Privacy Policy

01Who we are

Phantone.fm is operated by Midtown West LLC, 705 Gold Lake Dr Suite 250, Folsom CA 95630 ("Phantone", "we", "us"). For enterprise customers, Phantone acts as a processor under a Data Processing Agreement (see /dpa). For visitors to phantone.fm, Phantone acts as controller of the limited personal data described below.

02Microphone permission and on-device detection

• Detection requires the end user to grant microphone permission inside the participating app. Permission is requested by that app, is always user-granted, and can be revoked at any time in device settings — after which detection stops.
• Audio is analyzed on the device. Raw audio is not transmitted to Phantone and is not stored by Phantone. The decoder reports only the decoded campaign signal and the associated event metadata described below.
• Detection is only attempted in a supported listening state as determined by the participating app and the device operating system. It is not continuous background listening.

03Personal data we collect

• Account identifiers submitted by customers or contacts (name, work email, company).
• Device and session information reported by the Phantone SDK: a hashed device or installation identifier, IP address, user agent, and the campaign / session identifier associated with a detected signal.
• Location: location derived from IP address is coarse by default. Precise (GPS-level) location is collected only where the end user has separately opted in through the participating app.
• Context signals are allowlisted — the SDK reports only the fields defined for a campaign, not arbitrary device or app content.
• Attribution event records generated by the on-device decoder (campaign ID, timestamp, session identifier, and location as described above).
• Ephemeral presence records used to resolve a moment in a venue or session. These are short-lived and expire automatically after a short time-to-live.
• Support correspondence, including any content you send to us by email.
• Standard website analytics (page views, referrer) on phantone.fm.

04What a credential or impression record contains

A signed impression record contains the campaign identifier, a timestamp, a hashed session or device reference, and verification data used to check the record against a transparency log. It does not contain audio, contact details, or a direct identifier of the listener. Customers can verify that a counted impression is authentic without receiving additional personal data about the individual.

05What we do not collect

Phantone does not record, store, or transmit raw audio. The decoder reads a signal on-device and reports only the decoded payload plus the device/session information described above. Phantone does not build cross-site advertising profiles and does not sell personal data.

06Legal bases for processing (GDPR / UK GDPR)

• Performance of a contract (Art. 6(1)(b)) for account creation, service delivery, and support.
• Legitimate interests (Art. 6(1)(f)) for security, fraud prevention, service improvement, and responding to inbound inquiries.
• Consent (Art. 6(1)(a)) where required — for example, non-essential cookies and marketing communications.
• Legal obligation (Art. 6(1)(c)) for tax, accounting, and lawful requests.

07Retention

• Customer account data is retained for the life of the account. Attribution event records follow the retention terms in the customer's agreement. Website contact form submissions are retained for up to 24 months.
• Ephemeral presence records expire automatically after a short time-to-live and are not retained for analytics.
• Audit and impression records are append-only. Where a deletion request would conflict with an append-only integrity record, we delete or de-identify the personal data associated with it and retain only the non-identifying verification entry, where permitted by applicable law. We will tell you when this exception applies to your request.
• On termination, customer content is deleted within the window set in the customer agreement unless applicable law requires further storage.

08Your rights

• Access, rectification, erasure, restriction, portability, and objection under the GDPR / UK GDPR.
• Right to know, right to delete, right to correct, right to opt out of sale or sharing, and right to limit use of sensitive personal information under CCPA / CPRA.
• You can exercise these rights by writing to compliance@phantone.fm. We will respond within 30 days (GDPR) or 45 days (CCPA), extendable as permitted by law.
• You may lodge a complaint with your local supervisory authority.

09Do Not Sell or Share (CCPA / CPRA)

Phantone does not sell personal information and does not share personal information for cross-context behavioral advertising as those terms are defined under the CCPA / CPRA. To submit a verifiable consumer request, contact compliance@phantone.fm.

10Children

The Phantone service is not directed to children under 16 (or the applicable minimum age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe we have, contact compliance@phantone.fm and we will delete it.

11International transfers

Personal data may be transferred to the United States. For transfers from the EEA, UK, or Switzerland we rely on the EU Standard Contractual Clauses (Module 2) and, where applicable, the UK IDTA Addendum, as incorporated into our DPA.

12Cookies and analytics

phantone.fm uses strictly necessary cookies for site operation and, where you consent, limited analytics cookies. We do not use third-party advertising cookies. You can manage cookies through your browser settings.

13Sub-processors

A current list of sub-processors used to deliver the Phantone service is available at /trust and in Annex III of our DPA. Enterprise customers receive at least 30 days' prior notice of a new sub-processor that processes their personal data.

14Changes to this policy

We may update this Privacy Policy. Material changes will be posted here with a revised effective date; where required by law we will notify affected customers or contacts by email.

15Contact

Privacy and data protection: compliance@phantone.fm. Postal: Midtown West LLC, 705 Gold Lake Dr Suite 250, Folsom CA 95630.