Privacy statement

1. Who's behind this

This site is made and run by My Last Record (Mijn Laatste Plaat). There's no separate company behind it and no chamber-of-commerce number. Questions about your data go to info [at] mijnlaatsteplaat.nl or through the contact form on this site.

For this statement, My Last Record is the data controller under the GDPR.

2. What is kept, and why

Your account details: your email address, your first and last name, whether you're a man or a woman, and your language preference. Needed to sign you in, to address you properly, and to say "his five" or "her five" in the email to the people you invite.

Your music: the five records, the order you put them in, and any note you add. That is what the site is for.

Your trusted contacts: their name and email address, the personal note you may write with the invitation, and whether they have opened the list yet. Needed to invite them, and to send the same invitation again later.

The record of your agreement: the time, the version of the terms, a fingerprint of the exact text you saw, your IP address and your browser details. Needed to show that you agreed, and when.

Your message if you use the contact form, along with your name and email address.

Your IP address when you submit a form, and a counter for the number of attempts. Needed to keep spam and misuse out.

Nothing else. No profiles, no advertising, and nothing sold on to anyone.

3. Choosing before you have an account

While you choose without an account, your choice is stored only in your own browser, not with us.

When you press "Email me the link", we set up your account with your email address, and the numbers of your records travel along in the link in that email. Only when you click that link do your records reach us.

Your list says what music you love. We do nothing with it other than keep it and show it to the people you choose: we don't draw conclusions about who you are, we don't build profiles, and we share it with no one.

This site is not meant for children under 16.

If you no longer want us to keep your list, delete your records or your account. Both are yours to do, without asking anyone.

4. Who can see it

You.

The trusted contacts you add, through their own link. They see your list, not your account details.

The administrator of this site, for account support only. That includes your choice of records. Never for commercial purposes, never shared with anyone else. Every action the administrator takes is logged.

The parties that keep the site running and act only on instruction: Supabase (database, London), Brevo (sending the sign-in email), Resend (sending invitations, reminders and other email), and Vercel (hosting and the visitor counter; the functions run in London). There is a data processing agreement with each of them.

Apple, when you search for music: your search term goes to the iTunes Search API. Your name and your list never do.

5. How long it stays

Your account and everything in it: for as long as you keep your account. Delete it and it is gone at once.

Messages sent through the contact form: twenty-four months.

The record of your agreement stays, even after you delete your account. What is left is an irreversible fingerprint of your email address, the version, the fingerprint of the text, and the time. No name, no address, no IP address. It is there only to show that you agreed.

An account whose email link was never clicked: deleted after seven days.

Technical counters for forms: a few hours at most.

After a death, the list stays and the trusted contacts' links keep working, exactly as intended. If a family wants an account deleted, that can be arranged through the contact form; you will be asked for something that shows the death and your relationship to the person.

6. Your rights

You have the right of access, rectification, erasure, restriction, objection and data portability.

Access and portability are already built in: under Account there is a button that downloads everything in one file. Deletion is there too, and it takes effect immediately.

For anything else: the contact form, subject "My data". You will get an answer within thirty days.

If you disagree with the way your data is handled, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

7. Cookies and security

This site sets two kinds of cookies: one that keeps you signed in, and one that remembers which language (Dutch or English) you last viewed the site in. Both are strictly necessary for the site to work the way you've set it up, so no consent is required for them.

If you choose without an account, your own browser remembers your choice, in your browser's local storage (not a cookie). It goes nowhere until you save it, and it disappears once you save it or clear your browser data.

There is a simple visitor counter (Vercel Web Analytics). It uses no cookies and stores no IP addresses or anything else that could identify you. It counts how many pages are viewed, and from what kind of device and which country. There are no ad networks and no trackers on this site, which is why you see no cookie banner.

Every connection runs over HTTPS, and all data is stored encrypted.

The database enforces, row by row, that you can only reach your own data. That is not a check in the website but a rule in the database itself, and it holds even if the website has a bug.

There are no passwords, so there is no password to leak.