Terms of Service

1. Acceptance of Terms

By accessing or using Spinshare, you agree to be bound by these Terms, including the privacy notice in Part B. If you do not agree, do not use the service. We may update these Terms from time to time as set out in Section 17. Material changes will be communicated to you in advance, and where required by law, your continued use after the effective date will not be treated as acceptance unless you have been notified and given the opportunity to object.

2. Eligibility

You must be at least 18 years old (or the age of legal majority in your jurisdiction) to use Spinshare. By using the service, you represent that you meet this requirement and that your use of the service complies with all applicable laws, including export controls and sanctions.

3. Accounts

You are responsible for keeping your login credentials confidential and for all activity under your account. You agree to provide accurate information when registering and to keep it up to date. We may suspend or terminate accounts that violate these Terms or that we reasonably suspect of fraud, abuse, or misrepresentation.

4. The Service

Spinshare provides tools for two roles:

• Producers: create a public profile, publish drops, and earn money from paid subscriptions and one-time unlocks.
• Subscribers: follow producers, subscribe to producer pages, and access drops the producer has published.

We may add, remove, or change features at any time. Some features may be available only on certain subscription tiers (such as Spinshare Pro). Changes that materially reduce paid functionality will be communicated in advance and, where required by law, will give affected users a right to terminate.

5. Your Content; Representations and Warranties

Producers retain full ownership of the content they publish through Spinshare. We do not claim a copyright or license that lets us sell, sublicense, or repackage your work outside of the service.

You grant Spinshare a limited, non-exclusive, worldwide, royalty-free license to host, store, display, and transmit your content solely as needed to operate the service. This includes showing your profile, delivering files to entitled subscribers, presenting metadata in dashboards, and serving cached previews. The license ends when you remove the content, except to the extent we need to retain it to fulfil obligations to existing subscribers for periods they have already paid for.

For the avoidance of doubt, we do not, and will not, use your content to train any artificial intelligence or machine learning models, nor do we license your content to any third parties for this purpose.

Producer representations and warranties. By publishing, streaming, monetising, or otherwise making available any file through Spinshare (including any file referenced from a connected Dropbox account or other cloud-storage provider), you represent and warrant that, at the moment of publication and at all times the file remains available through the service:

• You own, or hold valid written licenses to, one hundred percent (100%) of the copyright, master-recording, mechanical, synchronisation, performance, distribution, sampling, and any other intellectual property rights in and to the file, in every territory in which the file is made available through Spinshare.
• The file does not contain any uncleared samples, unlicensed third-party recordings, unlicensed loops, royalty-bearing material, or any other content for which a third party could assert a claim of infringement, royalties, or moral rights.
• You have obtained any clearances required from collaborators, featured artists, co-producers, and any collecting societies (e.g. GEMA, BMI, ASCAP, SACEM, PRS) to publish and monetise the file on Spinshare.
• The file does not infringe any third party’s publicity, privacy, personality, trademark, or other rights, and does not contain content that is unlawful, defamatory, obscene, or otherwise prohibited by Section 6.
• All information you provide about the file (title, description, price, payment type) is accurate and not misleading.

You agree to indemnify, defend, and hold Spinshare and its affiliates, officers, employees, and agents harmless from and against any claim, demand, loss, damage, cost, or expense (including reasonable legal fees) arising out of any breach of these representations and warranties or any third-party claim relating to your content.

6. Acceptable Use and Direct Messaging (the Lab chat)

You agree not to use Spinshare to:

• Publish content you do not own or have rights to distribute, including unlicensed samples, copyrighted recordings, or works subject to third-party royalties you have not cleared.
• Distribute malware, illegal content, content that incites violence, sexually explicit content involving minors, or content that violates applicable law.
• Misrepresent your identity, impersonate another person or artist, or set up accounts for fraudulent purposes.
• Attempt to bypass payment, access controls, rate limits, or any technical measures designed to protect the service or other users.
• Scrape, mass-download, or redistribute other producers’ drops outside the access granted by your subscription or unlock.
• Use the service to harass, threaten, or defame any person.
• Use the Lab chat (direct messaging between connected producers) to send unlawful, harassing, threatening, or infringing content, sexual content involving minors, or unsolicited bulk or spam messages.

Violations may result in suspension or termination of your account, removal of content, and forfeiture of any undistributed earnings tied to the violating activity.

Direct messaging (the Lab chat). The Lab includes a private one-to-one chat between mutually connected producers (Crew). Sharing audio files is available to connected producers; free-text messaging is a Spinshare Pro feature. All messages and files you exchange in the Lab chat are subject to this Acceptable Use section. Every participant can report a message and block the other producer at any time from the chat settings; blocking stops new messages in both directions while keeping the existing history visible.

We do not automatically monitor or scan the content of private Lab chat messages. When a message is reported, our team may review that message and, where it breaches these Terms or applicable law, remove it, block the sender, or suspend or terminate the accounts involved. We may also report unlawful content to the competent authorities where required. How we handle the personal data in Lab chat messages is described in Section 37.

7. Producer Cloud Storage Integration (Dropbox)

Spinshare lets producers optionally connect their Dropbox account so that drop files hosted in Dropbox can be streamed or delivered to entitled subscribers through the Spinshare interface, without requiring the producer to upload duplicate copies to our infrastructure.

Strictly read-only access; no write capability. Spinshare operates on a strictly read-only basis using the following Dropbox API scopes, and only these scopes:

• files.metadata.read: list file and folder metadata for the specific paths a producer chooses to publish.
• files.content.read: read the bytes of those files for delivery to entitled subscribers.
• sharing.read: resolve Dropbox shared links a producer pastes into Spinshare to the underlying file path.
• account_info.read: read the producer’s Dropbox account email address and account ID only, so the Spinshare dashboard can display which Dropbox account is connected. No other profile information is read.

The platform does not request any write, modify, or delete scope, and is technically incapable of creating, modifying, overwriting, renaming, moving, or deleting any file, folder, share link, comment, or other object within a producer’s Dropbox account. Spinshare never invokes any Dropbox endpoint that mutates Dropbox-side state, including but not limited to files/upload, files/delete_v2, files/move_v2, files/copy_v2, files/create_folder_v2, sharing/add_file_member, and sharing/create_shared_link_with_settings.

Pass-through delivery; no permanent storage. Spinshare acts solely as a pass-through streaming and delivery layer between the producer’s Dropbox account and the entitled subscriber. Spinshare does not copy, clone, mirror, or permanently store the underlying file bytes of any Dropbox-hosted drop on its own servers. Files are streamed from Dropbox on demand. Short-lived temporary download URLs and cached metadata may be retained for brief operational windows to keep playback responsive; these are bounded by short time-to-live values and contain no persistent file content.

Token security and revocation.When a producer connects Dropbox, Spinshare receives a refresh token and a short-lived access token from Dropbox. Both tokens are encrypted at rest in our database using AES-256-GCM with a per-record initialisation vector and authentication tag. Tokens are never written to logs, never exposed in client-side code, and never shared with any third party. A producer can permanently revoke Spinshare’s access to their Dropbox account at any time by either: (i) clicking “Disconnect” in the Spinshare dashboard, which calls https://api.dropboxapi.com/2/auth/token/revoke on a best-effort basis and deletes the encrypted tokens from our database, or (ii) visiting dropbox.com/account/connected_apps and removing “Spinshare” from the list of connected applications. Either action immediately and permanently terminates Spinshare’s ability to call the Dropbox API on the producer’s behalf.

Use of the Dropbox integration is in addition to your obligations under Section 5 (Your Content; Representations and Warranties) and Section 8 (Copyright; DMCA Takedown and Repeat Infringer Policy). Connecting a Dropbox account does not transfer any rights in your files to Spinshare beyond the read-only operational use described in this Section 7.

8. Copyright; DMCA Takedown and Repeat Infringer Policy

Spinshare respects the intellectual property rights of others and expects users of the service to do the same. Although Spinshare is operated from the European Union, we apply a notice-and-takedown procedure consistent with the United States Digital Millennium Copyright Act (17 U.S.C. § 512) (the “DMCA”), Article 17 of EU Directive 2019/790 (the Copyright in the Digital Single Market Directive), and the EU Digital Services Act (Regulation (EU) 2022/2065) to handle allegations of copyright infringement.

Submitting a takedown notice. If you are the owner (or the authorised agent of the owner) of a copyrighted work and you believe in good faith that material on Spinshare infringes your copyright, please send a written notice to:

Designated Copyright Agent
WantedAudio GmbH
Email: copyright@spinshare.pro
Subject line: “DMCA Takedown Notice”

Your notice must include:

1. A physical or electronic signature of the rights holder or their authorised agent.
2. Identification of the copyrighted work claimed to have been infringed, or, if multiple works at a single online site are covered by a single notification, a representative list of such works.
3. Identification of the material that is claimed to be infringing, including the full URL on Spinshare (e.g. https://spinshare.pro/<slug>) and, where possible, the specific drop title.
4. Contact information for the complainant: full legal name, postal address, telephone number, and email address.
5. A statement that the complainant has a good-faith belief that the use of the material in the manner complained of is not authorised by the copyright owner, its agent, or the law.
6. A statement that the information in the notification is accurate and, under penalty of perjury, that the complainant is authorised to act on behalf of the owner of the right allegedly infringed.

Incomplete notices may be returned to the complainant for clarification before action is taken. Valid notices are actioned promptly: the material at issue is removed or disabled, the producer who published it is notified, the producer’s connected Dropbox token may be revoked under Section 7, and the matter is recorded in the producer’s internal account history.

Counter-notices. A producer whose material has been removed in response to a takedown notice may submit a counter-notice to copyright@spinshare.pro that includes: (i) their physical or electronic signature; (ii) identification of the material that has been removed and its previous location; (iii) a statement under penalty of perjury that the producer has a good-faith belief the material was removed as a result of mistake or misidentification; (iv) the producer’s full legal name, postal address, telephone number, and email address; and (v) a statement that the producer consents to the jurisdiction of the competent courts at the producer’s habitual residence (or, for residents outside the EU, of the local courts at the registered seat of WantedAudio GmbH), and that the producer will accept service of process from the complainant or their agent.

Repeat Infringer Policy. Spinshare maintains a strict repeat-infringer policy. A producer who is the subject of more than one valid takedown notice that is not successfully counter-noticed, or against whom we receive credible repeated allegations of copyright infringement (whether through DMCA notices, Dropbox compliance notices, or other channels), will have their Spinshare account permanently terminated, their public profile and all associated drops permanently removed, their connected Dropbox OAuth tokens revoked under Section 7, and, where applicable, any undistributed earnings tied to the infringing activity forfeited. We may apply this policy at our discretion in cases of egregious single-instance infringement (e.g. a producer caught republishing a major commercial release).

Knowingly submitting a materially false takedown notice or counter-notice may expose the sender to liability for damages under applicable law, including 17 U.S.C. § 512(f).

9. Subscriptions and Payments

Spinshare offers free producer accounts and a paid Spinshare Pro subscription. Subscribers pay producers directly through producer-page subscriptions and one-time drop unlocks. Payments are processed by Stripe Payments Europe, Limited (Ireland) and, where applicable, by Stripe Connect for producer payouts. By using paid features, you also agree to Stripe’s applicable terms.

Platform fee. Free-tier producers pay a platform fee on revenue generated through Spinshare. Spinshare Pro producers keep 100% of their revenue. Current fee percentages are disclosed in the dashboard and on the marketing site, and may be updated from time to time. Material changes will be communicated in advance and will not apply retroactively to revenue already earned.

Pro subscription. Spinshare Pro renews on the cadence selected at checkout (monthly unless stated otherwise) until cancelled. You can cancel any time from your dashboard; cancellation takes effect at the end of the current billing period and prevents future renewals. Pro features remain active until the period ends.

Payouts. Producer earnings are disbursed through Stripe Connect on the schedule and currency supported by Stripe. Spinshare is not responsible for delays caused by the payment provider, banking partners, or compliance review. Producers are responsible for any taxes due on the income they earn through Spinshare and for providing accurate identity, banking, and tax information to Stripe.

Invoices. Where required, invoices for Spinshare Pro and any platform fees are issued through Stripe.

10. Cancellation and Refunds

You can cancel Spinshare Pro and any producer subscription at any time from your dashboard. Access continues until the end of the period you have already paid for, then reverts to the Free plan (for Pro) or ends (for producer subscriptions).

Drops and Pro features are digital services delivered immediately upon payment. Where you expressly request immediate performance and acknowledge that you lose your statutory 14-day right of withdrawal, services already rendered are non-refundable. We may grant refunds on a discretionary basis in cases of demonstrable error, duplicate charges, or fraud. Mandatory consumer protection rights under EU and German law remain unaffected. For the full policy and how to request a refund, see Cancellation & Refunds.

11. Spinshare Intellectual Property

The Spinshare name, logo, software, design, and platform are owned by WantedAudio GmbH and protected by intellectual property laws. These Terms grant you a limited, non-transferable license to use the service for its intended purpose. You may not copy, modify, reverse engineer, or create derivative works of the Spinshare platform itself except to the extent permitted by mandatory law.

12. Termination

You may delete your account at any time. We may suspend or terminate your access if you violate these Terms or for any reason where continued service would be unlawful or commercially impractical. Upon termination, your right to use the service ends, your Dropbox OAuth tokens (if any) are revoked and deleted under Section 7, and any pending payouts are released subject to Section 9. Provisions that by their nature should survive termination will survive, including content licenses needed to serve subscribers for the period they have already paid for, payment obligations, and disclaimers.

13. Availability of the Service

We aim to keep the service available, but we do not promise uninterrupted operation. Maintenance, updates, technical faults, or events beyond our reasonable control (including outages of third-party hosting, payment, or storage providers) may temporarily limit access. Statutory warranty rights of consumers remain unaffected.

14. Disclaimers and Limitation of Liability

For consumers, we are liable without limitation for damages arising from injury to life, body, or health caused by us or our legal representatives or vicarious agents, for damages caused intentionally or by gross negligence, and where mandatory law (such as the German Product Liability Act) requires.

For damages caused by simple negligence, we are liable only for the breach of a material contractual obligation (an obligation whose fulfilment makes the proper performance of the contract possible at all and on whose compliance you may regularly rely). In such cases, our liability is limited to typical, foreseeable damages.

Any further liability is excluded to the maximum extent permitted by law. The above limitations also apply to claims for breach of pre-contractual duties (culpa in contrahendo) and tort.

For business users (Unternehmer), our aggregate liability under or in connection with the service is, to the extent permitted by law, limited to the fees you paid us in the twelve months preceding the claim, with a minimum of one hundred euro (€100).

15. Third-Party Services; No Affiliation

Spinshare integrates with a number of independent third-party services to operate (including but not limited to Stripe, Vercel, Supabase, PostHog, and Dropbox). These providers are separate legal entities operating their own services under their own terms and privacy policies. Spinshare is not responsible for the acts, omissions, content, or availability of any third-party service.

Dropbox. Spinshare is an independent application that uses the Dropbox API as a permitted third-party developer. Spinshare is not affiliated with, endorsed by, sponsored by, certified by, or partnered with Dropbox, Inc. The names “Dropbox” and the Dropbox logo are trademarks of Dropbox, Inc., used here solely to identify the third-party service Spinshare integrates with. Any issues relating to a producer’s Dropbox account, Dropbox storage quota, or Dropbox file availability are governed by the producer’s direct agreement with Dropbox, not by these Terms.

16. Changes to These Terms

We may update these Terms when needed (for example, to reflect new features, legal changes, or operational requirements). When we make material changes, we will:

• Update the “Last updated” date at the top.
• Notify you at least 30 days in advance of the effective date, in the app or by email, where we have an email on file.
• Where required by law, ask you to actively re-accept the new Terms before continuing to use paid features.

If you do not agree to the updated Terms, you may terminate your account before the effective date. Continued use after the effective date constitutes acceptance only to the extent permitted by law.

17. Governing Law and Jurisdiction

These Terms are governed by the laws of the Federal Republic of Germany, excluding its conflict-of-laws principles and excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG).

If you act as a consumer (Verbraucher) within the meaning of § 13 BGB, the choice of German law does not deprive you of the protection afforded by mandatory provisions of the law of the country in which you have your habitual residence (Art. 6 (2) Rome I Regulation). You may bring claims before the courts of your habitual residence to the extent provided by mandatory consumer protection law.

If you act as a merchant (Kaufmann), legal entity under public law, or special public-law fund, the place of jurisdiction for all disputes arising from or in connection with these Terms is the registered seat of WantedAudio GmbH in Germany. We remain entitled to bring proceedings at your general place of jurisdiction.

18. EU Online Dispute Resolution

The European Commission provides a platform for online dispute resolution available at ec.europa.eu/consumers/odr. We are not obliged and not generally willing to participate in a dispute resolution procedure before a consumer arbitration body.

19. Severability

If any provision of these Terms is or becomes invalid or unenforceable, the remaining provisions remain in full force. The invalid or unenforceable provision will be replaced by a valid provision that comes closest to the economic purpose of the original provision, to the extent permitted by law.

20. Contact

Questions about these Terms? Reach us at support@spinshare.pro. For copyright takedown notices, use copyright@spinshare.pro.

21. Controller

The data controller responsible for processing personal data on this website is:

WantedAudio GmbH
Neue Mainzer Straße 84
60311 Frankfurt am Main
Germany
Email: support@spinshare.pro
Copyright agent: copyright@spinshare.pro

22. Data protection officer

We have determined that we are not required under Art. 37 GDPR or § 38 BDSG to appoint a Data Protection Officer. Spinshare does not carry out the kind of large-scale systematic monitoring of data subjects or large-scale processing of special-category data that triggers the Art. 37 appointment obligation, and we do not currently meet the § 38 BDSG headcount threshold for automated processing. Please direct all privacy enquiries to the controller named in Section 21. We will reassess this determination as the service grows.

23. Categories of personal data we process

Depending on how you use Spinshare, we may process:

• Account data: email address, hashed password, display name, account role, account creation and login timestamps.
• Profile data (producers): public slug, display name, bio, avatar/cover image URL, accent colour preferences, verification status, subscriber count.
• Content data: drop titles, descriptions, prices, external file links (e.g. Dropbox or Google Drive), and metadata you choose to publish.
• Lab chat data: the text of messages you send to a connected producer (a Spinshare Pro feature), audio files you share in the Lab chat and their metadata (file name, size, type, duration), delivery and read timestamps, emoji reactions, and any reports or blocks you create. See Section 37.
• Subscription, follow, and unlock records: which producer you follow or subscribe to, which drops you have unlocked, timestamps, and price tier where applicable.
• Payment data: processed by Stripe (see Section 27). We receive limited Stripe identifiers (Stripe Customer ID, Stripe Connect Account ID, subscription status, charge amount, currency, country, last 4 digits / card brand). We do not store full payment card numbers.
• Dropbox integration data (producers only): if you choose to connect a Dropbox account, we receive and store: your Dropbox account ID, your Dropbox account email address, an encrypted OAuth refresh token, and an encrypted short-lived OAuth access token with its expiry timestamp. See Section 29 for the full breakdown of what we do and do not read from Dropbox.
• Communications: emails you send to us, support requests, and feedback you submit through the dashboard.
• Technical data: IP address (truncated where feasible), user-agent, request timestamps, referrer, and routing cookies necessary for authentication and security.
• Analytics and product data: if you give consent, anonymised or pseudonymised event data captured by PostHog (see Section 28).

24. Purposes and legal bases of processing

We process personal data on the following GDPR Art. 6 (1) legal bases:

• Performance of a contract (Art. 6 (1)(b)): creating and operating your account, delivering subscription access, processing payments and payouts, providing producer dashboards, and (for producers who opt in) operating the Dropbox integration so that subscriber-entitled files can be streamed from the producer’s Dropbox account.
• Legal obligation (Art. 6 (1)(c)): retaining invoices and accounting records under German tax law (HGB / AO), responding to lawful requests from public authorities, and complying with notice-and-takedown obligations under applicable copyright and intermediary-liability law.
• Legitimate interests (Art. 6 (1)(f)): securing our service against fraud and abuse, rate-limiting, server logs for diagnostics, ensuring platform integrity, and enforcing our Repeat Infringer Policy. We balance these interests against your rights and freedoms.
• Consent (Art. 6 (1)(a)):non-essential cookies, product analytics, session recording, marketing emails (where applicable), and the producer’s explicit authorisation of the Dropbox OAuth integration. You can withdraw consent at any time without affecting prior processing.

25. Account, authentication, and session cookies

To operate the service, we set strictly necessary cookies:

• NextAuth session cookies for keeping you signed in.
• CSRF protection cookies set by NextAuth.
• Referral / invite cookies (spinshare_ref, spinshare_invite) for attributing sign-ups to invite links you clicked, with a short lifetime.

These cookies are essential to operate the service you requested and do not require consent under § 25 (2) DDG.

26. User content and copyright handling

When you publish a drop, Spinshare processes the metadata you provide (title, description, price, external storage link, file count, and any cover art URL) to deliver the drop to entitled subscribers. We act as a hosting intermediary for metadata and, in the case of the Dropbox integration described in Section 29, as a pass-through delivery layer for the file bytes that remain stored at Dropbox.

Where we receive a valid copyright takedown notice (see Section 8 above), we will process the personal data contained in that notice (the complainant’s name, contact details, and identification of the works) on the legal basis of legal obligation (Art. 6 (1)(c) GDPR) and legitimate interest in operating a lawful service (Art. 6 (1)(f) GDPR). Where required, we forward the takedown notice to the producer whose content is at issue and record the matter in their account history for the purposes of our Repeat Infringer Policy.

For the avoidance of doubt, we do not, and will not, use your content to train any artificial intelligence or machine learning models, nor do we license your content to any third parties for this purpose.

27. Payments via Stripe

We use Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) and, where applicable, Stripe Connect to process subscription payments and producer payouts. When you make a payment, Stripe collects payment-card information and identity verification data directly. We receive only confirmation and limited transaction metadata.

Legal basis: performance of a contract (Art. 6 (1)(b) GDPR) for paying customers and producers receiving payouts. International transfers to Stripe affiliates outside the EEA, where they occur, rely on the EU Standard Contractual Clauses concluded by Stripe.

For Stripe’s own privacy practices, see stripe.com/privacy.

28. Analytics and product telemetry (PostHog)

We use PostHog to understand how producers and subscribers use Spinshare so we can improve the product. PostHog is operated by PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA.

PostHog may capture pseudonymous event data, including UI clicks, page views, and (with masked input fields) anonymous session replays. A long-lived ph_did cookie is used to keep consistent buckets between server and client for feature experiments.

Legal basis:consent under Art. 6 (1)(a) GDPR and § 25 (1) DDG. We will only place non-essential analytics cookies and load PostHog tracking scripts after you give consent through our cookie banner.

International transfers to PostHog Inc. (USA) rely on the EU Standard Contractual Clauses and any applicable adequacy decision. You can withdraw consent at any time through the cookie settings in our footer.

29. Producer Dropbox integration

Spinshare offers producers the option to connect a Dropbox account so that drop files stored in Dropbox can be streamed or delivered to entitled subscribers through the Spinshare interface. The integration is strictly opt-in. It is never activated for subscribers, and never activated for producers who do not click “Connect Dropbox” in their dashboard.

Scopes requested (read-only). When a producer authorises Spinshare on the Dropbox consent screen, Spinshare requests the following Dropbox API scopes, and only these scopes:

• files.metadata.read: read file and folder names, paths, sizes, and similar metadata for the specific files or folders the producer chooses to publish through Spinshare.
• files.content.read: read the bytes of those specific files for the sole purpose of delivering them to a subscriber who is entitled to access them under the producer’s drop configuration.
• sharing.read: resolve Dropbox shared links a producer pastes into Spinshare to the underlying file path inside the producer’s account.
• account_info.read: read the producer’s Dropbox account email address and Dropbox account ID, used only to display the “Connected as <email>” label in the Spinshare dashboard and to prevent the same Dropbox account from being silently attached to two different Spinshare accounts. No other profile fields, contacts, or activity are read.

No write capability.Spinshare does not request, and is technically incapable of using, any Dropbox scope that would permit Spinshare to modify, overwrite, rename, move, copy, delete, or otherwise alter any file, folder, comment, or shared link inside a producer’s Dropbox account. Spinshare invokes no write-class Dropbox endpoint, including but not limited to files/upload, files/delete_v2, files/move_v2, files/copy_v2, files/create_folder_v2, sharing/add_file_member, or sharing/create_shared_link_with_settings.

Pass-through delivery.Spinshare acts as a pass-through streaming and download layer between the producer’s Dropbox account and the entitled subscriber. Spinshare does not copy, clone, mirror, or permanently store the underlying file bytes of any Dropbox-hosted drop on its own servers. Files are streamed from Dropbox at the moment a subscriber requests them. Short-lived temporary download URLs minted by Dropbox (typically with a four-hour time-to-live) and lightweight metadata such as file name, file size, and content count may be cached briefly in memory or in our database to keep the in-app player responsive. These caches never contain persistent file content.

Token storage and encryption. When a producer connects Dropbox, we receive an OAuth refresh token and a short-lived access token. Both tokens are encrypted at rest in our database using AES-256-GCM (a NIST-approved authenticated-encryption algorithm) with a fresh 96-bit initialisation vector and an authentication tag generated per stored record. The encryption key is held in a server-side environment variable that is never exposed to client-side code. Tokens are never written to application logs, never emailed, never displayed in the user interface, and never shared with any third party. Decryption fails closed: if any tampering is detected, the producer is required to reconnect their Dropbox account.

Instant revocation.A producer can revoke Spinshare’s access to their Dropbox account, instantly and permanently, by either:

• Clicking “Disconnect Dropbox” in the Spinshare dashboard. This calls https://api.dropboxapi.com/2/auth/token/revoke on a best-effort basis and deletes the producer’s encrypted refresh and access tokens from our database together with any cached temporary download URLs.
• Visiting dropbox.com/account/connected_apps and removing “Spinshare” from their list of connected applications. This terminates the OAuth grant at Dropbox’s end and immediately invalidates any token Spinshare still holds.

Following revocation, drops that were configured to stream through the Dropbox integration will gracefully fall back to the producer’s original public shared link (or become unavailable, depending on the producer’s settings) and Spinshare loses all ability to call the Dropbox API on the producer’s behalf.

Independent controllers.Dropbox, Inc. remains the independent controller for any personal data and file content held inside the producer’s Dropbox account. Dropbox’s privacy practices and terms of service apply to data stored at Dropbox and are available at dropbox.com/privacy.

Legal basis. Performance of a contract (Art. 6 (1)(b) GDPR) for delivering subscriber-entitled drops, and explicit consent (Art. 6 (1)(a) GDPR and the Dropbox OAuth consent screen) for the initial authorisation of the integration. International transfers to Dropbox, Inc. (USA) rely on the EU Standard Contractual Clauses and any applicable adequacy decision.

30. Hosting, infrastructure, and processors

We engage the following processors to operate Spinshare. Each processor is bound by a Data Processing Agreement under Art. 28 GDPR.

• Vercel Inc. (USA) for application hosting and global CDN.
• Supabase Inc. (USA) for PostgreSQL database hosting in EU regions where supported.
• Stripe Payments Europe, Ltd. (Ireland) for payment processing and Connect payouts.
• PostHog Inc. (USA) for product analytics and session replay (consent-based).
• Resend, Inc. (United States) for transactional emails (sign-up verification, password reset, payout notifications, and similar account communications). Resend acts as our processor under a Data Processing Agreement; international transfers to the United States rely on the EU Standard Contractual Clauses concluded with Resend. See resend.com/legal/privacy-policy.
• Dropbox, Inc. (USA) where a producer has voluntarily connected a Dropbox account under Section 29. Dropbox stores the underlying file content as an independent controller. Spinshare uses Dropbox only as a read-only pass-through and stores Dropbox-issued OAuth tokens encrypted at rest as described in Section 29.
• Google LLCwhere a producer has voluntarily shared a Google Drive link as an external storage location for a drop. Drops linked from Google Drive currently rely on the producer’s own public-share configuration at Google; Spinshare does not hold any OAuth token for Google Drive.

Where data is transferred to processors outside the EEA, we rely on the EU Standard Contractual Clauses (SCCs) and supplementary safeguards required by the Schrems II ruling.

31. Data retention

• Account data is retained while your account is active. After you request deletion (see Section 33), we delete personal data that is not subject to a statutory retention obligation within a reasonable time, typically 30 days.
• Invoices and accounting recordsare retained for up to 10 years as required under §§ 257 HGB, 147 AO.
• Server logs are kept for diagnostics for a short period (typically up to 30 days) and then deleted or anonymised.
• Dropbox OAuth tokens are retained only for as long as the producer keeps the Dropbox integration connected. On disconnect (whether via the Spinshare dashboard, via dropbox.com/account/connected_apps, or as part of account deletion), the encrypted refresh and access tokens, the Dropbox account ID, and any cached Dropbox metadata are deleted from our database.
• Lab chat messages and files are handled as described in Section 37: files you share are purged from our storage a short time after delivery (roughly five to ten days), while message text and chat records persist while your account is active and are removed when your account is deleted.
• Analytics events (with consent) are retained according to the PostHog data retention configuration we apply.

32. Your rights under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR).
• Right to rectification (Art. 16 GDPR).
• Right to erasure (Art. 17 GDPR).
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR).
• Right to object to processing based on legitimate interests (Art. 21 GDPR).
• Right to withdraw consent at any time, without affecting the lawfulness of prior processing (Art. 7 (3) GDPR). For the Dropbox integration, withdrawal is effected by clicking “Disconnect Dropbox” in the dashboard or by revoking access at dropbox.com/account/connected_apps.
• Right to lodge a complaint with a supervisory authority. The authority responsible for our place of business is:
  Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)
  Gustav-Stresemann-Ring 1
  65189 Wiesbaden
  Germany
  Website: datenschutz.hessen.de
  Email: poststelle@datenschutz.hessen.de

33. Account deletion and data deletion requests

You can request deletion of your account and associated personal data at any time from Dashboard → Settings → Profile → Delete Your Account, which opens a confirmation dialog and a one-click support request from the email address registered on your account. You may also email support@spinshare.pro directly from your registered address. We review every deletion request within 24 hours and complete the deletion within one month at the latest, in line with Art. 12 (3) GDPR and subject to the retention obligations in Section 31.

Account deletion automatically revokes any connected Dropbox OAuth tokens under Section 29 and removes the encrypted tokens, the Dropbox account ID, and any cached Dropbox metadata from our database.

Account deletion also removes the Lab chat messages you sent, the audio files you shared in the Lab chat (deleted from our storage), and the reports and blocks you created.

34. Security

We apply technical and organisational measures appropriate to the risks of processing, including:

• TLS for all traffic to and from Spinshare.
• Account passwords hashed with industry-standard algorithms.
• OAuth refresh and access tokens (including Dropbox tokens) encrypted at rest with AES-256-GCM, per-record initialisation vectors, and authentication tags.
• HMAC-signed OAuth state parameters with short time-to-live values to defend the Dropbox OAuth handshake against cross-site request forgery.
• Masked form inputs in session recordings.
• Rate-limiting on sensitive endpoints.

No system can guarantee absolute security, but the measures above are reviewed regularly and updated as appropriate.

35. Children

Spinshare is not directed at children. You must be at least 18 years old (or the age of legal majority in your jurisdiction) to create an account.

36. Third-party services; no affiliation

Spinshare integrates with independent third-party services (including Stripe, Vercel, Supabase, PostHog, Dropbox, and Google Drive) to operate. These providers are separate legal entities, each operating their own services under their own terms and privacy policies. Spinshare is not responsible for the acts, omissions, content, or availability of any third-party service.

Dropbox. Spinshare is an independent application that uses the Dropbox API as a permitted third-party developer. Spinshare is not affiliated with, endorsed by, sponsored by, certified by, or partnered with Dropbox, Inc. The names “Dropbox” and the Dropbox logo are trademarks of Dropbox, Inc., used here solely to identify the third-party service Spinshare integrates with.

37. Lab chat (direct messaging between connected producers)

The Lab includes a private one-to-one chat between producers who are mutually connected (Crew). Producers can send audio files to each other and, with a Spinshare Pro subscription, free-text messages. The chat is only available between two producers who are already connected; it is never a public channel or a broadcast feed.

Data we process. The text content of messages you send, audio files you upload together with their metadata (file name, size, type, and duration), delivery and read timestamps, emoji reactions, and any reports or blocks you create. Uploaded audio files are stored in our Supabase storage (in EU regions where supported) and streamed to the other participant; message text is stored in our database.

Who can access your messages. Only the two producers in a conversation can read it. Spinshare staff do not routinely read private Lab chat messages. A specific message becomes visible to our safety team only when a participant reports it, so that we can review and act on that report.

No automated monitoring. We do not run automated scanning, profiling, or content-recognition over the messages or files you exchange in the Lab chat. Moderation is reactive and depends on the in-chat Report and Block tools described below.

Safety tools. Every participant, on any plan, can report a message and block the other producer from the chat settings. Blocking stops new messages in both directions while keeping the existing history visible. Reported messages are placed in an internal queue where our admins can dismiss the report, remove the message, or block the sender. We process this data on the legal basis of our legitimate interest (Art. 6 (1)(f) GDPR) in keeping the platform safe and acting on abuse.

Retention. Uploaded files are deleted from our storage a short time after delivery (currently within roughly ten days, or roughly five days once the recipient has downloaded them). Message text and chat records are kept while your account is active and are deleted when your account is deleted. See Sections 31 and 33.

Legal basis. Performance of a contract (Art. 6 (1)(b) GDPR) to provide the messaging feature you and your Crew use, and our legitimate interests (Art. 6 (1)(f) GDPR) in keeping the platform safe, preventing abuse, and acting on reports.

38. Changes to this privacy notice

We may update Part B to reflect changes in our processing or in the law. The “Last updated” date at the top reflects the latest revision. For material changes that affect your rights, we will notify you in advance through the service or by email, on the same terms as Section 16.

39. Privacy contact

For questions about Part B or to exercise any of your rights, please email support@spinshare.pro. For copyright takedown notices, use copyright@spinshare.pro.