Privacy Policy
This policy explains what personal data Haul.FM processes when you use this website, why, how long it is kept and what your rights are.
Who is responsible
The controller for this website is:
HaulMP [legal form]
[postal address]
contact@haul.fm
What we process
Visiting the site. To deliver the pages, the server processes your IP address, the time, the requested address and what your browser sends, for example its type. The web server of the site keeps no access log.
Send a request. When you use the form, we store the kind of request, the name you enter and your message. We do not ask for an email address and do not store your IP address with the request.
To stop abuse of the form, the server keeps a scrambled form of your IP address in memory for up to 24 hours to count how often the form is sent. It is never written to disk and is gone when the server restarts.
While the site is protected by a password, failed sign-ins are counted per IP address in memory for one minute to stop guessing.
Why and on what basis
We process connection data to show you the site and keep it secure, and request data to read your request and, where we can, play it or read it out. The legal basis is our legitimate interest in running a radio station and its website (Article 6(1)(f) UK GDPR and EU GDPR).
Requests are read by the team only. A name you enter may be read out on air together with your message.
How long we keep it
Requests are deleted automatically after 30 days.
The scrambled IP address of the request form stays in memory for at most 24 hours.
Advertiser account
Companies can book airtime and website space in the advertiser account. You sign in with Discord. We receive your Discord ID, your user name and your display name, and Discord gives us a key that lets us read your roles on the HaulMP Discord server. We read those roles when you sign in, book or renew, only to work out the supporter discount. The key is stored encrypted and used for nothing else.
For each company you add we store its name, logo, website, contact email and billing details (name, address, country, VAT number). For each booking we store what you booked, the price, the files you upload, the review result and, once it is approved, the invoice and the proof of play of your spots.
A company can have a team. Its members see the company's bookings, material, proof of play and invoices, and the names and roles of the other members. An invitation link is stored only in a scrambled form; we note who made it and who accepted it.
The legal basis is the contract you enter into with us or the steps before it (Article 6(1)(b) UK GDPR and EU GDPR), and for invoices our legal obligation to keep accounting records (Article 6(1)(c)). Rate limits and a log of sign-ins and changes protect the account; they rest on our legitimate interest in keeping it secure (Article 6(1)(f)).
Bookings, uploaded files and company details are kept while your account is in use. Under Account settings you can download your data as a file and delete your account once no booking of a company you own runs: your name, Discord ID, sign-in and team memberships are then deleted, and a company only you use is deleted with it. Invoices and the data on them are kept for the period tax law requires (10 years), then deleted.
Listening
When you press Listen live, your browser connects to our stream server at stream.haul.fm. To deliver the audio it processes your IP address and what your browser sends for as long as you listen. To see how many people tune in, we count listening sessions with their time, the kind of player, the country where known and a scrambled value that changes every day, never your IP address. Nothing is played until you press the button.
No tracking
The site uses no analytics or tracking. Fonts and images come from this server. Cookies are set only for the advertiser account (below).
When you sign in to the advertiser account, the site sets a sign-in cookie (__Host-hfm_session, up to 30 days) and, during the sign-in, a short-lived cookie that ties the Discord answer to your browser (__Host-hfm_oauth, 10 minutes). If you open an invitation link before signing in, the link is kept in a cookie for up to an hour (__Host-hfm_invite) so you return to it after signing in. If you pick a currency, it is kept in the cookie hfm_currency for a year. These cookies are needed for the account to work; they contain no tracking.
The player remembers your volume and whether you muted it in your browser's local storage. This stays on your device and is never sent to us.
If you close the hint about adding Haul.FM to your home screen, your browser's local storage remembers that, so it does not come back. This stays on your device and is never sent to us.
So that Haul.FM opens quickly and can show a notice while you are offline, your browser keeps a copy of the site's styles, script, fonts and pictures on your device (a service worker and its cache). Pages, what is playing, the advertiser account and the stream are never kept there. Nothing of it is sent to us.
While a page is open, it asks this server every few seconds what is playing (now.json). This request carries no personal data beyond the connection data above.
Links to other sites
Links to Discord, Twitch, social networks, partners or HaulMP lead to other services. Their own privacy policies apply there.
Your rights
You have the right to ask for access to your data, to have it corrected or deleted, to restrict or object to its processing and to data portability. To use these rights, contact us. You also have the right to complain to a supervisory authority: [supervisory authority, for example the Information Commissioner's Office (ICO) in the UK, or the data protection authority where you live].
Contact
For questions about this policy or your data, write to contact@haul.fm.