Privacy policy

Updated: 9 October 2026

This policy describes data processing on kirabeats.com, especially accounts, the public Kira Beats Radio Chat room and track comments. Voting, newsletter and shop features are not enabled.

Controller

The project is identified as Kira Beats and can be contacted at hello@kirabeats.com. The project owner must add their legal name or company name and address here before opening the service to the public. A brand name alone does not identify the controller legally.

Data and purposes

  • Account: email address, internal identifier, password stored by the authentication provider as a hash, and creation/update timestamps. Used to create and protect your account, verify your email, sign in and recover access.
  • Public profile: the alias and avatar you choose. Visitors can see them in the room and next to your track comments.
  • Chat and comments: text, publication time, the relevant track, alias/avatar and replies linked to a top-level comment. Replies have one level only. Approved content is visible to any visitor; comments awaiting review are not shown publicly. Moderation records and decisions are restricted to authorised staff.
  • Comment notices: every submitted comment, including one held for review, triggers an email to hello@kirabeats.com. It includes the alias, text, review status and track link. It is not sent to the author's account email.
  • Security: authentication may store the IP address and user-agent associated with a session. Request data is also processed to limit abuse and protect accounts. An IP address is not stored alongside each chat message.
  • Preferences and analytics: a cookie stores your cookie choice. Google Analytics loads only if you accept analytics.

We do not ask for special-category data. To reduce spam and abuse, chat messages and comments that trigger automated signals (for example, links or repeated patterns) may be analysed by a text classifier. Only the text is sent; the account email, alias, avatar and account identifier are not. The tool may recommend allowing, reviewing or blocking content, but it does not impose sanctions or delete it: a person makes moderation decisions. If analysis is unavailable or inconclusive, the content remains pending review.

Legal bases and purposes

Account, chat, comments, replies and the operational notice to hello@kirabeats.com are processed to provide the functions you request when registering and posting (GDPR Article 6(1)(b)). Anti-spam and anti-abuse controls, impersonation and threat handling, rate limits and moderation rely on the legitimate interest in keeping the community safe (Article 6(1)(f); you may object on grounds relating to your situation). Optional analytics relies on your consent (Article 6(1)(a)), which you can withdraw in Cookie Preferences. Data required by law is processed under Article 6(1)(c) where applicable.

Before launch, the controller must document the balancing test for this legitimate interest and confirm that each purpose and retention period is necessary.

Visibility and providers

Your alias, avatar and approved content are visible to people visiting the room or relevant track page. Neon provides the database; Vercel hosts the application and provides infrastructure; Resend delivers account emails and comment notices; OpenRouter routes selected text to a model provider for classification; Google Analytics receives analytics data only after you opt in. Comment notices go to hello@kirabeats.com to manage site activity and moderation. OpenRouter states that model providers have different data practices and some may retain or use inputs and outputs; the configured provider's practices should be reviewed before enabling analysis. The actual processing locations and safeguards for any international transfers must be confirmed by the owner against the provider accounts and agreements. We do not sell data or use account emails for a newsletter.

Retention

Chat messages, comments, replies and technical events are automatically deleted after 180 days. Moderation and audit records are deleted after 365 days. Cleanup runs daily on the deployment. Expired sessions are removed during that cleanup. Account and profile data are kept while the account remains active; to request account closure or erasure, email hello@kirabeats.com. The minimum information needed for legal obligations or claims may be retained.

Your rights

You may request access, rectification, erasure, restriction, portability or object where applicable by emailing hello@kirabeats.com. Include your account email and the right you wish to exercise. We will ask for additional information only if needed to verify your identity; do not send an identity document unless it is strictly necessary and specifically justified. You may also complain to the Spanish Data Protection Agency.

If you are under 14, do not create an account without the involvement or authorisation required by applicable law.

Security and updates

Accounts, the database and moderator access are protected by technical safeguards and access controls. No transmission or system can guarantee absolute security. Material changes will be published here. The controller's legal identity and confirmation of providers and transfers must be completed before public launch.