Privacy Policy

Calrave processes the minimum amount of personal data needed to make the site work. This policy explains what we collect, why, and your rights under the GDPR (EU Regulation 2016/679).

Data controller

Stefan Godin, individual, France. Contact for any privacy-related question : [email protected].

Data we collect

We collect very little data. Specifically :

• Anonymous analytics via Cloudflare Web Analytics. No cookies, no IP addresses stored, no individual user tracking. Aggregated pageviews only, broken down by region / country / browser.
• Email address if you subscribe to the newsletter (form not active yet ; will be when we launch it).
• Server logs kept by Cloudflare for technical operation (caching, DDoS protection). We do not access them ourselves.

Purposes

• Measure how the site is used (which pages, which countries) to inform editorial coverage.
• Send a newsletter to people who explicitly subscribe.
• Operate the site (caching, security, error handling).

Legal basis

Legitimate interest for anonymous analytics. Explicit consent for the newsletter, when it goes live.

Recipients

Cloudflare, Inc. (hosting + analytics provider, USA, GDPR compliant under the EU-US Data Privacy Framework). No third-party advertising network. No data resale, ever.

Retention

Analytics : anonymous and aggregated, no individual retention. Newsletter (when live) : until you unsubscribe, then 30 days for audit logs before final deletion.

Cookies

Calrave uses no non-essential cookies. Cloudflare may set strictly necessary cookies for security purposes (anti-bot, anti-DDoS). No analytics cookies. No advertising cookies. Embedded players (Spotify, YouTube) are click-to-load, so no third-party cookie is set before you choose to load them (see "Third-party content" below). No consent banner required at this stage.

Third-party content (players, images)

Some pages embed content hosted by third parties. Here is exactly what that means for your data:

• The Spotify and YouTube players on artist pages are click-to-load: nothing is requested until you click to load them. Once you do, Spotify (privacy policy) or Google/YouTube (privacy policy) may set third-party cookies and receive your IP address. Don't click to load if you would rather they didn't.
• Artist photos are served from our own server. They were downloaded once from the artists' public Spotify / Deezer profiles, so displaying them sends no request to any third party.
• Favourite artists are stored in your browser's localStorage, on your device only. They are never sent to us, set no cookie, and you can clear them anytime by emptying your browser's site data.

Affiliate links

Some practical guides link to products on Amazon through the Amazon Associates programme. If you buy through one of these links, we may earn a commission at no extra cost to you. These links are marked as affiliate links and open on Amazon, whose own privacy policy then applies.

Your rights under the GDPR

Under the GDPR you have the following rights :

• Right to access the data we hold about you
• Right to rectify inaccurate data
• Right to erase your data ('right to be forgotten')
• Right to data portability
• Right to object to processing
• Right to lodge a complaint with the CNIL (France), the AEPD (Spain), or your local supervisory authority

To exercise any of these rights, email [email protected]. We respond within 30 days.

Changes to this policy

If this policy changes (new feature, new data collected, new processor), we will update this page and the 'last updated' date at the top. Material changes will be highlighted on the homepage for at least 14 days.