Privacy Policy
This policy explains how we process personal data when you use JukeDJ: the iOS and Android app, the guest website at app.jukedj.com, the DJ web app at dj.jukedj.com, the venue screens portal at signage.jukedj.com and the JukeDJ music box for venues, including guests' messages on the venue's screens (Dedication, Big dedication, TV message and strip message), the social wall that shows Instagram posts on the venue's screens, and Google reviews, which show the venue's public reviews from Google Maps on the venue's screens (the “service”).
1. Controller
SINGLE CUBE s.r.o.
Company ID (IČO) 06731660
Bítovská 1222/32, 140 00 Prague 4, Czech Republic
registered in the Commercial Register kept by the Municipal Court in Prague, section C, file 287962
Email: support@jukedj.com
We have not appointed a Data Protection Officer because the law does not require us to. Please send any privacy question to the email above.
2. Who uses the service
- Guests attend an event and send song requests, ratings or tips to the DJ, or messages to the venue's screens. Guests do not create an account; a nickname and an event code, QR code or gift code is enough.
- DJs have an account with email and password, run events and receive requests and payments.
- Venue operators are DJs who run a JukeDJ music box at a venue, connected to their own Spotify account, or JukeDJ screens.
- Instagram post authors are people who, on the photo of a public Instagram post, tagged the account of a venue that has connected its own Instagram to JukeDJ, or tagged our account @jukedj_official and wrote the code the venue shows on its screens that night into the caption. Authors have no account with us and need not use the service otherwise; we obtain their data from Instagram (details in section 3.3).
- Google Maps review authors are people who publicly rated, on Google Maps, a venue that has turned on Google reviews on its screens. Authors have no account with us and need not use the service otherwise; we obtain their data from Google (details in section 3.4).
The DJ decides how their event runs. The DJ of an event sees the requests, messages and ratings sent to it and can act on them only within the features of the service. A DJ or venue that uses guests' data outside the service becomes an independent controller to that extent and is solely responsible for it.
3. What we process, why, and on what legal basis
3.1 Guests
| Data | Purpose | Legal basis |
|---|---|---|
Random browser identifier (stored in your browser in localStorage and IndexedDB and as the first-party cookie jd for 7 days; on our side only its one-way hashed fingerprint, without your IP address and without browser details) and the number of your free requests tonight | So that the limit of free requests per guest and night set by the venue also applies after rejoining from the same browser, and the queue stays fair to all guests | Legitimate interest of the venue and other guests in a fair queue and in preventing abuse (Art. 6(1)(f) GDPR). You may object (see section 8 of this policy); clearing the site's data in your browser is enough. |
| Nickname, event code, device identifier (in the app, the identifier assigned by iOS or Android; on the web, a randomly generated identifier) | Joining an event, telling your requests apart from other guests', preventing abuse | Performance of a contract (Art. 6(1)(b) GDPR) |
| Requests (track, artist, artwork), optional message to the DJ, ratings, time sent and request status | Passing requests and messages to the DJ, showing the queue, telling you a song was played, showing the message with your nickname as a Dedication on the venue screen and, for a Big dedication, a big card with your nickname, the track and the message (a neutral greeting with your nickname instead of a hidden message); the confirmation that a screen showed the big card (the price difference is refunded according to it) | Performance of a contract |
| TV message and strip message: the chosen template and look, the names or nicknames the guest fills in (for example who the message is for and from), any age or other template detail and the guest's own text; the product bought, the planned time and number of showings, the approval status and, for free strip messages, the number used per night | Showing the message on the venue's screens, approval by the DJ or staff, the screen's confirmation of each showing, refunds for a message not approved or showings that did not take place, the guest's “My TV messages” overview and the per-guest limits | Performance of a contract. For the names of other people the guest puts in the message: the legitimate interest of the guest and the venue in letting the guest greet or congratulate someone (Art. 6(1)(f) GDPR). Use only a first name or nickname and never contact details; the person named can ask the venue's staff or us at any time to take the message off the screens. |
| Message text of a request (Dedication, Big dedication) and the own text of a TV message or strip message (without the template's names, your nickname or other data about you) | Checking for inappropriate content before the message is shown on the venue screen (moderation): automatic filters and, for venues with JukeDJ Plus, an automated assessment using artificial intelligence | Legitimate interest in protecting guests, the venue and the DJ from inappropriate content (Art. 6(1)(f) GDPR) |
| Payment data: amount, currency, Stripe payment ID, payment and refund status. Card details are processed by Stripe only; we never see them. | Paid requests including Dedications and Big dedications, TV messages and strip messages, tips, automatic refunds (full and partial), accounting | Performance of a contract; legal obligation (Art. 6(1)(c) GDPR) for accounting records |
| Push notification identifier | Telling you the DJ played your request. You can turn notifications off in your phone settings at any time. | Performance of a contract |
| IP address, only temporarily or as a one-way hash | Protection against code guessing and overload | Legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR) |
3.2 DJs
| Data | Purpose | Legal basis |
|---|---|---|
| Email, password (stored in encrypted form by Google Firebase; we never know it), name, registration and last sign-in date | Account, sign-in, email verification, password reset | Performance of a contract |
| Optional profile details: phone, Instagram, Facebook and website links, profile photo, event images, VirtualDJ address | DJ and event profile shown to guests | Performance of a contract |
| Events: name, description, date, code, payment settings | Running events | Performance of a contract |
| Subscription and payout data: Stripe customer and account IDs, subscription status, phone number entered in Stripe checkout | Subscription, free trial, payouts of guest payments | Performance of a contract; legal obligation |
| Spotify, TIDAL and Apple Music connections (access tokens are stored encrypted) and paired music box details | Sending requests to the player and controlling playback | Performance of a contract |
| Song filter rules the DJ wrote in their own words, and the text of announcements for screens in the venue | Turning the rules into a song filter and announcements into speech (JukeDJ Plus features, see section 4) | Performance of a contract |
3.3 Social wall (Instagram posts)
The social wall shows guests' Instagram photos on the venue's screens. A post enters the wall in one of two ways: a) if the venue has connected its own Instagram account, the author tags the venue's account on the photo and no code is needed; b) if the venue has not connected its own account, the author tags our account @jukedj_official on the photo and writes the night's code from the venue's screens into the caption. We do not read mentions in captions or Stories, only tags on the photo. The post appears on the screens only after the venue (its DJ or staff) approves it by hand.
Where the data comes from: public Instagram posts in which the connected account is tagged. We retrieve them through the Instagram Graph API of Meta Platforms Ireland Ltd., only with the permission granted to us by the owner of the connected account.
| Data | Purpose | Legal basis |
|---|---|---|
| Post author: Instagram username, the photo of the post (for a video only its still preview, for an album the first photo), caption, time posted, post ID and link | Checking whether the post belongs to the venue's social wall (for the @jukedj_official account the night's code in the caption, at most 3 posts per author per night), manual approval by the venue and display on the venue's screens that night: photo, username, time and a shortened caption. A caption with contact details or profanity is not shown on the screen. | Legitimate interest of the venue and of us in letting guests share photos of the night on the venue's screens, as they themselves wish (Art. 6(1)(f) GDPR). The author expresses this wish by tagging the venue's account on the photo, or by tagging @jukedj_official and writing the night's code into the caption. |
| Username of an author the venue has blocked | So that the blocked author's posts are no longer shown at that venue | Legitimate interest of the venue in protection from inappropriate content (Art. 6(1)(f) GDPR) |
| IDs of posts already processed (no other data) | So that the same post is not processed twice | Legitimate interest in the service working correctly (Art. 6(1)(f) GDPR) |
| Connected account: Meta access tokens (stored encrypted and only on our server), Instagram account ID and username, Facebook Page name and ID, the app-scoped ID Meta assigned to the person who connected the account, time of connection and the JukeDJ account used to connect it | Retrieving posts in which the connected account is tagged, connection status, disconnection and handling data deletion requests from Facebook | Performance of a contract with the venue (Art. 6(1)(b) GDPR) |
We do not sell Instagram data, rent it out or otherwise provide it for payment, and we do not use it for advertising or ad targeting, for profiling, for tracking people or for training artificial intelligence, and we do not combine it with other data about guests. We use it only so that the post can be shown on the screens of the venue that was tagged. We send no social wall data to any artificial intelligence provider. A person (the venue), not an automated system, always decides whether a post is shown; automatic filters only hide a caption with contact details or profanity.
A venue that shows Instagram posts on its screens decides which posts to approve and is responsible for being entitled to show them (see the Terms of Use, section 10).
3.4 Google reviews
A venue can show its rating and selected public reviews from Google Maps on its screens. In the screens portal or the JukeDJ app, the venue searches for and picks its place on Google Maps. The JukeDJ server then retrieves from Google the place's name, average rating, number of ratings and at most 5 reviews that Google selects as the most relevant. A screen may show only reviews with a certain number of stars and always states how the reviews are ordered and selected. Reviews are shown labelled “Google Maps” and with a link (QR code) to the review on Google Maps.
Where the data comes from: public reviews that their authors themselves published on Google Maps. We retrieve them through the Google Places API of Google Ireland Ltd. / Google LLC, which is the source of the reviews.
| Data | Purpose | Legal basis |
|---|---|---|
| Review author: name and profile photo as published by Google, link to their profile, review text (at most 280 characters, possibly as translated by Google), star rating, publication time and relative time (e.g. “a week ago”) and link to the review on Google Maps | Showing the review on the screens of the venue it is about, with the author's attribution and a link to the review, as Google requires. Reviews without text, with contact details or profanity in the text, or with an inappropriate author name are not shown at all; we do not alter the content of reviews. | Legitimate interest of the venue and of us in letting the venue show its guests how others publicly rate it on Google Maps (Art. 6(1)(f) GDPR). The author published the review of this venue publicly themselves. |
| The ID of the Google Maps place the venue picked (no other data) | Knowing whose reviews the venue's screens should show | Performance of a contract with the venue (Art. 6(1)(b) GDPR) |
We do not store reviews or any other Google Maps content. The only thing we write to disk is the ID of the place the venue picked. The place's name, rating and reviews are held only in the server's memory, retrieved again at most once every 6 hours and only while a screen of the venue is on, and discarded at the latest after 12 hours without a refresh. We do not use reviews for profiling, tracking people, advertising or training artificial intelligence, we send them to no artificial intelligence provider, we do not read them aloud, and we do not combine them with other data. Automatic filters only leave out a review with contact details, profanity or an inappropriate author name.
The venue is responsible for picking a place that is its own venue (see the Terms of Use, section 2 point 4). The Google Privacy Policy also applies to Google Maps content.
We do not use your data for profiling or advertising. The only automated decision is whether a message is shown on the venue screen (the message check above). For a request with a Dedication or Big dedication the request remains valid, and the DJ can also review the message. A paid TV message or strip message that the check rejects is not shown and we refund the full amount. The own text of a free strip message is decided by the automated check alone. If you disagree with the result, write to us. The service uses no analytics or advertising tools and does not collect your location.
4. Who receives data
We share data only with processors and partners the service needs:
- Google Ireland Ltd. / Google LLC (Firebase, Google Cloud): database, sign-in, image storage, server functions (EU region, Belgium), bot protection (App Check, reCAPTCHA).
- Stripe Payments Europe Ltd. / Stripe, Inc.: card, Apple Pay and Google Pay payments, DJ subscriptions, DJ payouts. The Stripe Privacy Policy also applies to payments.
- OneSignal, Inc. (USA): push notification delivery.
- Contabo GmbH (Germany, data centre in Frankfurt am Main): the server running the service API, which also stores the social wall data (posts, images and encrypted tokens) and in whose memory we temporarily hold Google reviews and the content of TV and strip messages.
- WEDOS Internet, a.s. (Czech Republic): website hosting and sending email from noreply@jukedj.com.
- Artificial intelligence providers for JukeDJ Plus features. We send them data about tracks and texts written by the DJ or the venue. Of guests' data, we send only the message text (of a Dedication or Big dedication) and the own text of a TV message or strip message for checking (moderation), only to OpenAI and only for venues with JukeDJ Plus. We do not send them the names filled into a message template, the nickname, device identifier or payments, or anything about who requested a track. We send them no social wall data (Instagram posts) and no Google reviews at all.
- OpenAI Ireland Ltd. / OpenAI, L.L.C. (USA): the song filter (a description of a track based on its title, artist and music catalogue data, i.e. album, release date, genres and explicit content rating; turning the rules the DJ wrote in their own words into a filter) and “Did you know…” (short facts about the track that is playing, written by the model from public Wikipedia, Wikidata and MusicBrainz data about the track and the artist) and checking guests' messages before they are shown on the venue screen (moderation, message text only; for a TV message or strip message only the own text, without the template's names).
- Anthropic, PBC (USA): fallback provider for the song filter and “Did you know…” with the same data, when OpenAI's services cannot be used. We do not send it guests' messages.
- Google Ireland Ltd. / Google LLC (Gemini, Google Cloud Text-to-Speech): turning announcement text written by the venue into speech for the screens and the music box in the venue.
- Music services, depending on what the DJ uses: Apple (Apple Music, catalogue search), Spotify, TIDAL and Atomix Productions (VirtualDJ). The guest's nickname and message are sent to VirtualDJ together with the request.
- Meta Platforms Ireland Ltd. (Ireland): operator of Instagram and Facebook and the source of social wall data. We retrieve posts in which the connected account is tagged through its Instagram Graph API. We give Meta only what the API requires (access tokens and requests for posts). Meta's privacy policy also applies to Instagram and Facebook.
- Google Ireland Ltd. / Google LLC (Google Maps Platform, Places API): the source of Google reviews. We retrieve the place's details and its public reviews from Google (section 3.4). We send Google only the place ID and the text the venue uses to search for its place, no guest data. The Google Privacy Policy also applies to Google Maps content.
- The DJ of the event sees the nickname, requests, messages, ratings and payment amounts for their event, and the venue's TV and strip messages so that they can approve, reject or take them off the screens.
- The venue and its guests: the venue sees social wall posts awaiting approval (username, photo, full caption, time, link to the post). Approved posts can be seen by anyone at the venue in front of a screen. Google reviews shown on the screens can be seen by the venue and by anyone at the venue in front of a screen. Approved dedications, big cards of Big dedications and TV and strip messages (with the nickname and names the guest filled in, never with the price) can be seen by anyone at the venue in front of a screen.
- Public authorities where the law requires it.
5. Transfers outside the EU
Some partners (Google, Stripe, OneSignal, Apple, Spotify, TIDAL, OpenAI, Anthropic, Meta) may also process data in the United States. Such transfers rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) or on Standard Contractual Clauses approved by the European Commission. For the artificial intelligence providers OpenAI and Anthropic, transfers rely on Standard Contractual Clauses included in our data processing agreements with them. When retrieving Google reviews we send Google only the place ID and the venue's search text, no personal data of guests.
6. How long we keep data
- DJ accounts for as long as they exist. When an account is deleted we remove the profile, events and all data belonging to them, including guests' requests, messages and ratings, images and music service connections.
- The browser identifier fingerprint (section 3.1) is deleted automatically 48 hours after its last use; the
jdcookie in your browser expires 7 days after your last join. - Guest data for an event (nickname, requests, messages, ratings) until the DJ deletes the event or their account, or until you ask us to erase it.
- DJ messages to guests stop being shown after 6 hours. Single-use gift codes and unfinished payments expire within 30 minutes.
- TV message and strip message:
- the content of the message (names, any age and own text) is kept only until the message is settled, i.e. until its last showing bought, its rejection, its removal from the screens or the end of the event, at the latest about 12 hours after payment, and then deleted. The content of an unpaid message is deleted once the payment expires (within about an hour);
- in the server's memory, from which you see it in the “My TV messages” overview, the content stays for at most 12 hours after the message ended, and nothing of it is kept after a server restart;
- a free strip message is deleted as soon as it ends; only the number of free messages used remains with your guest identity for that night;
- the payment record of a message without its content (amount, product, template, number of showings, amount refunded) is kept as a payment and accounting record (below). You can see the payment status in the app for 90 days from its start.
- Payment and accounting records for 10 years from the end of the year of the payment, as accounting and VAT law requires. These records remain after an account is deleted.
- Security records (hashed IP addresses and attempt counts) are deleted once no longer needed and at the latest within 30 days.
- Social wall:
- post data (username, caption, time, link) until the end of the venue's night, i.e. until the event is ended, started again (“New night”) or the venue's next operating day begins. Posts not approved lapse at that point. When the account through which the post was retrieved is disconnected, or the JukeDJ app is removed in the Facebook settings, we delete it immediately;
- images (a reduced copy of the photo or video preview) are deleted as soon as the post is hidden, its author blocked or the account through which the post was retrieved disconnected, otherwise at the end of the night and at the latest within 24 hours of download;
- the venue's list of blocked authors until the venue unblocks the author, the venue's account is deleted or the owner of the venue's own account requests deletion of the data when removing the app on Facebook;
- IDs of processed posts (no other data) are continuously replaced by newer ones; we keep at most 5,000;
- access tokens and connected account details until the account is disconnected, the JukeDJ app is removed in the Facebook settings or the venue's account is deleted.
- Google reviews: place details and reviews (including authors' names and photos) only in the server's memory, for at most 12 hours from the last retrieval, never on disk; nothing of them is kept after a server restart. Place search results in the portal are held in memory for 10 minutes. The ID of the picked place is kept until the venue changes or removes it, or until the venue's account is deleted.
7. Data stored on your device
The apps and websites store on your device only what they need to work, such as your nickname, chosen language, a payment in progress or a random browser identifier (localStorage, IndexedDB and the technical first-party cookie jd). See Cookies and local storage for details.
8. Your rights
You have the right:
- of access to your data (Art. 15 GDPR),
- to rectification of inaccurate data (Art. 16),
- to erasure (Art. 17),
- to restriction of processing (Art. 18),
- to data portability (Art. 20),
- to object to processing based on legitimate interest (Art. 21),
- to lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, or with the supervisory authority in your EU country.
To exercise your rights, email support@jukedj.com. Guests have no account, so please include your nickname, the event code or name and the approximate date so we can find your data. We reply within one month. Deleting a DJ account is described on Deleting your account and data.
Authors of social wall posts can at any time ask for a post to be taken off the screens and for their data to be erased, or object to the processing. Email support@jukedj.com with your Instagram username and the link to the post, or the venue's name and the date. During the night you can also ask the venue's staff, who can hide the post with one tap. We take the post off the screens without undue delay and erase its data. Deleting the post on Instagram or removing the tag may not take effect on the screens immediately, so please also write to us in that case. The owner of a connected account can disconnect it at any time; we then immediately delete the access tokens and all posts retrieved through that account with their images and, where possible, revoke the app's permissions at Meta. The owner can also remove the app in the Facebook settings and request deletion of the data; they receive a confirmation code and the status of the request is shown at api.jukedj.com/v2/social/meta/deletion-status?code=… (details on Deleting your account and data).
People named in a TV message or strip message can ask for the message to be taken off the screens, during the night also from the venue's staff, who remove it with one tap, or at support@jukedj.com (give the venue's name, the date and the name in the message). We do not keep the content of a message after it is settled (section 6).
Authors of Google reviews can ask for their review to be taken off a venue's screens or object to the processing. Email support@jukedj.com with the venue's name and the name under which you published the review on Google Maps. We take the review off that venue's screens without undue delay, or turn Google reviews off for the venue. The review itself is managed by Google: you can edit or delete it in your Google account and report an inappropriate review directly on Google Maps. Editing or deleting a review on Google Maps takes effect on the screens within 12 hours at the latest.
9. Security
All communication with the service is encrypted (HTTPS). Music service and Meta access tokens are stored encrypted; Meta tokens stay on our server only and never reach devices at the venue. Guest and music box tokens are stored only as a one-way hash. Social wall images are available to screens only through signed, time-limited links. Access to data is limited by database rules and device attestation.
10. Age
The service is intended for people aged 16 and over. If you are younger, use it only with the consent of a parent or legal guardian.
11. Changes
We may update this policy, for example when we add a feature. The current version is always on this page. We tell DJs about material changes by email or in the app.