Last updated: 12 October 2026
We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share personal information across our website and related services (collectively, “the Website”) in compliance with applicable laws, including the UK General Data Protection Regulation (UK GDPR).
The data controller responsible for your personal data is Paul Robert Nicholls, trading as MusicMinutes, 7 Willow Court, London Road, Sawbridgeworth CM21 9FD, United Kingdom. You can contact us about anything in this policy at [email protected].
We collect personal information only when necessary to provide our services, with your knowledge and consent where required. The types of data we collect include:
Connected TikTok account. Connecting TikTok is optional. We use this data only to show which account a video will be sent to, and to upload a video to your TikTok inbox as a draft when you press “Send to TikTok”. You then add your sound and caption and publish the post yourself in the TikTok app: we never post on your behalf, and we cannot read your messages, followers or other videos. The access tokens are kept on our servers and are never sent to your browser. We also keep a short record of each video you send (which video, when, and TikTok’s status) so we can show you its progress. You can disconnect at any time from the Send to TikTok window, which revokes our access with TikTok and deletes the tokens, and you can also remove MusicMinutes from the apps you have given permission to in TikTok’s settings. Our lawful basis is contract: providing the feature you asked for.
We use your information to:
We process personal data under the following bases:
This section is provided to satisfy Article 14 of the UK GDPR, which applies where we obtain personal data other than directly from the person it relates to. If your video has been included in our analysis features, this section explains what we hold and what you can do about it.
What we collect and where it comes from. We select a small number of publicly posted short-form videos from platforms such as Instagram and TikTok, chosen individually by a human reviewer rather than harvested in bulk. Collection is carried out on our instruction by a third-party data provider, from posts that are publicly accessible without logging in. For each post we hold the video and its audio, the account handle and display name, the caption, publicly displayed engagement figures, and the music credited to the post. Because we hold the video itself, this will include the image and voice of anyone appearing in it.
Why we do it, and our lawful basis. We use this material to produce technical criticism and review of short-form marketing videos for an audience of musicians and marketers, as described in our Terms of Use. Our lawful basis is legitimate interests: our interest in providing analysis and education, and our subscribers’ interest in receiving it, balanced against the interests and rights of the creators concerned. We have documented this assessment and will provide it on request.
What we do not do. We do not use facial recognition, and we do not process any image or voice for the purpose of uniquely identifying an individual. The acoustic fingerprinting we apply identifies the sound recording used in a post so that the correct track and artist can be credited; it does not identify people. We do not sell this data, use it for advertising or profiling, or use it to make automated decisions about anyone.
Who sees it and how long we keep it. Analysed videos are shown only to logged-in subscribers within our analysis interface. We retain the material for as long as it remains useful as a reference example, and remove it when it no longer is, or sooner on request.
Your rights, and the quickest way to use them. You have the rights set out in section 8, including the right to object to processing based on legitimate interests and the right to erasure. You do not need to invoke them formally or give a reason: the fastest route is musicminutes.co/content-removal-request, where a request ordinarily hides the material immediately and, once upheld, blocks that account from being included again. You may also write to us at [email protected] or [email protected].
We do not sell personal data, and we do not share personally identifiable information publicly, except:
Publicly available data (e.g., playlist owner emails) may be shared with paid users for submission purposes, but only with a lawful basis (e.g., consent or legitimate interests).
We retain personal data only as long as necessary to provide our services or comply with legal obligations. Account data is kept for the life of your account and deleted when your account is deleted, as described below.
What deleting your account removes. Your login, profile, saved playlists and collections, saved videos, video uploads and their analysis, playlist submissions, reports, support messages, notifications, linked Spotify account, connected TikTok account and its tokens, and any files you uploaded. We delete these from our live systems at the time of deletion. Copies held in our database provider’s backups are overwritten on a rolling basis within 30 days. Any active subscription is cancelled first, because deleting the account alone would not stop Stripe from billing you.
What we keep after deletion, and why.
If a deletion request comes from an email address we already hold a deleted-account record for, we review it by hand before completing it. This does not change the time limit: the request is still completed within one month.
Data is stored securely using commercially acceptable measures, including:
Some of our providers process data outside the United Kingdom. Where that happens, we rely on UK adequacy regulations where they apply, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards required.
Under UK GDPR, you have rights to:
To exercise these rights, contact us at [email protected]. We respond within one month. Exercising a right is free and we will not treat you differently for doing so.
Deleting your account. Email [email protected] from the address on your account and ask for it to be deleted. If the request comes from a different address, we will ask you to confirm it from the account’s address first, so that nobody else can delete your account. You do not need to give a reason. We will confirm by email once it is done, and section 6 explains exactly what is removed and what is kept. If you only want to stop paying, you can cancel your subscription at any time from your account without deleting anything.
We use essential cookies to maintain your session and ensure Website functionality. These cookies are mandatory for the Website to work.
We also use Google Analytics and Google Tag Manager to understand how the Website is used, and Vercel Analytics, which does not use cookies. Google Analytics sets cookies on your device and shares data with Google.
Measuring our adverts. We advertise on Google and on Meta (Facebook and Instagram). To see which of our adverts lead to visits, sign-ups and purchases, we use the Google Ads tag and the Meta Pixel, which set cookies on your device and send Google and Meta details of your visit. We also keep the ad click identifier from the link you arrived on, and any campaign tags in it, in your browser so that a later sign-up or purchase can be credited to the right advert. If you arrive through an affiliate’s link, we keep their referral code in a cookie in the same way, so that they can be credited. When you make a purchase, our server tells Google the purchase value and the ad click identifier, and tells Meta the purchase value, a scrambled (hashed) copy of your email address and account ID, and Meta’s cookie identifiers.
We use this data only to measure the performance of our own advertising. We do not sell it or build our own marketing profiles from it. Google and Meta may also use it under their own privacy policies, for example to improve how their adverts are delivered. You can manage how they use your data in Google’s My Ad Center and Meta’s Ad Preferences, and you can ask us to stop sending your purchases to them by emailing [email protected].
You can block or delete cookies in your browser settings, and you can opt out of Google Analytics using Google’s browser add-on; blocking essential cookies will stop parts of the Website working.
The Website is intended for people aged 18 and over and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
The Website may link to third-party sites (e.g., Instagram) we do not control. We are not responsible for their content or privacy practices. Use of these sites is at your own risk.
You may refuse to provide personal information, but this may prevent us from offering certain services (e.g., account creation, app features).
We may update this Privacy Policy at any time. The current version is posted on the Website with the date it was last changed, and your continued use constitutes acceptance. Where a change materially affects your rights, we will take reasonable steps to tell you.
For questions or to exercise your data rights, contact us at [email protected].
This Privacy Policy is governed by the laws of England and Wales.