Your data
stays yours.

Reverb ("we", "us") is run by the team behind myreverb.nl, operating as a sole-trader based in the Netherlands. We're the data controller for the information described below. EU users can reach us at privacy@myreverb.nl for any privacy question or to exercise your rights under GDPR.

Two kinds of data, both minimum-necessary for the service to work.

We never collect, see, or store:

• Passwords for any distributor.
• Payment-card numbers (Stripe holds those, not us).
• Browser history outside the connected distributor sites.
• Listener-level data (who streamed your music — distributors don't share that anyway).

Under GDPR we need a legal basis for every type of processing. We rely on three of the six bases the regulation allows:

• Contract performance — we need your royalty data to deliver the dashboard you signed up for. Same basis Spotify uses to process your listening history.
• Your consent — the first time you Connect a distributor in the Reverb extension, you explicitly authorise us to read your data from that platform on your behalf. You can revoke at any time by disconnecting the integration.
• Article 20 right exercise — when we pull your data from a distributor, you're exercising your data-portability right. We're the tool you use to do it; the legal basis lives with you.

Full technical detail lives on the Security page. Headline answers:

• Database: Neon (EU region, Frankfurt). Encrypted at rest with AES-256.
• App + API: Vercel (EU region). HTTPS-only, HSTS enforced.
• Authentication: Clerk. They handle password hashing, MFA, session rotation.
• Payments: Stripe (only when you upgrade to Plus).

Every row in our database is scoped to your user ID and filtered server-side. Other Reverb users can't see anything of yours. The team can access anonymised aggregate data for debugging; identifiable rows only for an explicit, audited support request.

We hold your data for one reason: to render it back to you on the dashboard. The storage exists because you asked us to show you these numbers, and we have to keep them somewhere to be able to show them on every visit. Past that point, the processing stops. Specifically:

• We don't sell your data. Not to advertisers, not to data brokers, not to anyone.
• We don't share it with marketing or ad-tech platforms. There is no embedded tracker on the dashboard.
• We don't use it to build aggregate analytics or commercial insights products — there's no "industry trends" report sourced from your numbers.
• We don't train AI models on it. Not ours, not anyone else's.
• We don't profile you across the dashboard. No behavioural scoring, no personalised offers based on your earnings.

The vendors who power the service (Neon, Vercel, Clerk, Stripe) each see a slice of your data because they host the relevant piece of infrastructure. All four are GDPR-compliant processors under standard Data Processing Agreements. They process on our behalf and cannot use your data for their own purposes.

When you Connect a distributor, the extension talks directly from your browser to that distributor (we never proxy your session through our servers).

As long as your account is active, plus the time it takes to export everything if you ask for it.

When you delete your account: everything tied to your user ID is wiped from the database within 30 days. Backups are rotated on a 30-day cycle and overwritten in the same window. We email you a confirmation with row counts deleted so you can verify.

You have all of them. Practical pointers per right:

We set exactly two kinds of cookies on myreverb.nl:

• The Clerk authentication session cookie (so you stay signed in).
• A theme preference cookie (dark vs. cream mode).

Both are first-party, strictly necessary, and require no consent banner under the ePrivacy Directive. We don't use Google Analytics, Mixpanel, Posthog, Segment, or any other third-party analytics product. No Facebook Pixel. No ad tracking.

If we materially change what we collect, share, or how we hold it, we'll email every active user at least 14 days before the change takes effect. The "Last updated" date at the top tells you when this version went live.