Privacy Policy

1. Data controller and contact

The controller of the database is DMGREMIXPOOL, registration number (to be updated), (to be updated) (“DMG” or “we”). For privacy questions and to exercise your rights: dmgremixpool@gmail.com or 052-123-4567.

2. Do you have to provide information?

There is no legal obligation to give us information; it is up to you. However, without your full name, email address and phone number we cannot open an account, match a payment or provide the service. Without microphone permission you cannot use live identification, and without turning on notifications you will not receive them. Guests can browse part of the site without giving any details.

3. What we collect

3.1 Account details: full name, email address, phone number, preferred language and password. The password is stored by our authentication provider in one-way hashed form, and we cannot see it.

3.2 Purchases and subscription: requests you submitted (package or credits, and any note you wrote), DMG's decision and the reason for it, the approved price, subscription dates, remaining downloads and credits, and credit transactions. Payment is made by bank transfer outside the site. No card or bank account details are collected on the site, but to match your payment and issue a receipt we may receive from the bank or from you details such as the payer's name, date and amount.

3.3 Use of the service: downloads (which track, when, whether a credit was used, and the download ID), plays, tracks you marked as heard or liked, personal sets and playlist links you pasted (the full link is stored), and display and player preferences saved in your account.

3.4 Personal files: every downloaded file carries an inaudible mark linked to the download ID, and the file's metadata fields contain your full name, email address and the download ID (see section 9 of the Terms). These details stay in the downloaded file, and we have no way to remove them from files already held by you or by others.

3.5 Live identification: when you use this tool, the microphone records up to 8 seconds of ambient sound, which may also include people's voices. The recording is sent to DMG's processing server, converted into an acoustic fingerprint, compared with the catalog and deleted as soon as processing ends. We do not keep the recording and do not use it to identify people. We only keep a record that an identification was made and the number of results, linked to your account.

3.6 Usage data (analytics): we collect ourselves, without third-party analytics or advertising tools, events such as page views, demo or preview plays, download starts, sign-up, sending a request, turning notifications on or off, and live identification. For each event we store the event name, the page path (without parameters), language, referring page, browser and device type (user agent), a random session ID kept only in the browser tab, and the time. If you are signed in, your account ID is stored as well. If your browser sends a Global Privacy Control signal, it will not send events; sign-up, request and live-identification events are recorded on the server in any case.

3.7 Notifications: if you turn on push notifications, we store the subscription endpoint your browser creates, its encryption keys, your language and browser type.

3.8 Communications: the content of your enquiries by email, WhatsApp or phone, accessibility reports and infringement notices, and a record of emails sent to you (message type, address and status).

3.9 Technical data: our hosting and infrastructure providers automatically process IP addresses and connection data in system logs for operation and security. Our application itself does not store IP addresses in its tables.

3.10 Admin actions: actions by DMG staff on accounts (such as approving a request, updating credits, blocking and deleting) are recorded in a tamper-proof activity log, including a snapshot of the details before and after the action.

3.11 We do not ask for or knowingly collect information of special sensitivity, such as health information, national ID numbers or biometric data.

4. Why we use information

4.1 We use information to: open and manage your account and verify sign-in; match payments, approve requests, issue receipts and manage subscriptions, quotas and credits; prepare personal files and deliver downloads; protect the pool, trace the source of a leaked file, prevent abuse and enforce the Terms and copyright; provide tools you asked for (live identification, sets, playlist import and notifications); send operational messages; provide service and support; improve the service based on aggregated data; secure our systems; and comply with legal obligations and defend or bring legal claims.

4.2 We will not use information for a purpose incompatible with these purposes without telling you, and without your consent where the law requires it.

4.3 Decisions to approve or reject a request or to block an account are made by a person. Track recommendations and automatic transitions in the player are generated automatically and have no legal effect on you.

5. Messages, marketing and notifications

5.1 Operational messages are sent by email: sign-up verification, sign-in code or link, password reset, approval or rejection of a request, and reminders before and when your subscription ends. These messages are part of the service.

5.2 We do not currently send marketing messages. If we do in the future, marketing by email, SMS or WhatsApp will only be sent in accordance with section 30A of the Communications (Telecommunications and Broadcasting) Law, 5742-1982: with your express consent, or to an existing customer about similar services after they were given an opportunity to refuse. Every such message will include a simple way to unsubscribe.

5.3 Push notifications are sent only to devices where you turned them on, and cover new content in the pool and service updates. You can turn them off at any time in your profile or browser settings. Notifications are delivered through the push service of your browser or operating system vendor (such as Google, Apple, Mozilla or Microsoft).

6. Who we share information with

6.1 We do not sell personal information, do not pass it to advertisers and do not use third-party advertising or tracking tools.

6.2 Providers that process information on our behalf, only to run the service and subject to confidentiality and security obligations: Supabase (database, authentication, file storage and server functions; data is stored in the European Union region, in Frankfurt, Germany); Netlify (website hosting and application servers; requests are handled on a global server network, and application servers may run in the United States); Google Cloud (DMG's processing server for preparing personal files, leak detection and live identification, running in the Frankfurt region); Resend (sending emails); and browser vendors' push services (delivering push notifications to those who turned them on).

6.3 If you choose to contact us on WhatsApp, the conversation is also subject to the terms and privacy policy of WhatsApp (Meta).

6.4 Other parties, only when necessary: DMG's accountant and legal advisers; competent authorities, when required by law or court order; rights holders, law enforcement or a court, in the case of a leak or infringement and to the extent needed to investigate and enforce; and anyone who acquires or continues the service, subject to a commitment to honour this policy.

6.5 External components and sources: cover images in the charts load directly from Apple's and Beatport's servers, so your browser contacts them (and discloses to them, among other things, your IP address) when you view the charts. Chart data, artwork from the public Deezer and Apple (iTunes Search) catalogues and lyrics from the LRCLIB database are fetched by our servers or by DMG staff when uploading tracks, using only track and artist names, without any personal information about you. WhatsApp links lead to the WhatsApp website.

7. Transfers outside Israel

Some of our providers store or process information outside Israel, in European Union countries and in the United States. Such transfers are made in accordance with the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001: to countries where European Union data protection law applies, or on the basis of contractual commitments by the providers to protect and secure the information and not to transfer it onward except to provide the service.

8. Security

8.1 We take reasonable, industry-standard measures to protect information, including: encrypted connections (HTTPS); encryption at rest by our infrastructure providers; database-level access rules so each customer can reach only their own data; keeping original files in private storage not accessible to customers; delivering downloaded files only to the signed-in account that made the download, and only for a short time; limiting admin panel access to authorised staff; and a tamper-proof log of admin actions.

8.2 No system is completely secure. If a serious security incident occurs, we will act under the data security regulations, including reporting to the Privacy Protection Authority, and will notify affected individuals where the law or the Authority requires it, or where needed to let them protect themselves from harm.

8.3 Keep your password safe, sign out of shared devices, and tell us immediately if you suspect unauthorised use of your account.

9. How long information is kept

9.1 Account details are kept while the account is active.

9.2 After an account is closed or deleted: the name is replaced with a generic label, the phone number is deleted, the sign-in email address is replaced with an anonymous address, and access to the account is blocked. Records of requests, subscriptions, payments, downloads and credits are not deleted, because they are needed for bookkeeping obligations and enforcement of rights, and are kept for as long as required for those purposes (as a rule, at least 7 years, and longer if proceedings are under way or expected). Some records, such as the admin activity log and the record of emails sent, may continue to include identifying details during that period.

9.3 Analytics data is deleted automatically 180 days after collection.

9.4 Personal files prepared for download are deleted from our servers 72 hours after they were prepared (the download record is kept as described in section 9.2).

9.5 Live-identification recordings are not kept: they are deleted as soon as processing ends. Files uploaded by DMG staff for leak checks are deleted immediately after the check.

9.6 A notification subscription is kept until you turn notifications off, or until the push service reports that it is no longer valid.

9.7 Backup copies held by infrastructure providers are deleted on their regular cycles.

10. Your rights

10.1 Right of access: to inspect information about you held in the database (section 13 of the Protection of Privacy Law).

10.2 Right to correction and deletion: to ask us to correct or delete information that is not accurate, complete, clear or up to date (section 14 of the Law).

10.3 Closing your account: to ask us to close your account and delete identifying details, subject to records that must or may justifiably be kept as described in section 9.

10.4 Marketing and notifications: to ask not to receive marketing and to be removed from a database used for direct mailing (section 17F of the Law), and to withdraw consent to marketing or notifications at any time.

10.5 To exercise a right, write to dmgremixpool@gmail.com from your account email address, or in another way that lets us verify your identity. We will reply within 30 days. If we refuse a request we will explain why, and you may apply to the court as provided by law or file a complaint with the Privacy Protection Authority.

11. Cookies and browser storage

11.1 The site does not use third-party advertising or tracking cookies. We only use the following, which are needed to run the service and to keep preferences you chose:

Sign-in cookies (from Supabase, with names starting sb-): keep you signed in, for up to about 400 days or until you sign out. Without them you cannot sign in.

Language cookie (NEXT_LOCALE): remembers the language you chose, until you close the browser.

Local storage (localStorage): accessibility menu settings and the AutoMix setting.

Tab storage (sessionStorage): a random analytics session ID, deleted when the tab is closed.

IndexedDB: a copy of the catalog for fast search (for members), and the permission for a folder you connected for downloads (if you did).

Cache (service worker): site files and copies of pages you visited, for fast loading and offline use, including pages in the member area. On a shared device, we recommend signing out and clearing the site data in your browser.

11.2 You can delete or block cookies and storage in your browser settings. Blocking sign-in cookies will prevent you from signing in.

12. Minors

The service is for people aged 18 or over. We do not knowingly collect information about minors. If we learn that an account was opened by a minor, we will close it and delete their details, subject to section 9.

13. Changes to this policy

We will update this policy when the service or the law changes, and the update date appears at the top of the page. A material change in how information is used will be published on the site and emailed to customers before it takes effect, and where the law requires it we will ask for your consent. The Hebrew version of this policy prevails over this English translation.