Last updated 16 September 2026. This explains what we collect, why, and what you can do about it. It is written to be read rather than to be comprehensive-looking.
WIZR SAS, a société par actions simplifiée registered in Paris, France (RCS Paris 838 219 418) is the data controller. Contact us about anything on this page at .
| What you type | Writer names, song titles, Spotify links, ISRCs and any spreadsheet you upload. We use these to run the search you asked for. |
| Your email | Given when you ask to see catalogue results, request a report, or contact us. Also your name, company and role if you provide them. |
| Results | What the search returned, stored so the result page still works when you come back to it. |
| Your email, if you join the waiting list | Given on the holding page, before the service opened. We send a short confirmation straight away and one email when it opens, and nothing else. We keep the address and the date you gave it. It is not a newsletter and it is not shared. Ask us and we will delete it. |
| A session identifier | A random value in a cookie, used only to count free lookups. It is not linked to your identity and carries no personal data. |
| Payment | Handled by our payment provider. We receive confirmation that a payment succeeded and never see your card details. |
To run a search and deliver a report: performance of a contract, or steps taken at your request before entering one. Without this data there is no service.
To tell you when the service opens: your consent, given by typing your address into the waiting list. You can withdraw it at any time by asking us, and we will delete the address rather than merely stop writing.
To limit free usage and prevent abuse: our legitimate interest in keeping a free service available and not overloading the sources we read.
To reply to you about your enquiry: our legitimate interest in responding to someone who contacted us, or performance of a contract if you go on to become a client.
To send you anything else: your consent, which you can withdraw at any time. We do not add you to a mailing list because you ran a search.
We do not sell your data. We do not share it with advertisers for them to use for their own purposes. Inside the app itself, once you have run a search, there is no advertising or analytics tracking at all.
One exception, and it is on the holding page rather than in the app: while the service is in preview, soundsmatch.com carries the Meta pixel, so we can tell whether the people arriving from an advert are the people we meant to reach. It is described below.
In the app, one cookie, named sm_sid. It holds a random
identifier and is used solely to count how many free lookups have been made
from your browser. It expires after 30 days. Under the ePrivacy rules a cookie
that is strictly necessary to provide a service you have explicitly requested
does not require consent, and this is one: without it the free tier cannot be
offered at all.
On the holding page at soundsmatch.com, the Meta pixel. It loads a script from Meta and records that the page was viewed. Meta may read and set its own cookies through it and may connect that visit to an account you hold with them. We use it for one thing: to see whether our advertising is reaching the right people. It runs on the holding page only. It is not on the app, and it is not on the pages where you run a search or read a report.
Being straight about the legal position. An advertising pixel is not strictly necessary, and under the ePrivacy rules and CNIL guidance that means it should ask for your consent before it loads rather than after. It currently loads with the page. We are changing that, and until we do, two things are true and worth stating plainly: you can block it with any tracker blocker or by using Meta's own off-Facebook activity controls, and nothing you do on the holding page is required to use the service.
If you would rather it had not run, write to contact@soundsmatch.com and we will tell Meta to delete what it holds about your visit.
Search results contain the names of writers and publishers as recorded in the MLC's public database, which the MLC publishes and states may be used for any lawful purpose. We store the results of searches you run so that your report works, and we do not build profiles of those people or use their details for anything else.
If you upload a spreadsheet, please send only what is needed: recording identifiers and titles. Do not include other people's personal data.
Our hosting provider, our payment provider, and our email provider, each acting on our instructions under a data processing agreement. The searches themselves are sent to the MLC and, where you provide a link, to Spotify. We do not send them your email address.
Meta, but only for a visit to the holding page, and only what the pixel described above sends: that the page was viewed, from which browser and roughly where. Meta acts as a controller of that data in its own right, not on our instructions, which is why it is set out separately here.
Within the European Economic Area wherever possible. Some providers may process data outside it, in which case the transfer relies on an adequacy decision or on standard contractual clauses.
Search results and the associated email: 24 months, so you can come back to a report and so we can answer questions about one.
Waiting list addresses: until we have written to you once, and then a further 3 months in case you reply. Earlier if you ask.
Enquiries and correspondence: 3 years from our last exchange.
Records relating to a payment: as long as accounting and tax law requires, currently 10 years in France.
The session cookie: 30 days.
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Where we rely on consent, you can withdraw it at any time.
Write to and we will reply within one month. If you are not satisfied, you may complain to the CNIL (cnil.fr) or to the supervisory authority where you live.
Access is limited to people who need it, transport is encrypted, and credentials are held outside the codebase. No system is perfectly secure, and we will tell you and the CNIL if a breach affects you and the law requires it.
This service is for people managing music rights and is not directed at children. We do not knowingly collect data from anyone under 16.
We will update this page when what we do changes, and the date at the top will tell you when.