1. Introduction

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Metadata Monitor platform and related services.

By accessing or using the Metadata Monitor, you agree to this Privacy Policy and our Terms of Use.

If you do not agree to this Privacy Policy, you must not use the Metadata Monitor.

2. Data Controller

The data controller is:
Music Story SAS
24 Boulevard Carnot, 59800 Lille, France
SIRET: 504 765 405 00031
Email: musicstorypro@music-story.com

3. Data Collected

Depending on your interaction with the Metadata Monitor, we may collect the following types of data:

a) Browsing and Usage Data

• IP address, browser type and version, operating system, connection speed, date and time of access, pages/endpoints visited, API calls, and other interaction data.
• Purpose: internal analysis, security monitoring, system optimization, and API usage tracking.

b) Account and Authentication Data
Access to the Metadata Monitor requires a user account. Account creation, sign-in, and session management are operated on our behalf by our authentication provider, Clerk, Inc. (see Section 5).
The following data is processed for this purpose:

• Email address, first and last name, organization, and role;
• Authentication credentials. Passwords are never stored in plain text and are never accessible to Music Story;
• Sign-in and session metadata (IP address, user agent, timestamps, device information), used for security and fraud prevention;
• Where enabled, multi-factor authentication factors;
• An API token automatically generated and associated with your account.

c) Voluntarily Provided Data

• Data submitted via forms, feedback, or support requests.
• Purpose: communication, troubleshooting, and improvement of services.

d) Cookies
The Metadata Monitor only uses cookies that are strictly necessary to operate the service and to keep your session secure. It does not use analytics, advertising, profiling, or cross-site tracking cookies. See Section 9 for the full list.

4. Purposes of Processing and Legal Bases

After these periods, data are deleted or anonymized unless legally required to retain them longer.

5. Data Sharing and Processors

We may share your data with the following categories of recipients:

• Internal Music Story teams, on a need-to-know basis;
• The processors listed below;
• Competent authorities or judicial bodies upon justified request.

We rely on the following processors to operate the Metadata Monitor:

All processors are bound by a written data processing agreement under Article 28 GDPR and are required to implement appropriate technical and organizational measures to protect your data.

6. Transfers Outside the EEA

Authentication and session data is processed by Clerk, Inc., established in the United States. This transfer is governed by the Standard Contractual Clauses adopted by the European Commission, as set out in the data processing agreement concluded between Music Story SAS and Clerk, Inc.

All other data processed by the Metadata Monitor, including metadata records, API usage logs, and support correspondence, is stored within the European Union.

You may request a copy of the safeguards applicable to these transfers by contacting us at the address set out in Section 11.

7. Your Rights

In accordance with the GDPR, you have the following rights:

• Right of access: to know what data we hold about you.
• Right to rectification: to correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”): to request deletion of your data when legally permissible.
• Right to restriction of processing: to limit how your data is processed in certain cases.
• Right to data portability: to receive your data in a structured, machine-readable format.
• Right to object: to object to processing for legitimate reasons, including direct marketing.
• Right to withdraw consent: you may withdraw your consent at any time.
• Right to lodge a complaint: with the CNIL at https://www.cnil.fr/fr/plaintes

To exercise these rights, please contact us via the contact form available on our website.

Requests concerning your account or authentication data are transmitted to our authentication provider where necessary, and are actioned by Music Story as data controller. Deleting your Metadata Monitor account also deletes the corresponding record held by our authentication provider.

We may request proof of identity before processing your request to ensure the protection of your data.

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit, access controls, and logging.

Authentication is delegated to a specialist provider that maintains SOC 2 certification and applies industry-standard measures including password hashing, leaked-credential detection, brute-force protection, and optional multi-factor authentication.

Metadata Monitor application data and databases are hosted in Scaleway's Paris datacenters, in France. Authentication and session data is processed in the United States as described in Section 6.

Absolute security cannot be guaranteed; data transmitted online is at your own risk.

9. Cookies

The Metadata Monitor only uses cookies that are strictly necessary to provide the service you have requested. We do not use analytics, advertising, profiling, or cross-site tracking cookies, and we do not use browser fingerprinting.

Under Article 82 of the French Data Protection Act (Loi Informatique et Libertés), which implements Article 5(3) of Directive 2002/58/EC, cookies strictly necessary for the provision of a service explicitly requested by the user — including cookies used for authentication and for securing the authentication mechanism — are exempt from the prior consent requirement. For this reason, the Metadata Monitor does not display a cookie consent banner.

The following cookies are set when you sign in:

These cookies are required for the authentication mechanism to function and cannot be disabled while using the platform. They do not contain personally identifiable information.

You can block or delete cookies through your browser settings. Doing so will prevent you from signing in to the Metadata Monitor.

10. Policy Updates

This Privacy Policy may be updated periodically. Changes will be posted here, and the “Last updated” date will be revised.

11. Contact

For questions or requests regarding your personal data:

Music Story SAS
24 Boulevard Carnot, 59800 Lille, France
Email: musicstorypro@music-story.com