Privacy Policy
How we process personal data under the GDPR. Last updated 24 October 2026.
1. Controller
SORRIXSiemensstraße 60
Linz, Austria
E-mail: support@sorrix.com
Phone: 0062609164
Privacy questions and requests: support@sorrix.com. We have not appointed a data protection officer because the legal requirement (Art. 37 GDPR) does not apply to us.
2. What we process, why and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account: e-mail, username, display name, password hash (Argon2id), role, e-mail verification and onboarding status | Create and run your account, send service e-mails | Art. 6(1)(b) contract | Until you delete the account |
| Sessions and security events: session token hash, IP address and browser string of the session, login and 2FA events, rate-limit counters | Keep you signed in; protect accounts and the Service from abuse | Art. 6(1)(b), (f) legitimate interest in security | Sessions: up to 30 days; counters: 24 hours; security events: with the audit log (see below) |
| Two-factor data: encrypted authenticator secret, hashed recovery codes | Secure your account (optional) | Art. 6(1)(b), (f) | Until you switch 2FA off or delete the account |
| Library: likes, saved albums, followed artists, playlists | Provide the library features | Art. 6(1)(b) | Until removed by you or account deletion |
| Listening history and search history (can be switched off in Settings; private by default) | Recent plays, recommendations on your Discover page, search suggestions | Art. 6(1)(b); consent for optional history (Art. 6(1)(a)), withdrawable | History until you clear it; the last 20 searches |
| Taste preferences chosen in onboarding | Personalise the Discover page | Art. 6(1)(a) consent | Until you change them or delete the account |
| Play events: track, hashed listener identifier, hashed IP address, listened time, time | Count plays fairly and detect manipulation; creator statistics | Art. 6(1)(f) legitimate interest in fraud-resistant statistics | 12 months; totals are kept as aggregates |
| Creator data: profile, uploads, AI declaration, rights declaration (with timestamp and hashed IP), evidence documents (plan/licence proofs, screenshots, records) | Review AI origin and commercial rights; show verification status; defend against claims | Art. 6(1)(b), (f); Art. 6(1)(c) where law requires records | While the track exists and for 3 years after the last decision, then deleted (limitation period for civil claims) |
| Reports and complaints, moderation decisions, audit log of staff actions | Handle notices and complaints; accountability | Art. 6(1)(c) (DSA), (f) | 3 years after closure |
| E-mails we send (verification, password reset, review results) | Service communication | Art. 6(1)(b) | Not stored by us beyond delivery logs |
Providing the account data is necessary for the contract; without it you cannot use an account. You are not obliged to provide optional data (history, preferences, bio).
3. Evidence documents
Documents you upload as evidence are stored in a private area that is not reachable by URL. Only the creator and authorised reviewers, moderators and administrators can open them, and every access is logged. They are never shown publicly; the public verification panel only states what was checked and when. Please redact payment-card numbers, passwords and unrelated personal data before uploading, and never upload credentials.
4. Recipients and processors
- Hosting and infrastructure: Hostinger International Ltd. (hosting provider), as our processor under a data processing agreement.
- E-mail delivery through the SMTP provider we configure for sending service e-mails (processor).
- Authorities and courts where we are legally obliged, and parties we must inform in a notice-and-action procedure (for example the reporting party receives the outcome).
We do not sell personal data, show advertising, or use analytics or tracking tools. Where a processor or sub-processor is outside the EEA, transfers rely on an adequacy decision or the EU Standard Contractual Clauses.
5. Automated decisions
There is no decision with legal or similarly significant effect based solely on automated processing. Verification decisions are taken by people. Automated file checks (format, metadata, duplicate hashes, optional malware scan) are only supplementary signals, and AI classifiers are never used as proof.
6. Your rights
You have the right of access (Art. 15), rectification (16), erasure (17), restriction (18), data portability (20) and objection (21), and you may withdraw consent at any time with effect for the future (7(3)). In Settings you can download your data as a JSON file, change privacy options, and delete your account. Otherwise write to support@sorrix.com; we respond within one month. When you delete your account we erase or anonymise your data; records we must or may keep (moderation and verification records, the audit log) are retained for the periods above and detached from your profile where possible.
You can complain to the Austrian supervisory authority: Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, www.dsb.gv.at, or to the authority in your EU member state.
7. Security
Passwords are hashed with Argon2id; sessions use HttpOnly, Secure cookies; connections are encrypted (HTTPS/HSTS); two-factor authentication is available; staff access is role-based and audited; uploads are validated and evidence is stored privately; IP addresses are stored only as keyed hashes for play counting.
8. Cookies and local storage
We use only strictly necessary cookies and local storage. Details: Cookie notice.
9. Children
The Service is not directed at children under 16. If we learn that we hold data of a child without parental consent we delete it.
10. Changes
We update this policy when our processing changes and show the date above. We will inform registered users of material changes.
Last updated 24 October 2026. Questions about this document: support@sorrix.com.