Privacy Policy

Last Updated: July 20, 2026

This Privacy Policy describes how Tiber Consulting ("we", "us", "our", or the "Data Controller") collects, uses, stores, and protects your personal data when you use the Morrison Music mobile/web application (the "App").

Protecting your privacy is our top priority. We do not sell, trade, or rent your personal data to third parties, nor do we use your data for marketing or commercial profiling purposes.

1. Data Controller

The Data Controller responsible for processing your data under the GDPR is:

• Legal Entity: Tiber Consulting sprl

• Address: Rue Batonnier Braffort 14, 1200, Woluwe-Saint-Lambert, 1200 Brussels

• Privacy Contact Email: privacy@tibercons.com

2. Types of Data We Collect

We only collect and process personal data that is strictly necessary to generate your custom playlists:

A. Music Streaming Accounts Data (Spotify / Apple Music)

Through official authentication mechanisms (OAuth 2.0) provided directly by the platforms, we collect:

• Listening history and preferences (e.g., recently played tracks, top artists/genres, saved playlists).

• Account User ID (to link generated playlists to your profile).

Note: We never see, store, or have access to your Spotify or Apple Music account credentials (passwords).

B. AI Chatbox Data

• Text messages, prompts, and preferences you enter into the chatbox to generate or refine your playlists.

C. Technical and Account Data

• Account Email address and App User ID (used for authentication).

• Technical log data required for security, error monitoring, and service operations.

3. Legal Basis and Purposes of Processing

We process your data strictly under the following legal bases and for the following purposes:

1. Service Delivery: To connect your streaming accounts, analyze listening habits, process prompts via AI, and create/save playlists to your music account.

   • Legal Basis: Performance of a contract to which the user is party (Art. 6.1.b GDPR).

2. Security and Maintenance: To ensure the stability, security, and proper functioning of the App.

   • Legal Basis: Legitimate interest of the Data Controller (Art. 6.1.f GDPR).

4. Data Storage and EU Localization

All user data is securely stored and managed using Supabase infrastructure located exclusively within data centers in the European Union (EU). Your data will not be transferred to third countries outside the EU without adequate safeguards in place.

Data sent to the AI engine for playlist generation is pseudonymized and strictly restricted to the minimum text and context needed to process your request.

5. Data Sharing and Third Parties

We will NEVER sell, lease, or monetize your personal data.

Data may only be shared with trusted service providers acting as Data Processors (under Art. 28 GDPR) to operate the App:

• Supabase Inc. (EU database hosting and authentication).

• AI API Providers (Used solely to process chat prompts and return playlist suggestions; data is not retained to train public models).

• Spotify / Apple Music (Via official APIs to retrieve authorized preferences and export generated playlists to your account).

6. Data Retention

We retain your personal data only as long as necessary to provide the service:

• Chat History & Preferences: Retained as long as your account remains active.

• Account Deletion: If you delete your account or revoke API permissions, all associated personal data will be permanently deleted or anonymized within 30 days.

7. Your Rights Under the GDPR

If you reside in the European Economic Area (EEA), you have the following rights regarding your data:

• Right of Access: Request a copy of the personal data we hold about you.

• Right to Rectification: Request correction of inaccurate or incomplete data.

• Right to Erasure ("Right to be Forgotten"): Request the deletion of your personal data.

• Right to Revoke Consent: Revoke Spotify or Apple Music permissions at any time via their respective account settings or within the App.

• Right to Restrict or Object: Limit or object to how we process your data.

• Right to Data Portability: Request a copy of your data in a structured, machine-readable format.

To exercise any of these rights, please email us at: privacy@tibercons.com

You also have the right to lodge a complaint with your local Data Protection Authority (DPA) if you believe your data has been handled improperly.

8. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or relevant laws. Significant changes will be communicated through the App or via email.