Privacy Policy

1. Data controller

The data controller is [to be completed: company name], [to be completed: registered address], [to be completed: company registration number]. For any question about your data, write to support@blackplayer.app.

2. What data we process

• Device data: Device ID, platform (iOS/Android), model, app version, last connection time.
• Device Key: stored only as a cryptographic hash (not even we can read it).
• Hardware identifier: sent by the app so the free trial cannot be reset; stored only as a cryptographic hash.
• Your playlists: names, addresses, usernames and passwords of your providers, stored encrypted. We only use them to deliver them to your app.
• License and payment data: license type, activation and expiry dates, amount, currency, transaction ID. Card details are handled exclusively by the payment processor; we never see or store them.
• Technical and security data: IP address and browser type when you sign in to the portal, used for security and to limit repeated attempts.
• Email address (optional): only if you add one on your device page to receive license confirmations and expiry reminders. It is used only after you confirm it through a link, and you can remove it at any time from the same page.

We do not ask for your name, address or phone number to use the app. Apart from the optional notification email, we only receive your email if you contact us or if the payment processor requires it.

3. Why we process it (purpose and legal basis)

• Providing the service (device, license, playlists): performance of a contract (Art. 6(1)(b) GDPR).
• Fraud prevention and security (hardware identifier, IP, rate limiting): our legitimate interest in protecting the service (Art. 6(1)(f)).
• Payment records: legal tax and accounting obligations (Art. 6(1)(c)).
• Notification emails (license confirmations and expiry reminders): your consent, given by adding and confirming your email (Art. 6(1)(a)); you can withdraw it at any time by removing the email.

We do not use your data for advertising, we do not profile you and we do not sell data.

4. Cookies

The portal only uses strictly necessary cookies:

• bp_session: keeps you signed in to the portal (up to 7 days);
• bp_reseller: keeps resellers signed in to their portal (up to 7 days);
• locale: remembers your language (1 year).

We use no analytics or marketing cookies, so your consent is not required for them.

5. Who we share data with

Data is accessed only by us and by providers that help us run the service, under contracts that protect it:

• our server hosting provider;
• the payment processor (for payment data);
• Resend (Resend, Inc.), which delivers our emails, only if you added a notification email;
• Apple, if you activate through In-App Purchase on iOS.

If a provider processes data outside the European Economic Area, we make sure appropriate safeguards are in place (e.g. Standard Contractual Clauses approved by the European Commission).

We only disclose data to authorities when the law requires it.

6. How long we keep data

• device data and playlists: while you use the service, until you ask us to delete them;
• sign-in sessions: until they expire (up to 7 days);
• notification email: until you remove it or the device is deleted; one-time email links expire within 72 hours;
• payment data: as long as tax and accounting laws require;
• security log (activations, license moves): for as long as the device exists.

7. How we protect data

Playlist addresses and passwords are encrypted (AES-256). Device Keys and hardware identifiers are stored only as cryptographic hashes. Administrative access is password-protected, and administrators cannot see your playlist credentials.

8. Your rights

You have the right to:

• know what data we hold about you and get a copy (access and portability);
• correct your data (rectification); you can edit your playlists on the portal at any time;
• ask us to delete your data; you can delete playlists yourself on the portal, and for complete deletion of the device write to support@blackplayer.app;
• ask us to restrict processing or object to processing based on legitimate interest.

To verify your identity, include your Device ID in your request. We reply within one month.

You also have the right to lodge a complaint with the Romanian data protection authority (ANSPDCP, www.dataprotection.ro) or the authority in your country.

9. Children

The service is not intended for children under 16. Licenses must be purchased by an adult.

10. Changes

If we change this policy, we will publish the new version here with the update date.