WAVR Social — Privacy Policy

Last updated: June 12, 2026

1. Data Controller

The data controller responsible for your personal data is:
Bjørn Aksel Bergan, Norway
Contact: berganbjornaksel@gmail.com

2. What Data We Collect

• Account data: email address, display name, handle, account type (artist/listener), avatar, banner image, bio, social links, and profile settings.
• User content: audio uploads (Singles, EPs, Albums), cover visuals, descriptions, tags, comments, mentions, hashtags, and playlists.
• Social activity: likes, follows, followers, notifications, and playback interactions.
• Payment & entitlement data: transaction reference IDs and payment status from PayPal webhooks or crypto payment submissions, used solely to grant and verify Pro, Supporter, Game Pass, paid playlist, or artist badge access. We do not store full card numbers or PayPal credentials.
• Coin (virtual currency) data: your coin balance, coin purchase history, coins sent as tips to artists, and coins spent on track boosts. This data is stored to operate the in-app economy and for anti-fraud purposes.
• Game data: game play history, tracks played, game pass status, game scores, and boost campaign records.
• Terms acceptance: a timestamp recording when you accepted our Terms of Service and Privacy Policy, stored for legal compliance purposes.
• Referral data: referral codes, invite counts, and reward status.
• Access codes: redeem/promo code usage records for anti-abuse and entitlement tracking.
• Technical data: browser type, device type, IP address (via Firebase infrastructure), error logs, and app diagnostics.
• Activity timestamps: last active time and upload history used for profile features and anti-abuse.

3. Why We Collect It — Legal Basis

• Contract performance (GDPR Art. 6(1)(b)): to provide the platform — authentication, upload, playback, social features, and profile discovery.
• Legitimate interests (GDPR Art. 6(1)(f)): security, fraud prevention, abuse detection, debugging, and product improvement.
• Legal obligation (GDPR Art. 6(1)(c)): compliance with Norwegian and EU law, tax obligations, and responses to valid legal requests.
• Consent (GDPR Art. 6(1)(a)): where you have explicitly opted in to optional features or notifications.

4. Payments, Coins, and Game Pass

Artist tips, subscriptions (Pro, Supporter, Game Pass), coin pack purchases, and paid content are processed by PayPal. When you initiate a payment, you interact directly with PayPal’s checkout. WAVR Social receives a payment notification (IPN/webhook) containing a transaction ID, amount, and status — this is stored to grant and verify entitlements and coin balances. WAVR Social does not receive or store your PayPal password or full financial details. PayPal’s own privacy policy applies to data you provide them: paypal.com/privacy.

Coins (virtual currency): your coin balance and transaction history are stored in our database (Google Firestore). This data is used to operate the in-app coin economy, including coin tips to artists and track boost purchases. Coin data may be reviewed by platform administrators for anti-fraud purposes. Coin data is retained for the lifetime of your account and up to 5 years after closure for accounting obligations.

4c. AI Audio Processing (Mastering, Remix Bot & WAVR Studio)

WAVR Social offers AI-powered audio tools as part of the platform. When you use these features, the following processing occurs and the following data is involved:

• AI Mastering (Upload): When you apply mastering to a track during upload, your audio is processed locally in your browser using the Web Audio API. No audio data is sent to an external server for mastering — the process runs entirely on your device. The resulting mastered file is stored in Firebase Storage under your account, the same as a regular upload.
• Remix Bot (Full Genre Transform): When you use the full-genre remix feature in WAVR Studio, your audio file is temporarily uploaded to Google Cloud Storage, processed by our remix server (Google Cloud Run), and the result is returned and stored. The temporary source upload is used solely for this operation and is not shared with third parties. We do not use your audio to train AI models.
• WAVR Studio (client-side AI): Clip editing, BPM detection, arrangement analysis, and most AI commands in WAVR Studio process audio locally in your browser using the Web Audio API. No audio is transmitted to an external server for these operations except where the Remix Bot (Cloud Run) is explicitly invoked.
• AI action credits: We log the number of AI actions you perform per month (by user ID) in Firestore to enforce free-tier usage limits. No audio content is stored alongside this data.

Legal basis for AI audio processing: Contract performance (GDPR Art. 6(1)(b)) — to provide the AI features you requested as part of the platform service.

4c. Live Party Queue

When you submit a track to the WAVR Live Party Queue, we store your user ID, display name, handle, and the track’s title, audio URL, cover image, genre, and duration in our database for the duration of the event. This data is visible to all signed-in users on the platform while the queue is active. Queue submissions are deleted when an administrator resets the queue or closes the event. Submission data is not shared with third parties.

5. How We Use Your Data

• Authenticate your account and keep it secure.
• Store and serve your audio uploads, visuals, and profile content to you and other users.
• Showcase, stream, and promote uploaded music — including on official WAVR Social live streams and broadcasts (such as Twitch, YouTube, Discord, and similar platforms), at community events, in curated playlists, and in promotional content on WAVR Social social media accounts — as part of normal platform and community activity.
• Power social features: follows, likes, comments, notifications, and the activity feed.
• Process access codes, Pro/Supporter/Game Pass subscriptions, fan tips, paid playlist access, coin purchases, and track boosts.
• Operate the WAVR Game, including tracking game play history, game pass validity, spotlight campaigns, and coin transactions.
• Run the referral programme and track reward eligibility.
• Detect and prevent abuse, spam, fraud, and policy violations.
• Comply with legal obligations and respond to lawful requests from authorities.

6. Cloud Storage and Infrastructure

All uploads (audio, images) are stored securely in Google Firebase Storage. User data, social activity, and app state are stored in Google Firestore. Authentication is handled by Google Firebase Authentication. Google’s infrastructure is GDPR-compliant and includes appropriate safeguards for data transfers. See Firebase Privacy.

7. Who We Share Data With

We do not sell your data. We share limited data only with:

• Google Firebase / Google Cloud — hosting, database, storage, and authentication infrastructure.
• PayPal — payment processing for tips, subscriptions, and paid content.
• Law enforcement or courts — when required by law or to protect safety.

8. International Transfers

Your data may be processed on Google Cloud servers which may be located outside Norway or the EEA. Google relies on Standard Contractual Clauses (SCCs) and other GDPR-approved safeguards for transfers.

9. Data Retention

• Account and content data is retained as long as your account is active.
• After account deletion, we remove personal data within a reasonable period, except where retention is required for legal, accounting, or fraud-prevention purposes.
• Payment metadata may be retained for up to 5 years to meet Norwegian accounting obligations.
• Backup systems may retain data briefly after deletion requests are processed.

10. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data (“right to be forgotten”).
• Restriction — request we limit processing of your data in certain cases.
• Data portability — receive your data in a portable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at berganbjornaksel@gmail.com. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

11. Security

We apply technical and organisational measures to protect your data, including Firebase security rules, authentication controls, and HTTPS encryption. No system is perfectly secure — please also protect your own account credentials and devices.

12. Children

WAVR Social is not directed at children under 13 (or under 16 in the EEA without parental consent). If we become aware that a child under the applicable minimum age has registered, we will delete the account.

13. Cookies and Local Storage

WAVR Social uses browser local storage and session storage to maintain your login session and preferences. We do not currently use third-party advertising cookies or tracking pixels. Firebase may set functional cookies for authentication.

14. Changes to This Policy

We may update this policy as the platform evolves. The date at the top reflects the current version. For significant changes, we will notify users via the platform where reasonably possible.

15. Contact & Data Requests

For privacy questions, data requests, or to exercise your rights:
berganbjornaksel@gmail.com

Related legal page: Terms of Use

By using WAVR Social, you acknowledge you have read and understood this Privacy Policy.