Privacy Policy
This policy explains what personal information we process when you use musikpitchen.se in English, the chat on the website and our customer portal, why we do it, who receives it, where it is processed, how long we keep it and what rights you have. The short version: Musikpitchen is run by Khoury Companies AB in Sweden, and we are responsible for your information. We collect what you give us when you submit a song, pay, use the portal, write to us or sign up for emails, and, only if you accept cookies, information about how you use the website. We use it to review your song, carry out the campaign you buy, take payment, keep our accounts, answer you and, if you have said yes, send you news and offers. It is received by the curators, blogs, journalists, radio stations and labels we pitch your song to (that is the service), and by service providers that help us run the business, such as our payment, email and hosting providers. It is processed in Sweden and other EU countries, and with some service providers in the United States and Singapore, and the recipients of your campaign can be anywhere in the world (section 6). Tracking for advertising and our visitor statistics are off until you turn them on, and we only send marketing emails if you have said yes. We never sell your personal information. You can ask for access, correction, deletion and more by writing to support@musikpitchen.se.
Effective date: 2 October 2026.
Last updated: 2 October 2026
1. Who is responsible for your information
Musikpitchen is run by Khoury Companies AB (Swedish registration number 559581-4012), Sandgatan 13, 311 47 Falkenberg, Sweden. Khoury Companies AB is the controller of the personal information processed through musikpitchen.se, the chat on the website and the customer portal at kund.khourycompanies.com/musikpitchen.
Our person in charge of the protection of personal information is our Privacy Officer, John El-Khoury, Head of Operations, who you can reach at support@musikpitchen.se or at the address above. You can contact this person with any questions, requests or complaints about how we handle your information.
2. What information we collect
When you submit a song at checkout: your name, email address and phone number; your artist name, town, links to your music and social media accounts; the release date and, where relevant, your label or distributor; what you write to us, for example the description of your goals; the packages you chose and the price; if you order as a business, the business name, registration number and VAT number and the contact person; and your answers to the questions at checkout, for example that you have the rights to the music and whether you want news and offers from us.
When you order and pay: your billing address, including country and province or state; the payment status, the amount and the currency; the country of your card, which together with your billing address shows which country's tax rules apply; and when you sent your order and accepted our terms at checkout, and whether you asked us to start right away. The version of our terms that applies is the one in force on the day you pay.
Our payment provider Stripe handles your card details. We never see or store your full card number.
In the customer portal: your email address and password (we only store the password as a hash), the details in your profile (first and last name, artist name, phone number, town, links to Instagram, TikTok and Spotify and, if you upload one, a profile picture), the language you choose, files and messages you send us (for example press photos, audio files or PDFs), your orders, extras, payments and receipts, the results of your campaigns, and when you read notifications.
When you write to us in the chat, through the contact form or by email: your message, any attached files and, if you give them, your name, email address, artist name and a link to your song.
When you sign up for news and offers: your email address, your language, and when, where and with which wording you gave your consent.
When you withdraw from a contract using our withdrawal function: your order number, email address, the content of your withdrawal and the time we received it.
When you visit the website: see section 9 and our Cookie Notice in section 15. Without your consent, our website does not collect visitor statistics and does not load any advertising tracking.
If you work in the music industry (for example as a curator, editor, blogger, radio presenter or label contact): see section 3.9.
What you must give us. The details marked as required at checkout and in the order summary are needed to review your song, make the contract and carry out your order, and your billing details are also needed to meet our accounting obligations. If you do not give them, we cannot take on your order. Everything else is up to you.
3. Why we use your information, and our legal bases
The General Data Protection Regulation (GDPR) applies to everything we do, wherever you live, because we are established in Sweden. For each purpose, we tell you the legal basis under the GDPR.
3.1 Reviewing your song and carrying out your order. We use your information to review your submission, send you the order summary, perform the campaign, communicate with you during it and deliver your report. Legal basis: steps taken at your request before entering into a contract, and performance of the contract (Art. 6(1)(b) GDPR).
3.2 Payment, bookkeeping and VAT. We keep payment and billing information to take payment and to meet our obligations under the Swedish Bookkeeping Act (bokföringslagen) and Swedish VAT law. If you order as a business in Norway or in an EU country other than Sweden, we check your organisation number in the Brønnøysund Register Centre or your VAT number in the EU's VIES register before we accept the order, and keep the number, date and result as an accounting record. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
3.3 Tax rules in other countries. We keep your billing country, province or state and card country, so that we can show which country's tax rules apply to your order and keep track of sales per country. Legal basis: our legal obligations (Art. 6(1)(c) GDPR) and our legitimate interest in complying with tax rules in the countries where our customers live (Art. 6(1)(f) GDPR).
3.4 How we make decisions. A person on our team reviews every submission and decides whether to accept it. We may use software tools to help us, for example to analyse the tempo, key, genre and lyrics of your song, but we do not make decisions about you based only on automated processing.
3.5 News and offers by email. We only send you news and offers if you have said yes, by ticking the box when you order or by signing up in the footer or the welcome window. When you sign up yourself, you first get an email asking you to confirm your address, and only then is it added to the list. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with the link in every email or by writing to support@musikpitchen.se. We keep a record of your consent so that we can prove it. Legal basis: our legitimate interest in being able to prove consent (Art. 6(1)(f) GDPR). To prevent misuse of the sign-up form, we also store a code calculated from your IP address with a secret key. The code is deleted within two hours. Legal basis: our legitimate interest in preventing misuse (Art. 6(1)(f) GDPR).
While your campaign is running, we may also email you when an extra becomes available for that campaign, for example when a curator or blog that suits your song charges its own fee to consider submissions. These emails only concern the campaign you have bought, and every one of them has a link to stop them. Legal basis: our legitimate interest in offering you extras for the service you have bought (Art. 6(1)(f) GDPR). You can object at any time, and stopping these emails does not affect your campaign.
3.6 Chat and contact form. We store your messages and files so that we can answer you. Legal basis: steps taken before entering into a contract or performance of the contract (Art. 6(1)(b) GDPR) and, for general questions, our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). While you are on the website and already have a conversation in the chat, we can see which page you are on, whether the chat window is open and whether you are typing, and while the chat window is open we can also see the text you are typing before you send it. We do not store that draft. Automated replies in the chat are marked as automated.
3.7 Withdrawals. If you withdraw from a contract, we store your withdrawal and the time we received it so that we can process it and prove it. Legal basis: legal obligation and our legitimate interest in being able to prove what happened (Art. 6(1)(c) and (f) GDPR).
3.8 The notice about recent orders. On the website, we sometimes show a small notice that someone recently ordered and paid for a service, for example "Someone in Toronto, Canada ordered Startpitchen yesterday". The notice only shows paid orders. It shows which service was ordered, roughly when, and where from: for orders placed in English and for orders from Sweden, Norway, Denmark and Finland the town and the country, and for all other orders only the country. Your name, artist name, song, email address and the amount are never shown, and each person appears at most once. Legal basis: our legitimate interest in showing that the service is used (Art. 6(1)(f) GDPR). If you do not want your order to appear, write to support@musikpitchen.se and we will remove it. If you close the notice, it is not shown again during your visit. That choice is only stored in your browser (sessionStorage) and disappears when you close the tab.
3.9 Contacts in the music industry. When we present our customers' songs, we email editors, curators, blogs, podcasts, radio stations and record labels. For this, we store the name of the outlet, where relevant the name of the contact person, the email address, the website, the country, the genre and where we found the details. The details come from publicly available sources, such as the outlet's own website where it invites submissions, and from music industry directories. We only use them to present suitable songs and to match replies. Every pitch tells you who we are and how to stop receiving pitches. Legal basis: our and our customers' legitimate interest in presenting music to suitable outlets (Art. 6(1)(f) GDPR). We keep the details for as long as we present songs to the outlet. If you reply "unsubscribe" or object in another way, we stop straight away, and in any event within five working days, and we keep a note of your objection against your address so that no one at Musikpitchen pitches to you again.
3.10 Visitor statistics and advertising measurement. Only with your consent. See section 9 and our Cookie Notice in section 15.
3.11 Security, misuse and legal claims. We use the information we need to keep our services secure, prevent fraud and misuse, and establish, exercise or defend legal claims. Legal basis: our legitimate interest in doing so (Art. 6(1)(f) GDPR).
3.12 Mentioning our work with you. We may mention in our own marketing that we have worked with you, using your artist name, song title and results that are already public, unless you have told us not to. We never publish a quote from you as a review or testimonial without your permission. Legal basis: our legitimate interest in showing our work (Art. 6(1)(f) GDPR). You can say no at any time by emailing support@musikpitchen.se, and we stop using your name in new marketing.
4. Who receives your information
The recipients of your campaign. To carry out the service, we share parts of your material, typically your artist name, song link, artwork or press photo and the texts we have written, with the curators, editors, writers, influencers, radio stations and record labels we pitch to, and with the stations, booking services and other partners that help us carry out, book, publish or upload something for your campaign. If a recipient only accepts music through its own form or platform, we submit your material there, and the recipient or the platform receives it. That is what the service consists of. We do not share your email address or phone number with them unless you ask us to.
We may also disclose information if the law requires it, for example to a court or a public authority.
We never sell your personal information, and we do not share it for any purpose other than those described in this policy.
Our service providers receive information to the extent they need it for their task:
- Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, our database provider. Supabase stores orders, messages and files from the chat and the contact form, withdrawals, the data in the customer portal, sign-ups for our emails, music industry contacts and the visitor statistics. The database is in a data centre in Ireland.
- Netlify, Inc., San Francisco, USA, our hosting provider. Netlify runs the website and the customer portal, receives your IP address for technical reasons and works out the approximate country, town and region for the visitor statistics.
- Resend (Plus Five Five, Inc.), San Francisco, USA, our email provider. Resend sends emails about orders and the customer portal, our news and offers, and our emails to the music industry, and receives the recipient's email address and name and the content of the email.
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace), our provider of email inboxes. If you email us or send a message in the chat, it ends up in our inbox with Google.
- Stripe Payments Europe, Limited, Ireland, our payment provider. Stripe handles payments and receives the details you enter on the payment page, the amount and the order number. Stripe is itself responsible for its own purposes, for example fraud prevention and its own legal obligations. Read more at https://stripe.com/privacy.
- IT and AI service providers that help us write texts, analyse songs and handle messages and emails, under agreements that require them to protect your information. Some of them process information in the United States, see section 6.
- Our accountants and our auditor, for accounting records.
- The European Commission's VIES register and the Brønnøysund Register Centre in Norway, where we check a business's VAT number or organisation number.
- Spotify, YouTube (Google) and SoundCloud, when you search for your song on the website or paste a link. Our server then asks the service for the title, artist and cover, and only sends your search term or link. Our server also loads the covers, so these services do not receive your IP address.
- Meta Platforms Ireland Limited, only if you have consented to the Meta Pixel, see section 9.
5. How we protect your information
We use encrypted connections (HTTPS), access controls so that only people who need information for their work can reach it, and agreements with our service providers that require them to protect it. No system is completely secure. If a security incident is likely to put your rights at risk, we report it to the authorities where the law requires it and tell you without undue delay where the law requires it. We keep a record of all security incidents.
6. Where your information is processed
We are based in Sweden, and our database is in Ireland. Some of our service providers are based outside the EU and the EEA or also process information there, for example for operations, maintenance and support. The list below shows these countries and how your information is protected.
The recipients of your campaign. The curators, blogs, radio stations, record labels and other recipients we pitch your music to, and the platforms they use for submissions, can be anywhere in the world, for example in the United States, Canada or Australia. They receive your material because sending it to them is the service you have asked us to perform. Where a recipient is outside the EU and the EEA in a country without an adequacy decision, the transfer is necessary for the performance of our contract with you (Art. 49(1)(b) GDPR). Each recipient decides for itself how it uses what it receives, under the law of its own country, and the protection there may be lower than in the EU.
You can ask for a copy of the standard contractual clauses at support@musikpitchen.se, and check whether a company is certified at https://www.dataprivacyframework.gov/list.
While your information is in another country, courts, law enforcement and national security authorities in that country may be able to access it under their laws.
Our service providers outside the EU and the EEA:
- USA (Netlify, Resend, Stripe, Meta and Google): these companies are certified under the EU-US Data Privacy Framework, and the transfer is based on the European Commission's adequacy decision for the USA (Art. 45 GDPR). In addition, the European Commission's standard contractual clauses apply where our service providers' contracts provide for them (Art. 46(2)(c) GDPR).
- USA (our IT and AI service providers): where the provider is certified under the EU-US Data Privacy Framework, the transfer is based on the adequacy decision (Art. 45 GDPR), and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
- Singapore (Supabase): there is no adequacy decision for Singapore, so the European Commission's standard contractual clauses apply (Art. 46(2)(c) GDPR).
7. How long we keep your information
We keep your information for these periods:
- Submissions that do not lead to an order: deleted after 12 months.
- Information about completed orders, including your order summary, the copy of your agreement and your consents: kept for three years so that we can deal with questions and complaints.
- Accounting records, including invoices, receipts, payment details and the information we use to show which country's tax rules apply: kept for seven years under the Swedish Bookkeeping Act.
- Customer portal: the details in your account and profile and the files you upload are kept for as long as your account exists, then deleted unless we must keep them as accounting records.
- Chat and contact form: deleted 12 months after the last message, unless they belong to an order.
- Withdrawals: three years, and accounting records seven years.
- Subscribers: until you unsubscribe. After that, we only keep your address, when you unsubscribed and how you gave your consent, so that you get no more emails and we can prove the consent was yours. A sign-up that is never confirmed is deleted after 30 days.
- Music industry contacts: for as long as we present songs to the outlet. If you object, we keep only your address and the date of your objection, so that we do not contact you again.
- Visitor statistics: deleted after 13 months.
- Suppression lists: if you have unsubscribed from our offer emails or asked us to stop sending pitches, we keep your email address on a suppression list for as long as we need it to respect your choice. The legal basis is our legitimate interest in not contacting you again. The suppression lists are therefore not deleted.
8. Your rights
You have the right to find out what information we hold about you and get a copy of it, to have incorrect information corrected, to have information deleted when it is no longer needed or when you withdraw your consent, to ask us to restrict the processing, to receive information you have given us in a structured, commonly used and machine-readable format, to object to processing based on our legitimate interest (see below), and to withdraw any consent at any time. Withdrawing consent does not affect processing carried out before you withdrew it.
Your right to object. Where we process information on the basis of our legitimate interest, for example for the notice about recent orders, the emails about extras during your campaign, when we mention our work with you or when we write to you as a music industry contact, you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). If we use your email address for marketing, you can object at any time without giving a reason, and we will stop (Art. 21(2) GDPR).
To use your rights, write to support@musikpitchen.se. We answer within one month, and we may ask you to confirm your identity. Using your rights is free.
If you are not happy with how we handle your information, you can complain to our supervisory authority, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se. If you live or work in another EU or EEA country, you can also complain to the data protection authority there. Section 12 lists further options if you live in Canada or Australia.
10. Do Not Track, Global Privacy Control and tracking by other companies
If you click Accept in the cookie banner, Meta may collect information about your activity on our website over time and combine it with your activity on other websites and apps. If you do not accept, no other company collects that kind of information through our website.
Our website does not respond to Do Not Track signals, because there is no common standard for them, and it does not treat a Global Privacy Control (GPC) signal as an opt-out. This changes nothing for you: the Meta Pixel and our visitor statistics only run if you click Accept in the cookie banner or choose them under Choose.
11. Children
Musikpitchen is not directed to children. You must be at least 18 years old, or the age of majority where you live, to place an order. Orders for artists under 18 need the consent of a parent or legal guardian, who places the order and is our contact during the campaign. We do not take on campaigns for artists under 13, and we do not knowingly collect personal information from children under 13. In Québec, we do not collect personal information from a child under 14 without the consent of a parent or guardian. If you believe a child has given us personal information, for example in the chat, email support@musikpitchen.se and we will delete it.
12. Additional information for specific countries
If you are in Canada
Our person in charge of the protection of personal information is our Privacy Officer, John El-Khoury, Head of Operations, Khoury Companies AB, Sandgatan 13, 311 47 Falkenberg, Sweden, support@musikpitchen.se. You can contact this person with questions, requests or complaints.
We store and process your information in Sweden and other EU countries. Some of our service providers, for example our payment provider and our IT and AI service providers, may also process it in the United States, and our database provider's support may access it from Singapore. The recipients of your campaign can be in any country (section 6). While your information is outside Canada, courts, law enforcement and national security authorities in those countries may be able to access it under their laws. We have agreements with our service providers that require them to protect your information.
You can ask for access to the information we hold about you and ask us to correct it, and, if you live in Québec, ask for a copy in a structured, commonly used technological format. We answer within 30 days. You can withdraw your consent at any time, for example to our emails.
Tracking for advertising is off until you turn it on in the cookie banner.
We do not make decisions about your order based only on automated processing. A person reviews every order.
If a security incident creates a real risk of significant harm to you, we will tell you and report it to the Office of the Privacy Commissioner of Canada and, if you live in Québec, to the Commission d'accès à l'information.
If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or, in Québec, the Commission d'accès à l'information (www.cai.gouv.qc.ca).
If you are in Australia
This policy explains the kinds of personal information we collect and hold, how we collect and hold it, why we collect, use and disclose it, and how you can access and correct it. To make a request or a complaint about how we handle your personal information, email support@musikpitchen.se. We will reply within 30 days. If you are not satisfied with our response, you can contact the Swedish Authority for Privacy Protection (IMY) and, where the Australian Privacy Act 1988 applies to us, the Office of the Australian Information Commissioner (www.oaic.gov.au).
We are based in Sweden. Your personal information is stored and processed in Sweden and other countries in the European Union, and some of our service providers process it in the United States and Singapore, as described in sections 4 and 6. The recipients of your campaign can be in any country, including Australia.
If you are in the United States
This policy is effective from the date at the top of the page. Section 2 lists the categories of personal information we collect, section 4 the kinds of third parties we share it with, section 8 how you can review and ask us to change your information, section 10 how we respond to Do Not Track and Global Privacy Control signals and whether other companies can track you on our website, and section 13 how we tell you about changes.
13. Changes to this policy
We may update this policy. The latest version is always published here, with its effective date and the date of the last update at the top. If we make an important change, we will make it clear on this page and, where appropriate, tell you by email.
14. Contact
Khoury Companies AB (Musikpitchen), Sandgatan 13, 311 47 Falkenberg, Sweden. Email support@musikpitchen.se. Phone +46 73 031 74 84.