Privacy policy

This policy explains what personal data AIR collects, why, how long we keep it and what rights you have. It covers listening to AIR on listentoair.live and in the AIR app, AIR Rewards, and AIR for Business.

1. Who we are

In this policy, "AIR", "we" and "us" mean the data controller above.

2. What we collect

If you only listen

You do not need an account to listen to AIR. When you listen:

• Our servers receive your IP address, your browser and device type and the time of each request, as every website does.
• While AIR is playing, the player sends a random listening session number every 30 seconds. It is created fresh each time the player opens and is not linked to your name or email. We use it to count listeners and listening time.
• We work out an approximate location (country and town) from your IP address for listener statistics. We never use your device's GPS for this.
• The player and the AIR app store a few small settings on your own device, for example whether you dismissed the install banner. We do not use advertising cookies or tracking pixels.

If you join AIR Rewards

• Login details: your email address. If you log in with Google or Apple, also the name they share with us.
• Your profile: display name, date of birth, country and town.
• Your consents: which terms and policy you accepted, with the date, time, IP address and device type, and your choice about AIR emails.
• Logins: how you logged in, when, and the IP address and device type used.
• Listening for creds: when your listening sessions start and end, the regular "still playing" check-ins from your player, the device used and its IP address. We need these to work out your creds and to check that creds are earned fairly.
• Creds: creds earned, spent, held for review or expired, and the partner offers you use.
• How you joined: if you joined through a partner business's AIR QR code, which business location it was.

If you register a business on AIR for Business

• Everything above for the owner or manager's own account.
• Business details: legal and trading names, contact phone and email, website, VAT or tax number, company registration number and the result of the EU VAT (VIES) check.
• Verification documents you upload, such as a VAT certificate or the owner's ID.
• Locations: addresses, type of premises and opening hours.
• Devices: the devices paired to your locations and when they play AIR, to work out business creds.
• Offers you create for AIR listeners, and any referral code you entered.

If you contact us

Your messages and our replies.

3. Why we use it, and our legal basis

Login codes, security messages and important account notices are part of the service and are sent whatever your email choice.

4. Fair-earning checks

AIR Rewards pays creds for listening, so we check that listening is genuine. Automated checks look at patterns such as session timings, devices and IP addresses. They may hold creds for review. A person reviews held creds and any decision to remove creds or close an account. Nobody is ever prevented from listening to AIR.

5. Who we share data with

We do not sell your personal data. We share it only with the service providers that run AIR for us, under contracts that require them to protect it:

• Hetzner Online GmbH (Germany): our servers and database.
• Auth0 by Okta (EU region): logins.
• Google and Apple: only if you choose to log in with them.
• Brevo (France): sending login codes and AIR emails.
• European Commission VIES service: checking EU VAT numbers for AIR for Business.
• Google Fonts: our pages load fonts from Google's servers, which receive your IP address.

When you use a partner offer, the business sees only what it needs to honour it. We may also disclose data where the law requires it, or to protect AIR, its members or the public from fraud or harm.

6. Data outside the EU

We keep AIR's own data in the EU. Some providers (for example Okta, Google and Apple) may process data in other countries. Where that happens, they rely on safeguards recognised under EU law, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

7. How long we keep it

Creds that are not used may expire after 12 months without activity, as explained in the AIR Rewards terms.

8. Your rights

You have the right to:

• get a copy of your personal data;
• have it corrected or deleted;
• restrict or object to how we use it, including use based on our legitimate interests;
• receive it in a portable format;
• withdraw your consent to AIR emails at any time.

Email hello@listentoair.live from the address on your account. We reply within one month. You can also complain to the Information and Data Protection Commissioner (IDPC) in Malta: idpc.org.mt.

9. Age

Anyone can listen to AIR. AIR Rewards and AIR for Business are for people aged 18 or over. If we learn that someone under 18 has joined, we close the account and delete their data.

10. Security

Connections to AIR are encrypted. Access to personal data is limited to what is needed to run AIR. Logins are handled by Auth0, so we never see or store passwords.

11. Changes to this policy

The version and date at the top show when this policy last changed. If a change is material, we tell members and business owners by email before it takes effect.