any time.
To use any of these rights, email hello@spruv.net. We answer within one month.
If you think we have handled your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at www.imy.se. We would appreciate the chance to fix it first.
9. Cookies and browser storage
We only use storage that the site needs in order to work:
- keeping you signed in, and remembering whether you asked us to,
- remembering simple settings, such as which workspace you last used,
- security cookies set by our hosting providers to protect the site from bots and attacks, and to route your visit correctly.
We do not use advertising cookies or third-party analytics cookies, so we do not ask for cookie consent.
10. Children
Spruv is not intended for anyone under 16. We do not knowingly collect data from children under that age. If you believe a child has submitted to us, contact hello@spruv.net and we will delete it.
11. Security
Access to personal data is limited to the people who need it to run Spruv. Data is sent over encrypted connections, and passwords are stored by our authentication provider using industry-standard hashing.
12. Changes to this policy
If we change this policy, we will update the date at the top. If a change materially affects how we use your data, we will also tell you by email.
13. Contact
Jonas Böös, Spruv
Sweden
hello@spruv.net