Privacy Policy

1. Who is responsible for your data

The controller of your personal data is Tomáš Urban (“we”). For anything related to your personal data, write to tomurban@tomurban.one.

2. What we collect

Depending on how you use the site, we process:

• Account data: your e-mail address, a password (stored only as a secure hash, never in readable form), and optionally your first and last name, date of birth, gender, profile photo and where you listen to music (the platform, optionally a short note). Your full name, date of birth, gender and platform are seen by the author only; other signed-in fans see just your first name with the initial of your surname (“Jan N.”) and your photo next to comments and dedications.
• Preferences: interface language and theme, stored in your browser and on your account, and your time zone, which we read automatically from your browser settings at sign-up and sign-in (you can change it in your profile) so that scheduled e-mails, such as a birthday wish, arrive in your morning.
• Account usage record: the time of your last sign-in and, rounded to the hour, the time you were last active on the site. The author uses it to see which fans are alive around the music and whom to reach out to; it is kept for the life of the account. From this record, from how you open our e-mails and from what you do on the site (comments, chat, favorite songs, sharing), a simple engagement figure from 0 to 100 over the last 90 days is computed every hour and stored on the account; only the author sees it and it serves only to decide whom to reach out to. The author also sees on your card how many devices you are signed in on (from the valid sign-in records), not which ones.
• Security records: IP address and browser identification in sign-in protection, on requests for verification and password-reset e-mails, and in the administrative audit log (what changed, when and from where). On an anonymous visit through a sharing link the IP address is kept for one hour as a hash only, so the visit is counted once; it is not written anywhere.
• Notifications inside the app: to you about your account, to the author about activity on the site (see below).
• Email interaction: whether a message we sent you was opened and which links in it you followed. We record this with an invisible image and by routing links through our own address. You can ask us to stop at any time, and we do not use it for advertising or profiling.
• Community content: the comments and replies to comments you write under songs (published only after a check: an artificial intelligence judges them and the author may change its decision), the hearts you give to comments (we store which comment you liked; others see a count only), the messages in the private chat with the author, voice messages and their transcript included, and the songs you mark as favorites. With a chat message we also store the page you sent it from. Approved comments are shown to other signed-in fans with your first name, the initial of your surname and your photo, in their own language as a machine translation with a note about the original language; chat messages are seen by you and the author only. When someone replies to your comment and the reply passes the check, we e-mail you its text.
• Sharing link: every account carries an opaque sharing code and a link to an invitation page. Whoever opens that page (even without an account) sees your first name with the initial of your surname (“Jan N.”) and your profile photo, if you have one; only the people you send the link to see the page, and search engines do not index it. When someone opens the site through your link, we count the visit and, if they create an account, we record that you invited them (the invited account stores a reference to yours). You see counts only; the author sees in the administration who invited whom. When an invited person becomes a fan (verifies their e-mail and has the news on), we send you a thank-you e-mail; it carries neither their name nor their address. It is information about your account as part of providing the service, not a commercial message, so it goes out even with the news off. The code carries no personal data and is not passed to traffic measurement. The “Open my sharing page” link in our e-mails carries a signed key of your account: it opens only your sharing page with the link and the counts, does not sign you in and unlocks nothing else; whoever you forward the e-mail to sees the same.
• Dedications: the author may dedicate a song to you. The song then shows your first name with the initial of your surname, your profile photo (if you uploaded one) and his short message; currently to signed-in fans only. You accept this possibility when you create your account (Terms of Service, section 4). You can ask for the dedication to be removed, or delete your photo in your profile, at any time.
• Notifications for the author: when you register, write a comment or a chat message, switch the news on or off (including the reason you may give when unsubscribing), or when the digital avatar closes the chat or passes on your request to reach the author, the author gets a notification in the admin area and by e-mail. It contains your name, your e-mail address, a preview of the text and, for the chat, a short summary of the conversation written by the model. If the author has phone notifications on, Telegram gets only a short line with your display name and a link into the admin area.
• News subscription history: when and from where you switched the news on or off (at registration, in your profile, on the unsubscribe page, by the link in an e-mail, or the administrator at your request) and the reason you may have given when unsubscribing. We keep it as proof of your choice for as long as the account exists.
• The sign-in form can, if you ask it to, remember the e-mail address you last used; it is stored in your browser only.
• Account security settings: whether two-factor authentication is on, and the technical key needed to verify the code from your app. The codes themselves are never stored.
• Chat moderation records: the number of warnings and any temporary closing of the chat, so that the rules can be applied fairly.

3. Why we process it

Each purpose has its legal basis under the GDPR; how long we keep the data for each purpose is listed in section 6.

• Providing the service you signed up for: accounts, sign-in, purchased content. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Keeping accounts and content secure and preventing abuse: sign-in protection and the administrative audit log. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• Meeting legal obligations, such as accounting records for purchases. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Sending you email news for fans: new music and releases, and in future other offers for fans such as courses, only while your news preference is switched on. Legal basis: our legitimate interest in direct marketing to our own fans (Art. 6(1)(f) GDPR, recital 47). You can object at any time and we stop immediately: every news email carries a one-click unsubscribe link, and the same switch is in your profile. The news include a short welcome series after you verify your account, a birthday wish if you filled in your date of birth, and a friendly reminder if something is missing from your profile (twice at most, a week and a month after sign-up, and only while the profile is incomplete).
• Anything we explicitly ask your consent for. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Measuring site traffic with Google Analytics: which pages and songs are read and played, where visitors come from. Legal basis: consent (Art. 6(1)(a) GDPR), given in the cookie banner and withdrawable at any time via “Cookie settings” in the footer. Nothing is measured without consent.
• Running the community features you use: comments, the private chat, favorites, the sharing link and dedications. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Moderation of comments and chat rests on our legitimate interest in keeping the site civil (Art. 6(1)(f) GDPR).
• Alerting the author to activity on the site and moderating comments and chat: so he can respond quickly and keep the site civil. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• Running the author's digital avatar in the private chat, so that you get an answer even when the author is away from his computer. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Keeping the chat civil: automated assessment of messages and, where needed, temporarily closing the chat. Legal basis: our legitimate interest in keeping the site civil (Art. 6(1)(f) GDPR). The details are in the section on artificial intelligence.

4. Cookies

We use cookies and browser storage that the service needs to work or that keep a choice you made yourself, and, with your consent, the analytics cookies of Google Analytics:

We use no advertising cookies. The analytics cookies are set only after you choose “Accept all” in the cookie banner or switch analytics on in the settings; until then nothing measuring is stored in your browser and no request leaves for Google's servers. Rejecting has no effect on how the site works, and you can change your choice at any time via the “Cookie settings” link in the footer. We remember a consent for 12 months and a refusal for 6 months, then we ask again.

• auth_access: signs you in; httpOnly (inaccessible to scripts on the page), technical, expires after 60 minutes.
• auth_refresh: keeps you signed in between visits; httpOnly, technical, expires after 30 days, or after 12 hours with two-factor authentication on.
• auth_mfa: a short-lived cookie between the password and the code from your app during two-factor sign-in; httpOnly, technical, expires after 5 minutes.
• to-locale and NEXT_LOCALE: remember the language you chose; technical preference, kept for 1 year (when set by the server, only until you close the browser).
• to-profile-prompt-snoozed: remembers that we recently asked you to complete your profile so the window does not keep coming back; technical, kept 24 hours.
• to-consent: remembers your choice in the cookie banner (consent or refusal); technical, kept 12 months after consent, 6 months after refusal.
• _ga and _ga_<id> (Google Analytics): only with your consent; a random browser identifier that tells visits and sessions apart, kept 2 years. Google Analytics 4 does not store IP addresses, and the data is not linked to your account.
• localStorage to-theme-color, to-theme-mode, to-left-menu-type and to-content-type: interface preferences (theme and layout), stored in your browser until you clear them.
• localStorage to-remembered-email: the e-mail address from the sign-in form, only if you chose to have it remembered; stored in your browser until you clear it.
• sessionStorage to-ref and to-ref-visited: the sharing code of the link that brought you here, so that a sign-up is credited to the fan who invited you; only until you close the browser tab.
• localStorage to-chat-sound: whether the chat should chime on a new message; stored in your browser until you clear it.
• sessionStorage to-chat-open, to-chat-opener-asked and to-chat-teaser-dismissed: the state of the chat window (open, already greeted you, preview dismissed); only until you close the browser tab.

5. Who we share data with

We never sell or rent your personal data. It is shared only with providers we need to run the service:

• Our hosting provider (server operations).
• The e-mail mailbox provider (SMTP) through which we send every e-mail: account e-mails and news alike; like any mail server it sees the recipient address and the message content.
• Google Ireland Limited / Google LLC (Google Analytics 4): traffic statistics, only if you consented in the cookie banner; Google processes the data as our processor under the Google Ads Data Processing Terms, and the transfer to the USA is covered by the EU-US Data Privacy Framework. See policies.google.com/privacy.
• OpenAI (USA): the content of the private chat. The digital avatar's answers and the transcription of voice messages are computed by an OpenAI model. We send your first name, your language, the last fifty messages of the conversation, the page you are on and, for a voice message, the recording itself; we never send your e-mail address. The message of a dedication, if the author dedicated a song to you, is translated the same way. The same model judges and translates the comments under songs: it receives the text of the comment, your language on the site and the title of the song, never your name or e-mail; its decision, the reason for a rejection and the translations are stored with the comment, and the reason is seen by you and the author only.
• Telegram (Telegram FZ-LLC, United Arab Emirates): only if the author has phone notifications on: a short line with your display name (“Jan N.”) and a link into the admin area, without your e-mail address and without the text of the message.
• Some of these providers may process data outside the EU (typically in the USA). Such transfers are covered by the European Commission's standard contractual clauses or an adequacy decision (such as the EU-US Data Privacy Framework).

6. Artificial intelligence in the chat

In the private chat you are answered by the author's digital avatar (Tom Urban AI). It is a program, not a person, and its messages always say so. The real Tom Urban reads the chat and can answer himself at any time.

So that the avatar can answer, we send an OpenAI model your first name, your language, the last fifty messages of the conversation and the page you are on. A voice message is sent for transcription into text; the recording is deleted right after the transcription and only the text remains. We never send your e-mail address.

The avatar may start a conversation itself when you are on the site and we have not written to each other for a while.

Automated decision: the model also assesses whether a message breaks the chat rules. It warns you first; if it happens again we close the chat temporarily (for an hour, then for a day), and on a further breach we lock the account, so you cannot sign in. We always tell you in the chat when it is closed.

You can contest such a decision at tomurban@tomurban.one. A human reviews it, you can put your point of view, and if the decision was wrong we undo it.

7. YouTube API Services and social media

We publish short promotional videos of the author's own songs on his own YouTube channel (Tom Urban, youtube.com/@tomurban-one). To do that, this service uses YouTube API Services: a program on our server uploads the videos to that channel and reads basic data about the channel and the videos it has uploaded (titles, descriptions, status). By using this site you agree to be bound by the YouTube Terms of Service at https://www.youtube.com/t/terms. How Google handles data is explained in the Google Privacy Policy at https://policies.google.com/privacy.

The only data that passes through the YouTube API is the author's own: the data of his channel, the videos he uploads and their titles and descriptions. No data about visitors of this site or viewers of the videos is collected, stored or processed through the API, nothing from it is sold or shared with third parties, and nothing from it is used for advertising. The access token that authorises the uploads is stored securely on our server and is used for this one purpose only.

The author can revoke this access at any time on the Google account security page at https://myaccount.google.com/connections (formerly https://security.google.com/settings/security/permissions). No visitor signs in with a Google account here, so there is nothing for you to revoke.

The same videos are published the same way on the author's own accounts on Instagram and Facebook (Meta), X and TikTok: by our server, only on his own accounts, without any data about visitors of this site. These services apply their own privacy policies: https://www.facebook.com/privacy/policy, https://x.com/en/privacy and https://www.tiktok.com/legal/privacy-policy.

Questions about this section go to tomurban@tomurban.one, like everything else in this policy.

8. How long we keep it

How long we keep data depends on its purpose:

• Account data: for as long as your account exists. Ask for deletion by e-mail; we handle it within 30 days and your comments, chat messages, favorites, dedications and referral records go with the account (except records we must keep by law, such as purchase and tax records). Records of sent e-mails and audit records live out their own periods listed below.
• Sign-in protection records: sign-in attempts expire within minutes; records of requests for verification and password-reset e-mails (including the IP address) are deleted 30 days after the link expired; refresh tokens are deleted as soon as they expire (30 days).
• Administrative audit log: what changed, when, from which IP address and browser, the e-mail address at registration and the reason given when unsubscribing from the news; kept long-term so that security-relevant actions remain traceable.
• Server backups, where made: 30 days at most.
• Sent emails and their open and click records: 12 months, then deleted automatically.
• Comments, chat messages, favorites and referral records: for as long as your account exists; deleting the account deletes them. You can delete your own comments at any time.
• Traffic statistics in Google Analytics: 14 months at the level of individual events, aggregated reports afterwards.
• Chat messages and the transcripts of voice messages: for as long as the account exists; deleting the account removes them.
• Voice recordings: deleted right after they are transcribed into text.
• The queue of phone notifications for the author: 30 days.
• Records of the automated tasks run on the server: 180 days.

9. Your rights

Under the GDPR you can at any time:

• Ask what data we hold about you and get a copy (access, portability).
• Have incorrect data fixed (rectification).
• Have your data deleted or its processing restricted.
• Ask us to delete your account: an e-mail from the account address is enough; we delete it within 30 days.
• Object to processing based on legitimate interest. For news emails the objection is unconditional: use the unsubscribe link in any of them or the switch in your profile, and no further news will be sent.
• Withdraw any consent you have given, at any time, with effect for the future.
• Complain to a supervisory authority: in the Czech Republic the Office for Personal Data Protection (uoou.gov.cz), or the authority in your country.

10. How we protect it

All traffic is encrypted (TLS). Passwords are stored only as strong hashes. Administrative actions are recorded in an audit log, and access to production data is restricted.

11. Age of users

The site and its accounts are meant for people aged 15 or over, the age from which a person can validly consent to data processing by online services in the Czech Republic. We do not knowingly collect data of younger children. If we learn that a child under 15 has created an account, we delete the account and its data. Parents and guardians can reach us at tomurban@tomurban.one.

12. Changes to this policy

If this policy changes, the new version will be published here with an updated date. Substantial changes will be announced to registered users.