Groovedesk

Privacy

Your information and your choices.

Who we are

Groovedesk is run by 9516-8555 Québec Inc. (Mega Labs Industries), 1619 William, Suite 201A, Montreal, QC H3J 1R1, Canada. We decide how the information on this page is used, which makes us the controller of it, in privacy-law terms.

Our privacy officer is Francis di Stasio. For anything on this page, write to contact@groovedesk.io or to the address above.

Because we offer the waitlist in the European Union and the United Kingdom without being established there, we need a representative in each. We’ve engaged DataRep for both. Their appointment is being completed; we’ll publish their names and addresses here as soon as it is. Until then, write to us directly.

What this notice covers

Three things, and they work a little differently:

  • This website and the waitlist: joining the list, the emails we send you and the referral offer.
  • The Groovedesk app: your account, and the work your team does inside a workspace.
  • Calls you book with us: the conversation, any recording of it, and our notes from it.

One thing to keep in mind throughout. For your account and how you use the app, we decide what happens to your information, so you deal with us. The work your team puts inside a workspace belongs to the company that owns it: that company decides what happens to it, and we follow its instructions. To have that content changed or removed, ask your workspace owner. We’ll help them do it.

What we collect

When you join the waitlist

Your name, email address, company and team size, plus your email permission and when and how you gave it.

We also record when you signed up, whether our emails reach you and whether you’ve opted out, your referral activity, and any campaign details in the link you followed. Our spam check looks at your IP address and request details, and our referral check stores a hashed version of your IP. Our host keeps server logs, which can include IP addresses and request details, for up to 30 days.

If you later create a Groovedesk account with the same email address, we link your waitlist record to that account and note when, so you get the trial you earned and we know your spot has been taken up.

When you use the app

Your account. Your name, email address and password. The password is stored hashed, so we can’t read it. If a workspace invited you, we keep the invitation with your email address. If you sign up or sign in with Google, we get your name, email address, profile picture and Google account ID, as your Google settings allow, to sign you in.

Your team’s work. Releases, tasks, marketing plans, files you upload and anything you type into the app. Uploaded files are scanned for viruses.

Personal details in artist and team records. Music teams keep some personal details for touring, travel and payments: personal email addresses and phone numbers, home and payee addresses, and airline loyalty numbers. We leave these fields out of analytics, and the parts of the screen that show them are blocked from session recordings, not just hidden.

How you use the app. Which screens you open, which features you use, and errors the app runs into. Not general page views, individual clicks or console output. Your IP address is dropped before any of this is stored.

Session replays. In some parts of the app, we record how the screen changes as you use it, to find bugs and see where the app is confusing. If you said yes to sharing usage data, a replay can include the text on screen and what you type. If analytics is only on by default where you are, all of that is masked, so a replay shows layout and navigation, not your content. Passwords, the personal details on artist profiles, and the sign-in and billing pages are never recorded. Only the Groovedesk team can watch replays, and they can be turned off for a whole workspace.

Voice clips. If you use dictation, your audio is sent off to be transcribed and the text comes back into the field. Neither we nor the transcription service keep the audio. What you save afterwards is kept like anything else you type.

We don’t ask for payment details on the waitlist. We never ask for government ID or sensitive (special category) information like health or biometric data for our own purposes, so please don’t send it.

Why we use it, and our legal basis

Some privacy laws ask us to name a legal basis for each use. Here they are:

  • Your consent: waitlist updates, early-access invitations and product news by email, and optional analytics or marketing cookies. In the app, it also covers product analytics that remember your browser, and session recording. You can withdraw it whenever you like; that doesn’t affect anything we did before you withdrew it.
  • Our contract with you: running the app for you and your workspace, keeping your account working and taking payment for a subscription.
  • Our legitimate interests: holding your spot on the list, stopping spam and referral abuse, keeping the site and app secure, measuring campaigns, learning which parts of the product work, and looking at company and team details so the founders can follow up where it makes sense. We weigh these against your interests, and you can object.
  • Our legal obligations: keeping the minimum record we need to respect an opt-out and show you gave permission, and keeping billing records as long as tax law requires.

We also use feedback and signup details to improve the site, the product and how we look after customers. We never email people you refer unless they sign up themselves.

If you’d rather not share it

Every field on the signup form is needed: your email to reach you, and your name, company and team size to plan early access and decide who to invite when. If you’d rather not share them, don’t join; you can still email us.

In the app, you need a name and email address to have an account. Dictation and session replays are optional: dictation only runs when you use it, and replays can be turned off for a whole workspace.

Cookies and your choices

Analytics and marketing cookies are optional, and each is its own choice. Saying no doesn’t affect joining the waitlist. Whether they start on or off depends on where you are. In the European Economic Area, the United Kingdom, Switzerland and Quebec, both start off, and nothing optional loads until you turn it on. We do the same whenever we can’t tell where you are. Elsewhere, both start on, and you can turn either off at any time. If your browser sends a Global Privacy Control signal, marketing starts off wherever you are. Change your mind any time with “Privacy choices” on this page or “Cookie settings” in the footer.

To pick the right starting point, our server estimates your country, and in Canada your province, from your IP address, using a location database it keeps itself. Nothing is sent anywhere for this, and the result isn’t stored. This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com.

Necessary browser storage remembers your choice and your waitlist session. Our spam check only loads when you submit the form. If you take back tracking permission, the page reloads to stop anything already running; where your browser allows it, what you’d typed in the form survives the reload in that tab, then is cleared.

When they’re on, analytics measures visits and waitlist actions, and marketing partners measure campaigns and recognize visits. Form answers, names, email addresses and private unsubscribe links never go into website analytics. If you say no to cookies, your signup still counts in our own waitlist numbers.

The app follows the same rule. In the European Economic Area, the United Kingdom, Switzerland and Quebec, and whenever we can’t tell where you are, product analytics that remember your browser and session recording stay off unless you tick the box when you create your account, or turn them on later in your account settings. Elsewhere they’re on, and turning them off in your account settings stops all of it in your browser. The app works out which rule applies when you create your account, the same way as above, and keeps it. If your account predates this setting, it’s set on your next visit, and in the regions above the app asks once. Accepting the app terms isn’t saying yes to this, and saying no never limits what you can do in the app.

A little usage information also reaches us from our own servers, not your browser, so the browser setting doesn’t stop it. We need it to keep the service running and know what to fix. It uses an internal account ID and a fixed list of events, never what you type. If you’d rather be left out, write to us and we’ll stop it for your account.

Who else sees it

For the website and waitlist: Railway hosts it, our own backend holds signup records, Resend sends email, Copper is where the founders follow up, and Cloudflare Turnstile checks for spam (Cloudflare explains what it collects in its Turnstile Privacy Addendum). When optional cookies are on, we also use Google Tag Manager, with tags that can include Google Analytics, Google Ads, Meta, LinkedIn and X. Calls are booked through Google Calendar, then transcribed by Notion or recorded and transcribed by Fireflies.

For the app: Railway runs the app server and database, Tigris stores the files you upload, Vercel serves the app, PostHog handles product analytics and session recordings, Groq transcribes dictation, and OpenRouter sends marketing-plan requests to a model provider, currently OpenAI. Resend sends account email, like address verification.

Our hosting, backend, file storage, email, CRM, spam-check, transcription and analytics providers work on our instructions and can’t use your information for their own purposes. We have a written data processing agreement with each of them. Advertising partners are the exception: when marketing cookies are on, they also use what they get for their own advertising business. That’s why marketing is a separate choice you can turn off on its own. We’ll update this list before we add a provider.

The AI features. Marketing-plan generation sends the text it needs to OpenRouter, which passes it to the model provider. Dictation sends your audio to Groq. Both only run when you ask. Neither the router nor the model provider may train on what we send: we’ve chosen settings that rule out providers who would, and the transcription service is set to keep nothing. The model provider keeps a short abuse-monitoring log for up to 30 days. Generated plans are drafts and can be wrong, so check them before you act on them.

We don’t sell your personal information for money, and we never will. When marketing cookies are on, though, advertising partners get information in a way some United States state privacy laws call “sharing” or “targeted advertising.” You can switch that off any time in “Privacy choices” or “Cookie settings”, and a Global Privacy Control signal keeps it off.

We may also disclose information when the law requires it, or to establish or defend a legal claim.

If you book a call

We transcribe calls booked through this site so our notes are accurate and our follow-up is useful, and some calls are also recorded. We tell you at the start, and you can ask us not to record or transcribe. The call goes ahead either way.

Calls cover more than the signup form: how your label works, what you’re planning, who you work with. We use our notes to follow up and to understand what music teams need, never to advertise to you, and they stay inside Groovedesk.

We use one of two notetakers. Notion transcribes the call and writes up notes. It processes the text in the United States and uses OpenAI and Anthropic to do it, and our agreement with Notion lets them and their providers use it only to run the service for us. Fireflies records the call, transcribes it and writes up notes, also in the United States.

We keep call recordings, transcripts and notes with no set end date. If you’d like yours deleted, write to us and we’ll remove them from both tools.

Where your information goes

We’re based in Quebec, and our providers process information in other countries. Email, founder follow-up, call recordings and notes, and hosting are in the United States, and spam protection runs on a global network. When analytics or marketing cookies are on, those providers are in the United States too. For the app, the server, database and uploaded files are in the United States, product analytics and session recordings are in the European Union, and dictation and marketing-plan generation are processed in the United States.

When information leaves the European Economic Area, the United Kingdom or Quebec, we rely on the European Commission’s Standard Contractual Clauses, the UK Addendum, or a country the relevant authority recognizes as offering similar protection. The privacy impact assessment that Quebec law requires before personal information is sent outside Quebec is complete and retained. You can ask us for a copy of the safeguards we rely on.

How long we keep it

We keep your information while we still need it for the reasons above, and no longer. In practice:

The waitlist

  • While you’re on the list: we keep your record while you wait for your invitation, whether or not you still get our updates.
  • If you unsubscribe from updates: you stay on the waitlist and we still email your invitation when it’s your turn. We just stop the updates. To leave the waitlist completely, ask us to erase your information.
  • If our email to you bounces: you stay on the waitlist. If it bounces for good, we stop sending to that address, but we may still reach you about your invitation another way.
  • If you report our email as spam, or our email provider refuses to send to your address at all: your signup record is deleted within 30 days. We keep only your email address and the fact that you objected, so we can respect it.
  • If you have unused referral days: we keep the minimum record needed to honour them, even if you report our email as spam, because we promised them to you. We delete it once those days are added to your trial, or after the 24-month period below if you never take up your invitation.
  • If you go quiet: if we’ve been emailing you and you haven’t opened or clicked anything for 36 months, we delete your record. If we haven’t been emailing you, that doesn’t count against you, so we may keep your record longer.
  • If you never take up your invitation: once Groovedesk has launched, we delete or anonymize your record after 24 months.

Your account and workspace

  • While your account is open: we keep it.
  • If you close your account: you lose access, but nothing is erased right away, since people often come back for their work. Support can reopen it for 12 months. After that we erase your account identity, unless there’s a specific reason to keep certain details, which we write down with a date to review it.
  • If you want it erased sooner: write to us. We look at each request when it comes in and tell you what we can and can’t remove.
  • Work in a shared workspace: stays with the workspace, because it belongs to the company, not to any one person. Removing you from a workspace doesn’t delete the releases and tasks the team worked on together.
  • Billing records: kept as long as tax law requires, which is longer than the account itself.

Everything else

  • Calls: recordings, transcripts and notes are kept with no set end date. Ask us and we’ll delete yours.
  • Security and server logs: kept by our host for up to 30 days.
  • Website analytics, when on: Google Analytics keeps the events from your visit for 2 months, and the ID that links your visits for 14 months, counted from your last visit rather than your first. If analytics stays off, none of this is collected.
  • Product analytics in the app: our analytics provider keeps usage events for up to 7 years and session recordings for 30 days.
  • Database backups: we take one a day and keep six. When we erase something, it’s gone from the live system right away, but we don’t edit backups, so it can sit in an older one for about a week before that’s overwritten.

Every deletion above runs automatically, on a schedule, except the two Google Analytics periods: those are settings inside Google’s own product, so Google applies them rather than our system. When we delete your record, we also delete the copies held by our email provider and our CRM. Anonymized information, meaning counts and trends that can no longer identify you, can be kept for our own research.

Your rights

Depending on where you live, you can ask us for a copy of your information, to correct it, to delete it, to restrict how we use it, or to send it to you or another organization in a portable form. You can withdraw permission any time, and you can object to uses based on our legitimate interests.

Email contact@groovedesk.io to make a request. We’ll reply within the time your local law allows, we won’t charge you, and asking won’t change how we treat you. We may need to confirm who you are first.

If your request is about work inside a workspace, we’ll let you know and help the workspace owner act on it, since that content is theirs to decide about.

If you’re not happy with how we handled it, you can complain to your data protection authority: in the European Economic Area, the supervisory authority where you live or work; in the United Kingdom, the Information Commissioner’s Office; in Quebec, the Commission d’accès à l’information; elsewhere in Canada, the Office of the Privacy Commissioner of Canada. You can also go to court.

Automated decisions

We don’t make decisions about you by automated means alone that have a legal or similarly significant effect on you. Spam and referral checks can flag a signup, and the kind of email address you use is one signal when we decide invitation order, but a person reviews anything that affects whether you get access. The AI features write drafts for you to edit. They don’t decide anything about you.

Email permission

Email permission is separate from website tracking: yes to one doesn’t mean yes to the other. To stop updates, use the unsubscribe link in any waitlist email or write to us. We act on it quickly and keep a record so we keep honoring it. Emails that come with having an account, like confirming your address or a payment notice, keep coming after you unsubscribe from updates, and so does your waitlist invitation.

Changes to this notice

We’ll update this notice when the waitlist, the app or how we handle data changes. If a change materially affects how we use your information, we’ll email waitlist members and account holders before it takes effect. The date at the top shows the current version.