GDPR and CCPA Privacy Rights

This page explains the specific privacy rights available to users under the General Data Protection Regulation (GDPR) — which applies to users in the European Union and European Economic Area — and the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), which applies to residents of California, United States.

If you are not based in the EU or California, your general privacy rights are covered in the Privacy Policy.

About BPMKeyFinder.com and Data Processing

BPMKeyFinder.com is a free educational website providing a browser-based audio analysis tool and educational content about BPM detection, musical key detection, and harmonic mixing. The website is operated by Charlotte Hayes (contact available via the Contact page).

What data this site processes:

Uploaded audio files. When you upload an audio file, it is read from your device locally by the browser’s FileReader API and decoded within the browser’s AudioContext. The audio is analysed locally using JavaScript. No audio file or audio data is transmitted to or stored by BPMKeyFinder.com at any point. Because the site never receives or retains audio files, uploaded audio does not constitute personal data held by BPMKeyFinder.com.

Analysis results. BPM values, key names, and Camelot Wheel codes are displayed on screen as text and are not transmitted to or stored by BPMKeyFinder.com.

Usage data. Basic technical data may be processed by hosting infrastructure — including IP address, browser type, and device category — for security and functionality purposes only.

Contact data. If you contact us via the Contact page, we receive your email address and message content. Used only to respond to your inquiry.

Cookies. Only essential functional cookies are used. No advertising or tracking cookies. Full details in the Cookie Policy.

Part 1 — GDPR Rights (EU and EEA Users)

Your Rights Under GDPR

Right of access. You have the right to request confirmation of whether BPMKeyFinder.com holds any personal data about you. Because this site does not require registration and uploaded audio files are never transmitted or retained, the only personal data that may exist is information voluntarily submitted through the Contact page.

Right to rectification. You have the right to request correction of any inaccurate or incomplete personal data held about you.

Right to erasure. You have the right to request deletion of personal data held about you where it is no longer necessary for the purpose it was collected, or where you withdraw consent.

Right to restriction of processing. You have the right to request that processing of your personal data be restricted in certain circumstances.

Right to data portability. Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, machine-readable format.

Right to object. You have the right to object to processing based on legitimate interests and to object to direct marketing at any time.

Rights related to automated decision-making. BPMKeyFinder.com does not engage in automated decision-making that produces legal or similarly significant effects.

Legal Basis for Processing

Legitimate interests — for basic website security and functionality monitoring
Contractual necessity — where processing is needed to respond to a contact inquiry you initiated

Data Retention

Contact data is retained only as long as necessary to resolve the inquiry. Uploaded audio data is never retained — it exists only within your browser’s memory during active analysis and is cleared when you navigate away or close the tab.

International Data Transfers

Where web hosting infrastructure processes data outside the European Economic Area, appropriate transfer mechanisms under GDPR apply. BPMKeyFinder.com does not use third-party advertising or analytics services that transfer personal data internationally for commercial purposes.

How to Exercise Your GDPR Rights

Submit a data request via the Contact page with the subject line “GDPR Data Request.” Describe the right you wish to exercise. We will respond within 30 days as required by GDPR.

If you believe your rights have not been respected, you have the right to lodge a complaint with your national data protection supervisory authority. A full list of EU supervisory authorities is available at edpb.europa.eu.

Part 2 — CCPA Rights (California Residents)

Your Rights Under CCPA/CPRA

Right to know. You have the right to request disclosure of the categories and specific pieces of personal information BPMKeyFinder.com has collected about you, the purposes for which it was collected, and whether it has been shared or sold.

Right to delete. You have the right to request deletion of personal information collected from you, subject to certain exceptions permitted by law.

Right to correct. You have the right to request correction of inaccurate personal information held about you.

Right to opt out of sale or sharing. BPMKeyFinder.com does not sell personal information. This site does not use advertising networks and does not share personal data for cross-context behavioural advertising purposes. There is no advertising-related data sharing to opt out of.

Right to limit use of sensitive personal information. BPMKeyFinder.com does not collect sensitive personal information as defined under CPRA.

Right to non-discrimination. Exercising your CCPA rights will not result in a different level of service or any penalty.

A Note on Uploaded Audio Under CCPA

Audio files uploaded to BPMKeyFinder.com are processed locally within your browser and are never transmitted to or stored by BPMKeyFinder.com. Because this site never receives or retains uploaded audio files, they do not constitute personal information held by BPMKeyFinder.com for CCPA purposes. Analysis results — BPM values, key names, and Camelot codes — are displayed on screen only and are not retained by the site.

How to Exercise Your CCPA Rights

Submit a request via the Contact page with the subject line “CCPA Privacy Request.” We will respond within 45 days, with the option to extend by a further 45 days where necessary.

Contact for Privacy Matters

All privacy-related requests should be submitted through the Contact page. We are committed to responding promptly and transparently.