1. Who We Are
1.1ZeroOne Beats ("we", "us") operates the free song submission system at zeroonebeats.com/submit and the paid ZOB Premium subscription. This policy explains what personal data we collect across both services, why, and what your rights are.
2. Data We Collect
| Data | Source | Purpose | Lawful Basis |
|---|---|---|---|
| OAuth display name | Your chosen sign-in provider (Twitch, Google, or Discord) | Shown to you as confirmation of who you're signed in as | Legitimate interest |
| OAuth provider & user ID | Your chosen sign-in provider | Identity verification; enforcing the 3-submissions-per-24h rate limit | Legitimate interest |
| Artist name, song title, track link, artist profile URL | You (submission form) | Processing and storing your music submission | Contractual necessity (you choose to submit) |
| IP address (hashed, non-reversible) | Your browser / network | Abuse and fraud prevention | Legitimate interest |
| Submission timestamp | Server | Record-keeping | Legitimate interest |
2.1IP addresses are immediately and irreversibly hashed before storage using HMAC-SHA256. We never store your raw IP address.
3. Cloudflare Turnstile (CAPTCHA)
3.1The submission form uses Cloudflare Turnstile to prevent automated abuse. Cloudflare may process your IP address and browser signals to determine whether you are human. This is governed by Cloudflare's Privacy Policy.
4. Session Cookies
4.1When you sign in, we set a session cookie to keep you authenticated during your visit. This cookie:
- 4.2Is HttpOnly (not accessible by JavaScript)
- 4.3Is Secure (only transmitted over HTTPS)
- 4.4Expires after 24 hours
- 4.5Contains only a random session identifier - no personal data
5. Data Retention
5.1Submission files (WAV and metadata JSON) are retained for as long as they are relevant to our playlist management. We do not have a fixed automatic deletion schedule. You may request deletion at any time (see Section 7).
5.2Session data is deleted automatically after 24 hours.
6. Third-Party OAuth Providers
6.1We use Twitch, Google, and Discord for authentication only. We do not receive your password, email address, or any data beyond your display name and user ID. Each provider's own privacy policy governs how they handle your data during the sign-in process.
7. Your Rights (GDPR)
7.1If you are located in the European Economic Area or United Kingdom, you have the right to:
- 7.2Access - request a copy of the personal data we hold about you
- 7.3Rectification - request correction of inaccurate data
- 7.4Erasure - request deletion of your submission and associated data
- 7.5Restriction - request that we limit processing of your data
- 7.6Objection - object to processing based on legitimate interest
7.7To exercise any of these rights, get in touch via the Contact page (choose "Privacy / GDPR data request" as the topic). We will respond within 30 days.
7.8You also have the right to lodge a complaint with your local data protection authority.
8. Payment Processing (ZOB Premium)
8.1If you subscribe to ZOB Premium, payment is processed by Lemon Squeezy (Lemon Squeezy, LLC), which acts as the merchant of record. We do not collect or store your payment card details. Lemon Squeezy shares the following information with us about each subscriber:
- 8.2The e-mail address you used to subscribe
- 8.3Your country of residence (for tax compliance)
- 8.4Your subscription status, renewal dates, and any cancellation
8.5We use this information solely to provide and support your subscription. Lemon Squeezy's own handling of your payment data is governed by its Privacy Policy.
9. Contact Form (Web3Forms)
9.1If you message us through the Contact page, your submission is processed by Web3Forms, which receives your name, email address, message, and the topic you selected, and forwards them to our inbox. We do not store your message on this website. Web3Forms may keep operational logs in accordance with its own Privacy Policy. If you prefer not to use a third-party processor, you can email us directly using any of the aliases referenced from the Contact page.
10. Automated Lyric Review (Anthropic)
10.1When you submit a track, we retrieve the lyrics from the public page you link on the AI music platform you name (for example your Suno track page) and send that lyric text to Anthropic, which returns an automated summary of the content it contains — for example profanity, violence or adult themes. We use this only to check that the Clean/Explicit rating on a submission looks right before a human reviews it. Our lawful basis is legitimate interest in classifying content we broadcast.
10.2Only the lyric text is sent to Anthropic. Nothing else from your submission goes to them — not your name, your email address, your account details, or the audio file you upload to us. Those stay on our own systems.
10.3The result is visible only to station staff — never publicly, and never on your own submissions page. It is advisory: it can flag a submission for closer review, but it never approves, rejects or re-rates a track on its own. A human makes every decision.
10.4The lyrics we send are ones you have already published yourself on the linked platform page. Anthropic’s handling of this data is governed by its own Privacy Policy. The check runs automatically when you submit. If you would rather your lyrics were not processed this way, contact us — we will delete the stored result and handle your future submissions by hand.
11. Social Campaign Reporting
11.1If you arrive through one of our campaign links, we count page opens, web-player playback starts, playback reaching 60 seconds, and completed music submissions. This helps us understand which posts bring people to the radio or encourage submissions.
11.2The campaign database uses a random visit reference, which expires after 24 hours and is removed by scheduled cleanup. It does not store visitor names, account IDs or IP addresses. Daily totals are retained for up to 366 days. Campaign reporting does not create a persistent browser identifier or use local storage. The normal sign-in cookies described above still apply.
11.3Campaign measurement is skipped when your browser sends Do Not Track or Global Privacy Control. You can also open the web player or submission form without a campaign link. We use our own server for these counts, with no advertising pixels or third-party analytics service.
12. Seasonal competitions and prizes
ZeroOne Beats, Denmark, CVR 38227386, is responsible for the event information described here. Contact us through the website's Privacy / GDPR data request contact option.
Country eligibility and verification
The event rules set the age, residence and prize eligibility requirements. Residents of the following countries and territories are excluded from participation and both prize types:
- Countries: Belarus, Belgium, Brazil, Cuba, Iran, Italy, Mexico, North Korea, Russia and Syria.
- Canadian province: Quebec.
- Ukrainian territories: Crimea and Sevastopol, and the non-government-controlled areas of Donetsk, Luhansk, Kherson and Zaporizhzhia.
At entry we record your eligibility declaration, the version of the rules you accepted and the time of acceptance. We do not automatically verify your location through this declaration. If verification is necessary, we may ask privately for your country of legal residence and the minimum supporting information needed to check eligibility or a payment restriction. We do not require every listener to upload identity documents. We will explain any specific evidence request and how to provide it privately.
Residence information and supporting evidence are used for eligibility, prize administration and any applicable legal obligations, on the lawful bases below. They are not public leaderboard fields or marketing information. Access is limited to the people administering the event and any recipient necessary for payment or a legal obligation. Once a verification issue is resolved, we delete or redact supporting material that is no longer necessary; minimum decision records and legally required payment records follow the retention rules below. Contact us to correct an inaccurate declaration or ask for a human review.
Suno Premier prize eligibility also requires lawful access to Suno Premier and a PayPal account able to receive the prize payment from Denmark. These prizes are void where PayPal services are legally restricted or unavailable for receiving that payment. We use your separate Suno/PayPal eligibility confirmation to determine whether you may qualify for a main-prize place. It does not prevent otherwise eligible participants from collecting songs or winning ZeroOne Beats Premium rewards.
Information and purposes
We use your linked account identifiers and display name, your rules and eligibility confirmations, claim times and outcomes, collected songs, reward records and delivery status to run the competition and provide your prizes. Linking Twitch and Discord is required; Kick participation also requires a linked Kick account. You cannot enter without the necessary linked identities and eligibility confirmations.
Your display name, collection total and first-finder total may appear on the public event leaderboard. Your individual saved collection and prize details are available through your signed-in account. Claim ordering and limits are calculated automatically under the event rules. You can ask the ZeroOne Beats Owner to review an error or disputed result through our support routes.
If you earn a main-prize place, we ask privately for your PayPal email and confirmation that your account can receive the prize. We use this to check and arrange delivery, record its outcome and handle related support. Without suitable payout details we cannot deliver a PayPal prize. We never ask for your PayPal password or login code. Gift keys must be kept private by you and anyone you give them to.
We process information necessary to administer your entry and deliver an earned prize to perform the event agreement. Our legitimate interests in fair competition, account security, preventing abuse and resolving disputes support the necessary verification and audit records. Records required by applicable accounting or other law are retained to meet those legal obligations. Entry does not subscribe you to marketing.
Access, recipients and hosting
PayPal emails, prize keys and payment references are not public leaderboard information. Private payout details are restricted to the owner and the access needed to administer the payment. Discord processes direct messages used to deliver Premium keys. PayPal receives the recipient and transaction information necessary to process a payment and handles it under its own privacy notice. We will explain any additional information or recipient before using a different prize-delivery arrangement.
Our event records are hosted on our server in Canada. Linked platforms and delivery providers may also process data outside the EEA. Their own privacy notices describe their processing and international-transfer arrangements. Contact us for information about our hosting arrangements and the applicable safeguards. See the Discord and PayPal privacy notices linked in the full policy.
Retention and rights
We retain entry and claim records for the event and for as long as necessary to complete prize delivery and resolve an outstanding dispute, delivery fault or suspected abuse. After those purposes have ended, we review the records and delete or anonymise information no longer needed.
Saved collections and the minimum records needed to show earned achievements remain linked to your account while you keep that history. You may request its deletion. Payment evidence required for accounting or a specific legal claim is kept separately for the applicable requirement; only information necessary for those requirements is retained.
You may request access, correction, deletion, restriction and, where applicable, portability, or object to processing based on legitimate interests. Some records may need to be retained for an outstanding legal obligation or claim. Contact us using Privacy / GDPR data request on the contact page. You can complain to Datatilsynet or another competent supervisory authority.
Provider notices: Discord and PayPal.
13. Changes to This Policy
13.1We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision.