Privacy Policy
Last updated: 25.10.2026
This policy describes how personal data may be collected and used when you visit XAURAL, create an account, stream music or upload content.
Controller and contact
The operator of xaural.com is the controller for personal data it determines how and why to process. The operator’s full legal name, business address and any appointed data-protection contact must be confirmed and published by the site owner. Requests can be sent using the contact email below.
Data we process
Depending on the feature used, we process email, account name, password hash, profile image and banner, uploaded music and lyrics, playlists, likes, follows, playback activity, account and moderation records, device or browser information, IP addresses and essential security logs. We do not need your plaintext password.
Purposes and legal bases
We process account credentials and music activity to provide the service and perform our agreement with users; security logs and abuse prevention where justified by legitimate interests; legally required records under legal obligations; and optional functions requiring consent where applicable. Consent, when used, may be withdrawn without affecting earlier lawful processing.
Visibility and sharing
Published songs, stage names, public profile information and content interactions intended to be public can be seen by visitors. Private data such as login credentials is not intentionally displayed publicly. Other users may copy or share content you make public; choose carefully what you upload.
Service providers and transfers
The site uses WordPress and may use Cloudflare R2 for audio storage, social sign-in providers such as Google or Meta, and YouTube, Spotify or Apple Music embeds when enabled. Such providers may receive technical data necessary for the feature. Transfers outside the European Economic Area, if any, must rely on a valid legal transfer mechanism and should be documented by the operator.
Cookies and similar technologies
Essential cookies may support logins, security, language preferences and session continuity. Third-party embedded players and social login may use their own cookies or identifiers. Non-essential cookies or tracking must be subject to any consent controls required by law. Review the active cookie tools and providers on this site.
Retention
Account data is generally retained while an account remains active; published content until removed or lawfully retained; security and playback logs for periods reasonably necessary to prevent abuse and measure activity. Exact retention schedules, backup lifetimes and hosting arrangements must be verified by the operator and disclosed before publication.
Your rights
Subject to applicable conditions, you may request access, correction, deletion, restriction, portability, objection or withdrawal of consent. You may also complain to a competent supervisory authority. For users in Greece, the Hellenic Data Protection Authority is the national supervisory authority.
Security and incidents
Reasonable technical and organizational safeguards should protect stored information, but no internet service is completely secure. Report suspected account compromise promptly. If a personal-data breach meets statutory notification thresholds, the operator must make the required authority and user notifications.
Children and automated recommendations
The service must apply applicable rules for minors and parental consent; users should not provide data if they cannot lawfully consent without required authorization. Music suggestions may use likes, follows and listening signals. The operator should disclose any profiling or automated decisions that produce legally significant effects if introduced.
Updates
This policy may change as services, providers or law change. Important updates will be communicated where legally required. The current text, contact route and effective date should be kept accurate by the site operator.
Contact
Site operator: XAURAL
No absolute waiver of statutory responsibilities is intended.