Listening Party Privacy Policy

When someone adds the Bot to a server (through Discord's authorization screen):

• the Discord user ID, username and email address of the person who adds the Bot, which Discord shares with us because that person approves the “email” permission on the authorization screen;
• the server's ID and name;
• the name, email and community name the admin types into our sign-up form;
• whether that person chose to receive promotional emails from Lisnin, and when.

When a member registers for listening parties (through Discord's authorization screen):

• the member's Discord user ID, username and email address, which Discord shares with us when the member approves the “email” permission;
• the server they registered from;
• the email address the member optionally types in on the Join Listening Party page;
• Spotify listening activity that the member shares in their Discord status, such as the track, artist and album being played and when listening started and stopped;
• if we connect to the member's Spotify account, the Spotify account information and listening data that the member authorizes Spotify to share with us;
• how many times the member listened to tracks promoted through Lisnin listening parties, and the points earned for them;
• whether the member chose to receive promotional emails from Lisnin, and when.

Records of your consent. When you accept the Terms or choose to receive promotional email on our forms, we save the version of the terms, the exact checkbox wording, the time, and your browser's user-agent string (first 300 characters), so we can show what you agreed to.

[engineering to confirm: anything else the Discord backend (app.lisnin.io) stores, for example Discord or Spotify OAuth access and refresh tokens, role or channel IDs, campaign acceptances and message IDs, and how long each is kept]

We may connect to a member's Spotify account and collect Spotify data at any point, for example to confirm that listening is genuine and to prevent abuse. Where we do, we collect only what we need for those purposes and we will ask for the member's permission through Spotify's own authorization screen. Otherwise, the Bot sees listening activity that a member has chosen to display on Discord. The Bot does not read or store chat messages, and we do not collect payment information through the Bot.

• to operate, maintain and improve the Bot and listening parties;
• to send server admins and registered members service messages, such as a welcome email, outage notices, required updates and policy changes;
• to count listens, award points and run the prize draw, and to show communities and participating artists aggregated listening statistics, which do not identify individual members;
• to prevent abuse, fake engagement and violations of our Terms;
• to send promotional emails about Lisnin only to server admins and members who opted in, with an unsubscribe option in every message.

We do not sell personal information. We do not use Discord data to train artificial intelligence models, and we do not share it with data brokers or advertisers. For people in the EEA and UK, the legal bases are contract (to provide the Bot), consent (promotional email, Spotify connection) and legitimate interests (abuse prevention, security).

We share information only with service providers that help us run the Bot, such as cloud hosting, database and email providers, and with Lisnin's development team, all under confidentiality obligations. We may disclose information if required by law or to protect the safety and rights of users and Lisnin. If Lisnin is involved in a merger or acquisition, information may transfer to the successor under this Policy.

Providers we have verified for the sign-up forms on this website: Microsoft Azure (hosting and storage), Resend (email), Discord and Spotify. [Matt to confirm full vendor list for the Discord backend]

Information is stored on Microsoft Azure servers located in Canada. Members of our development team in India and our email service providers may access it to operate the Bot. Wherever it is accessed, we protect it as described in this Policy. [Matt to confirm: Azure region and development team locations]

We keep server and admin information while the Bot is in your server, and delete or anonymize it within 90 days after the Bot is removed, unless we need to keep it longer to meet legal obligations or resolve disputes. We keep member registration information and listening activity for as long as we need it for the purposes described in this Policy, including long-term listening analytics and improving our services; we propose to delete it 24 months after a member's last activity [Matt to confirm retention period]. If you unsubscribe from promotional emails, we stop sending them to you. Aggregated statistics that do not identify any person may be kept longer.

• You can remove the Bot from your server at any time in Discord server settings.
• Members can stop the Bot from seeing their listening activity by turning off “Share your activity status” in Discord's Activity Privacy settings, or by leaving the server.
• After registering, admins and members can choose whether to receive promotional emails, and can unsubscribe at any time using the link in any email.
• You can ask us to access, correct or delete your personal information, withdraw consent, or receive a copy of it, by emailing hello@lisnin.io. We will respond within 30 days. If you live in the EEA, UK, California or Quebec you have the additional rights described in our general Privacy Policy.
• You can revoke the Bot's access to your account in Discord under User Settings, Authorized Apps.

Server admins: removing the Bot and deleting your server's data. Remove the Bot in Discord, then email hello@lisnin.io from the address you signed up with, with your server ID and the words “Delete server data”. We delete or anonymize your server and admin information within 90 days. [engineering to confirm: self-serve removal and deletion flow]

You can complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec or your local data protection authority.

We use reasonable safeguards, including encryption in transit and at rest, restricted access and secure storage of credentials, to protect information. No system is perfectly secure, and we will notify affected users and regulators of a breach where the law requires it.

The Bot is not directed at anyone under Discord's minimum age (13 in most countries). We do not knowingly collect personal information from anyone under 13. If you believe a child under that age has given us personal information, contact us and we will delete it.

We may update this Policy. If we make material changes, we will update the effective date above and notify server admins by email.

Privacy questions or requests: Lisnin Music Inc., Privacy Officer, 949 Sprague Pl, Milton, Ontario L9T 0K6, Canada. Email: hello@lisnin.io