1. Introduction

WhatSongIsThis identifies songs from an uploaded file, a live recording, or a pasted link. This policy explains what happens to what you give it, and what the site tracks in the background.

By using the site, you agree to this policy. If you don’t agree with it, please don’t use the service.

WhatSongIsThis is governed by the laws of Iceland. As Iceland is part of the European Economic Area, EEA data protection standards (equivalent to the GDPR) apply to how personal data is handled, regardless of where you’re located.

2. Information We Process

2.1 What you provide

• Audio or video files you upload for identification.
• A YouTube, Instagram, or TikTok link you paste, from which the audio is extracted.
• Audio captured through your device’s microphone, only while you’re actively recording, and only with your browser’s permission.

2.2 What’s collected automatically

• Standard server access logs (IP address, browser type, timestamps), used for security and troubleshooting.
• Analytics data collected through Google Analytics — see Section 6.
• Your language and light/dark theme preference, stored only in your browser.

We do not collect your name or email, and there is no account system on this site.

3. How We Use It & Legal Basis

Under EEA data protection law, we need a valid legal basis for each way we use your data. Here’s what we do and why:

What we do	Legal basis
Send your clip for identification and return a match	Necessary to provide the service you’ve directly requested
Keep basic server logs for security and troubleshooting	Legitimate interest in keeping the service secure and working
Run Google Analytics	Your consent, given (or withheld) via cookie preferences
Remember your language/theme choice	Necessary to provide the preference you selected

We don’t use anything you submit for advertising, and audio submitted for identification is never used for analytics — those are two entirely separate systems.

4. Data Retention

• An uploaded file or recording is temporarily written to the server just long enough to send it for identification, then deleted immediately after that request completes — whether or not a match is found.
• For a pasted video link, the audio is extracted, sent for identification, and the temporary copy is deleted the same way.
• The result you see (title, artist, links) is shown in your browser and not logged or connected to you afterward.
• Analytics data is retained per Google’s default settings for this property — see Section 6.

We don’t maintain a searchable history of what’s been uploaded, matched, or identified — by you or anyone else.

5. Third-Party Services

5.1 ACRCloud

Identification is performed by ACRCloud, an audio fingerprinting service. Your clip is sent to their systems for matching against a catalog of released recordings — this is the only third party that ever receives your actual audio.

5.2 YouTube, Instagram, TikTok

When you paste a link from one of these platforms, we fetch the public audio from that page to identify it. We don’t access your account on those platforms.

5.3 Spotify & Apple Music

A successful match links out to listings on Spotify and Apple Music, governed by their own privacy policies once you click through.

5.4 Google Analytics

We use Google Analytics to understand site usage in aggregate — see Section 6 for specifics.

6. Cookies & Analytics

6.1 Essential local storage

Stored value	Purpose	Duration
wsit_lang	Remembers your chosen language	Until cleared
wsit_theme	Remembers your chosen light/dark mode	Until cleared

6.2 Google Analytics

We use Google Analytics to see, in aggregate, how the site is used — page views, approximate location at a city/country level, device and browser type, and how visitors arrive. This data is used to understand and improve the site, not to identify individuals.

Cookie	Purpose	Duration
_ga	Distinguishes unique visitors	Up to 2 years
_ga_*	Persists session state for this property	Up to 2 years
_gid	Distinguishes visitors within a shorter window	24 hours

You can opt out any time by installing the Google Analytics Opt-out Browser Add-on, or through your cookie preferences. Full detail: Cookie Policy. We do not use advertising cookies, ad networks, or ad-targeting pixels of any kind.

7. International Data Transfers

Google Analytics is operated by Google, which processes data on servers located around the world, including outside the EEA. Where that happens, Google relies on its own approved transfer mechanisms (such as Standard Contractual Clauses) to keep that processing compliant with EEA data protection law — see Google’s own documentation for the current specifics. ACRCloud may similarly process data outside Iceland as part of returning an identification result; no audio is retained by us afterward regardless of where that processing occurred.

8. Data Controller & Your Rights

WhatSongIsThis is the data controller for the personal data described in this policy. [Full registered business name and address to be added here once available.] You can reach the controller at Legal@whatsongisthis.net for anything in this section.

Under EEA data protection law, you have the right to:

• Access — ask what personal data we hold connected to you.
• Rectification — correct inaccurate data.
• Erasure — request deletion (in practice, there is usually nothing left to delete once a request completes, since audio is removed immediately).
• Restriction — ask us to limit how data is processed in specific circumstances.
• Portability — receive a copy of data you provided in a portable format, where applicable.
• Object — object to processing based on legitimate interest, including opting out of analytics at any time.

We don’t use automated decision-making or profiling that produces legal or similarly significant effects about you — identifying a song is a content-matching function, not a decision about you as a person.

9. Children’s Privacy

This site isn’t directed at children, and we don’t knowingly collect information from anyone under 13. If you believe a child has used the service in a way that concerns you, contact us and we’ll look into it.

10. Changes to This Policy

If how we handle data changes, this page will be updated and the date at the top will change. Adding or removing a third-party service will be described plainly here.

11. Contact & Supervisory Authority

Questions about this policy or how your data is handled: Legal@whatsongisthis.net.

If you’re in the EEA and believe we haven’t handled your data properly, you have the right to lodge a complaint with your local supervisory authority. For Iceland specifically, that’s Persónuvernd, the Icelandic Data Protection Authority (personuvernd.is).