Privacy Policy

This Privacy Policy was originally published on 23.09.2022. This document was last updated on 03.04.2026.

The only legally binding version of this document is the German version. Any other version is a translation and may not be current or accurate and is provided for information purposes only.

Protecting personal data is our highest priority. This Privacy Policy explains which personal data we process in connection with the use of songbattle.io, for which purposes we use it, the legal basis for processing, and the rights granted to users regarding their personal data.

This Privacy Policy applies exclusively to the use of the songbattle.io website and online service. By using songbattle, you agree to this Privacy Policy and its terms.

1. Controller

The controller responsible for processing personal data is:

If you have any privacy-related questions, you may contact us at this address at any time.

2. Processing of Personal Data

We use personal data in the following ways:

• To use songbattle, login via Twitch or Discord is required. In this process, we receive the username, user ID, profile image URL, Twitch affiliate or partner status, and current viewer count from the respective provider. We do not store passwords; they remain fully with the login provider. Users may revoke access permissions via their platform settings at any time. You also grant us permission to create polls in your Twitch chat. We will only use this capability if you yourself trigger a poll as part of a game you host. If you never host a game or choose not to use polls, we will never create a poll in your Twitch chat.
• During your use of our service, we collect and store data about your activity. This includes games created or joined, songs submitted through external platforms, game results, won or lost battles, voting actions, and progression such as unlocked achievements or titles. We also store virtual currency balances and purchases of cosmetic items in our shop. Some of this information may be visible in the user interface where necessary for gameplay (for example, public cosmetic selections or gameplay statistics).
• Each time you access songbattle, we automatically collect technical information, including browser type and version, operating system, date and time of access, IP address (processed anonymized or truncated where possible), and system activity. This data supports stable operation and troubleshooting.
• If you purchase digital items in our shop, payment processing is handled by Xsolla. We transmit the minimum required information: an internal user identifier and details about the purchase amount and timestamp. We do not receive or store any credit card or banking information. Processing occurs exclusively within the Xsolla platform.

3. Purposes and Legal Bases

We process personal data solely in accordance with the following legal bases:

• Providing and enabling the use of our service, including login, game participation, progression storage, and purchase processing, is necessary to fulfill a user agreement under Art. 6(1)(b) GDPR.
• Analysis of usage to improve the service, detection and prevention of misuse, and ensuring technical operation is carried out on the basis of our legitimate interest under Art. 6(1)(f) GDPR.
• If we use cookies or tracking technologies not strictly necessary for operation, this is exclusively based on explicit user consent under Art. 6(1)(a) GDPR. Consent can be revoked at any time.
• Retention of purchase-related data (e.g., invoice information) is required under statutory retention obligations, particularly tax regulations. Processing for this purpose takes place under Art. 6(1)(c) GDPR.
• songbattle does not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant impacts on users (Art. 22 GDPR).

4. Cookies and Tracking

songbattle uses technically necessary cookies to enable login, save preferences, and ensure the proper functioning of the service. To manage consent, songbattle.io uses a cookie banner allowing users to allow or refuse optional cookies and change their preferences at any time.

We also make use of analytics tools, in particular Mixpanel. Analytics data is only collected if you have consented to the use of corresponding cookies. Consent can be revoked at any time via cookie settings.

5. Payment Provider

We use Xsolla, headquartered in Dublin, Ireland, to process payments. Xsolla may transfer personal data to countries outside the European Economic Area, including the United States. These transfers are based on the Standard Contractual Clauses (SCC) adopted by the European Commission.

Further information can be found in Xsolla's Privacy Policy at https://xsolla.com/privacypolicy.

6. Use of Additional Third-Party Services

songbattle processes personal data partly with the support of external service providers:

• The technical infrastructure (servers, databases, storage) is provided through Google Cloud within the EU.
• Mixpanel Inc., based in the United States, analyzes usage interactions if the user consents. Processing is secured through Standard Contractual Clauses.
• Media playback and retrieval of metadata may occur via APIs from third-party providers, including YouTube, Spotify, Apple Music, SoundCloud, Suno, Twitch, and Discord. When loading media and metadata through these services' APIs, technical information such as IP address, browser headers, or timestamps may be transmitted to the respective providers.

7. YouTube API Services

We are explicitly required to inform you that songbattle uses YouTube API Services. This includes the use of the YouTube Data API as well as data and audiovisual content provided by YouTube.

To learn more about YouTube's privacy practices, please read their Privacy Policy: https://policies.google.com/privacy

8. Data Disclosure

We disclose personal data only when necessary to provide the service, fulfill contractual obligations, comply with legal requirements, or within the scope of commissioned processing. We do not disclose data for advertising purposes and do not sell personal data.

9. Retention and Deletion

We store personal data only as long as necessary for the respective purpose. Usage and account data are deleted when you request deletion of your user account. However, transaction-related data is subject to statutory retention periods of up to ten years. Such data is stored for this purpose only and deleted or anonymized once the period expires.

10. User Rights

Users have the following rights under the GDPR:

• the right to access stored personal data,
• the right to rectification of inaccurate data,
• the right to deletion of personal data unless storage duties apply,
• the right to restriction of processing,
• the right to object to processing based on legitimate interest,
• the right to data portability in a common, machine-readable format,
• the right to revoke consent at any time.

To exercise these rights, a simple message to info@songbattle.io is sufficient. Users are also entitled to lodge a complaint with a supervisory data protection authority.

11. California Privacy Rights (CCPA/CPRA)

Users residing in the State of California have additional privacy rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). To the extent that songbattle processes personal data of California residents, the following rights may apply:

• Right to Know: You have the right to request information on what categories of personal data we have collected, the sources of that data, the purposes for which it is used, and to which categories of third parties it has been disclosed.
• Right to Access: You may request a copy of the personal data we hold about you.
• Right to Deletion: You may request deletion of personal data unless legal obligations or compelling legitimate interests require us to retain it.
• Right to Correct: You have the right to request the correction of inaccurate personal data.
• Right to Opt-Out of Data Selling/Sharing: songbattle does not sell personal data within the meaning of the CCPA and does not share personal data for the purpose of third-party advertising.
• Right to Non-Discrimination: We do not provide less favorable treatment if you exercise your privacy rights.

You may exercise your CCPA/CPRA rights at any time by contacting us at info@songbattle.io. We will respond within 45 days; this period may be extended once for up to an additional 45 days if necessary. If you wish to submit a request through an authorized agent, we may require suitable documentation as required by law.

12. Minors

Our service is not directed at individuals under 18 years of age. To the best of our knowledge, we do not process personal data of minors. If we become aware that such data has been submitted, we will delete it without delay.

13. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy whenever service changes or legal developments require it. The current version is always available at https://songbattle.io/privacy. If you have any questions regarding this document or the processing of personal data, please contact us at the email address listed above.