bounce Privacy Policy

1. Data controller

The controller of personal data within the meaning of Art. 4(7) GDPR is:

Bounce Sp. z o.o.
ul. Innowacyjna 1, 16-400 Suwałki, Poland
KRS: 0001209432 · NIP: 8442391415 · REGON: 543439882
District Court in Białystok, XII Commercial Division of the National Court Register
Share capital: PLN 75,000.00
E-mail: hello@bounce.radio

2. Data Protection Officer (DPO)

The controller does not meet the criteria requiring the appointment of a Data Protection Officer under Art. 37(1) GDPR (it is not a public authority, does not process data on a large scale on a regular basis, nor does it systematically process special categories of data).

Regardless, for any data-protection matter contact: hello@bounce.radio.

3. Purposes and legal bases of processing

4. Scope of personal data

bounce mobile app (listener):

• Phone number: the basis of login - a one-time SMS code is sent to it; it identifies the listener account
• Profile: nickname (public in rankings), profile photo (optional), birth date/city (optional)
• Voice recordings: recordings created by the listener (e.g. shout-outs) - stored ephemerally and sent to the editorial team
• Activity: track votes, listening history for “wrapped”/rankings, favourites
• Push token: device identifier (FCM/APNs) for notifications

bounce.radio website and bounce Circle:

• Identification data: e-mail, display name (optional)
• Billing data (B2B): company name, tax ID, registered address
• Financial data: support amount (shout-out/tip/subscription), payment history
• Card data: tokenised by Stripe - we only see the mask (last4 + brand). The full card number is NOT stored on our servers
• On-air shout-out content: nickname, message, track request (for moderation and reading on air)
• Technical data: IP address, user-agent, country derived from the IP address, visited page, cookies and similar technologies (section 9); for display ads the IP address is stored only as a hash

Advertising brief at bounce.radio/reklama:

• Contact data: company or brand name, full name, e-mail, phone number (optional)
• Answers about the campaign: goal, industry, channel (on air, the bounce.radio website, both channels or a request for advice) and the chosen ad formats, preferred start (including a specific date) and campaign length, budget range, spot details (ready-made, to be adapted, to be produced or not decided yet; length, type of production)
• Message (optional)
• Entry point and language: the page through which the sender reached the brief (/reklama, the home page or /kontakt) and the form language
• Technical data: IP address, used only to prevent abuse - it limits submission attempts and is shown in the e-mail to the advertising team so they can judge whether the brief is spam. We do not pass the sender’s IP address to the station’s submission system. The limit on confirmation e-mails uses hashes of the e-mail address and its domain, not the address itself

The brief is sent by e-mail to the advertising team (ads@bounce.radio) and a copy goes to the station’s submission system (own server infrastructure, section 6). We send a confirmation of receipt of the brief to the address provided - at most one per address within 24 hours. The form does not store the answers or contact data in the browser (either in cookies or in any other browser storage).

Promo Pool at bounce.radio/promo-pool:

• Contact data: artist name, e-mail, phone number
• Submission: type (a track, a set or an application for bounce Department), the title of the track or set or the name of the show, an MP3 file (up to 30 MB) or a download link on a host chosen by the sender, a statement that the sender holds the rights to the material and agrees to it being broadcast, the form language
• Optional details: vibe (up to three genres), tempo, label or self-release, release date, up to three links to the artist’s profiles, a description and, for an application for bounce Department, the idea for the show and whether there is an own vocal intro and outro
• Correspondence about the submission: messages from the music team and the sender’s replies in the conversation at bounce.radio
• Technical data: IP address, used only to prevent abuse - it limits attempts to submit, to upload files and to open the conversation, and is shown in the e-mail to the music team. We do not pass the sender’s IP address to the station’s submission system: its request limit receives only a hash of the address, computed with a key the submission system does not know, and it is not stored with the submission. The limits on the website server also keep hashes of the IP address, and the limit on confirmation e-mails uses hashes of the e-mail address and its domain, not the address itself

A Promo Pool submission is sent by e-mail to the music team (promo@bounce.radio, with the MP3 file attached and the sender’s IP address) and goes to the station’s submission system (own server infrastructure, section 6) together with the demo file, which we store outside the publicly accessible folders of the server. The file uploads to the website server in the background before the submission is sent and reaches the submission system only together with the sent submission; until then a copy of it is kept on the website server, and a file abandoned in the form (another file or another type of submission chosen) is deleted at once. We send a confirmation with the submission number to the address provided - at most three per address within 24 hours - containing a link to the conversation with the music team at bounce.radio. The conversation shows the status of the submission and the team’s messages, and the sender can reply; replies are added to the submission in the submission system, and the team’s messages also arrive by e-mail, each with a link to the same conversation. Each of these links works for 30 days after the team’s last message (or after the submission, if the team has not written yet), and the system stores only their hashes; anyone who knows a link can see the conversation. The conversation page does not load the Ahrefs Web Analytics script or ads. The form does not store the answers or the file in the browser.

The controller does not process special categories of personal data (Art. 9 GDPR) or data on criminal convictions (Art. 10 GDPR).

5. Retention periods

• Financial data (payments, invoices): 5 years from the end of the accounting year (Polish Tax Ordinance)
• Account data during an active relationship + 6 years after it ends (limitation period for claims)
• Account after deletion: 30-day soft-delete (recoverable) → anonymisation (financial data kept pseudonymised for accounting requirements)
• Session in the Circle patron panel (bounce_circle_sesja cookie): up to 1 year from signing in with the e-mail code or link
• Voice recordings: ephemeral - removed after processing/delivery to the editorial team
• System logs (IP, user-agent): 90 days
• Marketing cookies (after consent): max 24 months or until consent withdrawal
• Fraud-detection data: 3 years
• Advertising brief: kept in the station’s submission system for 12 months after it is sent, then anonymised (company name, full name, e-mail, phone, answers and message removed), with the entry deleted after 24 months; the advertising team’s notes on the entry, including the record of replies sent from that system, are deleted only together with the entry. The brief e-mail (including the IP address) is kept in the advertising team’s mailbox for 12 months after it is sent. The entry with the IP address in the attempt limit expires 15 minutes after the first attempt, and the hashes of the e-mail address and its domain in the confirmation limit 24 hours and 1 hour after they are stored; an expired entry is removed from the server’s memory at most a minute later
• Promo Pool: the submission (with the phone number) in the station’s submission system - 12 months after it is sent, then anonymised (e-mail, phone and content removed), with the entry deleted after 24 months; submissions selected for broadcast are kept for the broadcast period of the track + 12 months (settlements with collective management organisations). The demo file in the station’s submission system - 1 month after the submission, then we delete the file and the entry stays with a note that the file was deleted; a file that reached the submission system without a submission (failure while sending) - 24 hours; the copy of the file on the website server - until the submission is sent, at most 2 hours (interrupted upload - 1 hour), together with a hash of the IP address it was uploaded from. Correspondence about the submission (messages in the conversation with the music team) - together with the submission: the content of the messages is anonymised after 12 months and deleted together with the entry after 24 months; for submissions selected for broadcast both periods run from the end of the broadcast. Each conversation link (from the confirmation and from the team’s messages) works for 30 days after the team’s last message (or after the submission). The entry with the hash of the IP address in the limit on submission and reply attempts expires 30 minutes after the first attempt, in the file-upload limit 30 minutes, in the limit on opening the conversation 10 minutes, and the hashes of the e-mail address and its domain in the confirmation limit 24 hours and 1 hour after they are stored The Promo Pool submission e-mail (including the MP3 file and the IP address) is kept in the music team’s mailbox for 12 months after it is sent.

6. Recipients / processors

The controller entrusts the processing of personal data to the following entities (under Art. 28 GDPR - data processing agreements):

Cookie-free visit statistics (Ahrefs Web Analytics)

The pages of the Service with the menu, footer and player bar run the Ahrefs Web Analytics script from analytics.ahrefs.com (it is not present in the editorial panel, the embeddable player, the player window, the /app/web app or the Chromecast receiver app). On every page view, move to another page of the Service, link click and form submission the script sends Ahrefs the page address, the address of the page the User came from, the languages set in the browser, the page title, the screen size and pixel density, and - for a link click - the link address and whether Ctrl, Shift or Cmd was held, for a form submission - the address the form is sent to (without the form content). The browser also passes the IP address and browser information (User-Agent). The script does not store or read cookies or any other data in the browser, so it runs regardless of the choice in the privacy settings. The legal basis is the controller’s legitimate interest (Art. 6(1)(f) GDPR); the User has the right to object (section 8).

Content and services loaded from third-party servers

Some elements of bounce.radio come directly from the servers of other entities. The User’s browser then connects to that entity’s server and passes at least the IP address, browser and device information (User-Agent) and the fact that the request comes from bounce.radio (without the address of the specific page). The entities in the table below - except Google Analytics, which is also covered in the table above - process this data as separate controllers under their own privacy policies. For the collection and transmission of data by an embedded element the controller may be their joint controller (Art. 26 GDPR).

Players and posts embedded in content

In news, on event and show pages and on other pages of the Service the editorial team embeds Spotify, YouTube, Tidal and Apple Music players and posts from Instagram and X. They load right after the page loads, regardless of the choice in the privacy settings, because they are part of the editorial content. The legal basis is the controller’s legitimate interest (Art. 6(1)(f) GDPR): presenting editorial content, including the tracks, videos and posts of the artists we write about. YouTube players are loaded from youtube-nocookie.com (except the YouTube Music player). The providers of players and posts may store their own cookies and data in the browser - the list of entries known to us is in section 9. The User can limit this in the browser settings by blocking third-party cookies and data or selected domains; the player or post may then not be displayed. The User also has the right to object (section 8).

Track covers are fetched through the bounce.radio server; only when our server does not respond may the browser fetch a cover directly from the music service’s server (e.g. Spotify, Apple, Deezer, Last.fm).

Casting to Chromecast

When the User casts bounce to a Chromecast device (from the mobile app or from the website), the device loads our receiver app from bounce.radio (bounce.radio/cast). The device then downloads the Google Cast receiver library (gstatic.com, and at runtime also ajax.googleapis.com) and the audio stream from the bounce server, and during playback asks bounce.radio every 10 seconds which track is playing; when the track changes it fetches the cover address from bounce.radio and then the cover itself. These requests come from the Chromecast device, i.e. from the IP address of the network it runs in. The bounce receiver app code stores nothing on the device. The User uses the device itself and its software under Google’s terms.

Apart from the entities listed in this section, the controller does not sell, exchange or share personal data, except where required by law (e.g. law-enforcement authorities).

7. Transfers to third countries

Some entities from section 6 are established outside the European Economic Area: Stripe Inc., ElevenLabs Inc., Google LLC, Amazon, Cloudflare, Inc. and AdsWizz Inc. (USA), Ahrefs Pte. Ltd. (Singapore) and Unmuted Limited (Streamerr, United Kingdom). The Spotify player sends error reports to Functional Software, Inc. (Sentry, USA), and the Tidal player loads resources from the squarecdn.com and datadoghq-browser-agent.com domains. Providers of players and posts established in the EEA (Spotify AB, TIDAL Music AS, Apple Distribution International Limited, Meta Platforms Ireland Limited, X Internet Unlimited Company) may transfer data to entities of their group outside the EEA under their own privacy policies. Transfers to countries for which the European Commission has not found an adequate level of protection take place on the basis of:

• Standard Contractual Clauses (SCC) adopted by the European Commission in decision 2021/914 of 4 June 2021
• EU-U.S. Data Privacy Framework for certified US entities (incl. Google, Stripe, Amazon, Cloudflare)

8. Your rights (Art. 15-22 GDPR)

• Right of access (Art. 15) - the app/portal lets you view your data; full JSON export on request
• Right to rectification (Art. 16) - in the app/portal
• Right to erasure (“right to be forgotten”, Art. 17) - “Delete account” in the app (Strefa bounce → Settings → Delete account); 30-day soft-delete + anonymisation, billing data kept until the end of the retention period
• Right to restriction (Art. 18)
• Right to data portability (Art. 20) - full JSON export of your data
• Right to object (Art. 21) - to processing for marketing or profiling and to processing based on the controller’s legitimate interest
• Right to withdraw consent (Art. 7(3)) - one click in every marketing e-mail, and cookie consent in the privacy settings on the website (the “Cookies” link in the footer); does not affect lawfulness of processing before withdrawal
• Right to lodge a complaint with the supervisory authority (Art. 77):

  President of the Personal Data Protection Office (UODO)
  ul. Stawki 2, 00-193 Warsaw, Poland
  kancelaria@uodo.gov.pl · uodo.gov.pl

9. Cookies and similar technologies

The website uses cookies and similar technologies (browser local storage). Under Art. 399 of the Polish Electronic Communications Law, storing information on the User’s device and accessing it - other than strictly necessary - requires prior consent.

Cookie categories

• Necessary (no consent) - session and login, CSRF token, the Cloudflare security cookie after browser verification, the signed Circle patron panel session, the saved choice of consent, language, stream quality, volume, player-bar settings and accessibility settings, player markers (audio ad once per session, the Chromecast library after playback starts and during casting). Basis: Art. 399(3) of the Electronic Communications Law (storage necessary to provide the service requested by the User).
• Analytics (consent) - Google Analytics 4 on the website, Firebase Analytics in the app and the A/B-test identifier (bounceAnonId). Without consent the Google Analytics script does not load and the A/B-test identifier is not created. Withdrawing consent stops measurement immediately on the open page and deletes the _ga and _ga_* cookies; the A/B-test identifier is deleted on the next server check (within 60 s). Ahrefs Web Analytics visit statistics store and read nothing in the browser and run without consent (section 6).
• Marketing (consent) - measuring audio ad views (AdsWizz) and measuring the performance of display ads from our own ad server (the bounce_ad_session tab identifier: frequency cap, viewable time, clicks, audience groups). Without this consent ads still show and play, but audio ad views are not reported and for display ads we only count the view itself, without an identifier (section 3). Marketing consent does not cover players and posts embedded in content - they load regardless of it (section 6). We do not use social-media advertising pixels or Google Ads remarketing.
• Third-party content (no consent; basis: Art. 6(1)(f) GDPR - section 6) - Spotify, YouTube, Tidal and Apple Music players and Instagram and X posts embedded in content, OpenFreeMap maps and the Google Cast library (after playback starts). Their providers may store their own data in the browser (list below). This can be limited in the browser settings by blocking third-party cookies and data.

Cookies and browser storage

The bounce_circle_email cookie, used by the Circle patron panel until 29.09.2026, is no longer set or read; the Service deletes it on the first visit to any page.

Consent can be withdrawn at any time - the “Cookies” link in the website footer opens the privacy settings. Withdrawal takes effect immediately, also on the open page. Cookies and data stored by the Service and by providers of embedded content can also be deleted or blocked in the browser settings.

10. Profiling and automated decisions

The controller does not make decisions based solely on automated processing (Art. 22 GDPR) producing legal effects or similarly significantly affecting the User.

Exception: fraud detection (Stripe Radar) may decline a transaction - this is an automated decision, but the User may appeal by contacting the controller; the decision is subject to human review.

With marketing consent the controller links display-ad views and clicks within one browser tab (tab identifier) to limit how often the same ad is shown and to measure its performance, including in audience groups that saw or clicked a given ad. This has no legal or similarly significant effects on the User.

Based on the answers in an advertising brief, the server picks matching items from the advertising offer as an internal hint for the advertising team. The campaign proposal is prepared by the advertising team. The controller does not profile the person sending the brief or make decisions about them based solely on automated processing (Art. 22 GDPR); only the form’s safeguards (attempt limit, limit on confirmation e-mails, anti-spam check) work automatically.

11. Security

The controller applies technical and organisational measures appropriate to the risk:

• Transport encryption - TLS 1.3 + HSTS
• Card-data tokenisation - PCI-DSS Level 1 on Stripe’s side
• Fraud detection - Stripe Radar
• Login tokens in the device secure storage (Keychain iOS / EncryptedSharedPreferences Android); app attestation - Firebase App Check
• Encrypted at-rest backups
• Access control - role-based access control + 2FA for staff
• Audit log of sensitive-data changes (who, when, what)

In the event of a personal-data breach likely to result in a high risk to Users, the controller will notify UODO within 72 hours and inform Users without undue delay (Art. 33-34 GDPR).

12. Changes to the policy

The controller may amend this policy in the event of changes in law or service functionality. Material changes are communicated by e-mail 30 days in advance. The current version is always available at /wesprzyj/polityka-prywatnosci (PL) and /mobile-privacy-en (EN).

Change history

• 23.10.2026 - Promo Pool: scope of data (MP3 file or link, optional details, statement on broadcast rights), the demo file kept in the station’s submission system for one month, the conversation with the music team at bounce.radio and its retention, the copy of the submission in the music team’s mailbox (12 months); registry court and share capital in the controller’s details
• 22.10.2026 - advertising brief (bounce.radio/reklama): scope of data, purpose and legal basis, retention, IP address for abuse prevention, offer hint for the advertising team without profiling; SEOHOST (e-mail in the bounce.radio domain, also for the contact and Promo Pool forms) among processors; Polish version only: retention of contact and Promo Pool submissions counted from sending
• 30.09.2026 - description of content and services loaded from third-party servers (players and posts embedded in content, maps, Google Cast, audio ads, Stripe Checkout) and of casting to Chromecast; cookie-free visit statistics (Ahrefs Web Analytics); Cloudflare and the backup stream server among processors; display ads from our own ad server and measuring their performance with consent; A/B tests with analytics consent; list of cookies and browser storage; legal basis for cookies under the Electronic Communications Law; withdrawing consent in the privacy settings
• 22.08.2026 - Polish version only: contact and Promo Pool forms (phone number, purpose and retention of submissions)
• 11.07.2026 - previous version