Last updated: 2 November 2026
Mitxoda is an independent music discovery project. This page explains, plainly, what happens to the information you give us — especially if you are an artist who submits a track.
Who is responsible
Advice That SRL, Rue Delwart 149, 1070 Anderlecht, Belgium (BE0728534930) — operating mitxoda.be and board.mitxoda.be. For any question about your data, write to mitxoda@gmail.com.
What we collect, and why
When you submit a track
The submission form collects: artist name, email address, phone number (optional), label, label website and VAT number (optional), country, genre, track and album title, release date, a link to the track, a social link, ISRC if you provide one, a short description, and the audio file itself, with its quality report. We use this to listen to your music, decide whether to feature it, and get back to you.
To help catch typos, we check that the domain of your email address (the part after the @) exists. We send nothing for this.
If you name a label manager, the form also collects their name, email address and phone number. They receive their own confirmation, which tells them about this policy.
If your track isn’t released yet, you can submit it without the file. It is marked “audio to come” and can’t be scheduled on a show while the file is missing.
Your file, as soon as you upload it
Your file is stored on our server as soon as you upload it, so we can check its quality. If you don’t finish your submission, it is deleted within about a month. Uploads abandoned before October 2026 are the exception: they remain in a private backup on our server, and we remove yours if you ask. The file is kept as you sent it, including its tags: anything you put in them travels with the file.
Your link, and the platforms we ask
When you paste a link from Spotify, SoundCloud, YouTube, Bandcamp, Deezer or Apple Music, our server asks that platform for the track’s details so you don’t have to type them. It sends the link and nothing about you: no name, no email, no IP address of yours. A Tidal link is only read for its track number; nothing is sent to Tidal.
Cover art shown on our pages can load directly from Spotify’s and SoundCloud’s image servers. When it does, your browser connects to them, and they see your IP address.
Technical logs
To protect the form against abuse and fix errors, our logs record your IP address and browser details when you use the form, and a hash of your browser’s characteristics for blocked attempts. They are deleted after about 90 days, or up to a month later because the cleanup runs monthly. To limit the number of attempts, we also keep a hash of your IP address for up to an hour. Our host keeps ordinary access logs for a short time.
Consents and permissions, kept separate on purpose
The form asks separate questions. Nothing is preselected, and a “no” to any optional question doesn’t affect your submission:
- Newsletter — permission to write to you. You can unsubscribe from any email.
- Mitxoda Board — permission to feature that track in our indie music board game. This is a rights decision, not a communication preference, which is why it is asked separately. We record the exact date and time you gave it.
- Le Salon Indie de Mitxoda — required for a submission. You confirm that you can give this permission, or act for those who can, and you agree that Mitxoda may listen to the track and, if it’s selected, play it on the show, free of charge. The show goes out live on OTAT247, is replayed by partner radios and stays online, including on Mixcloud. You can say no for future episodes at any time. A recorded episode can’t be re-edited, but you can ask for it to be taken down and we pass your request on.
- OTAT247 rotation — a separate yes or no. If you say yes, OTAT247 may keep the track and play it in its own rotation, free of charge, non-exclusively and worldwide, until you ask for it to stop. That applies to the future only. If you say no, OTAT247 is told the track is for Le Salon Indie only.
- Live DJ sets — yes or no. Mitxoda may play your track live in DJ sets on partner radios. Sets are recorded and may stay available to replay online. The radio may need a copy of the file, only so Mitxoda can play it in those sets.
- Partner radios — yes or no. Mitxoda may send your track to the radios named on the form, which store it and play it in their own programming. A yes covers only those radios. If a new radio joins the list, it doesn’t get your track without a new yes from you.
- Indie Top 100 — a small optional extra, yes or no. If Mitxoda selects your track, it may appear on the Indie Top 100 pages, with its title, artist name and artwork, and people can vote for it. If you say no later, it is hidden from the site automatically, with its votes and history kept. A later yes doesn’t publish it again by itself. Tracks received before November 2026 can appear there unless you say no.
You can withdraw the game consent at any time, using the link in your submission confirmation email. That link never changes anything by itself — it shows you your current setting and asks you to confirm. Withdrawing removes the track from the game; we keep the record that a consent was once given, and when, because a withdrawal has to be provable too.
When you write to us
The contact form sends us your name, email and message by email, delivered by Brevo to our mailbox at Google. Nothing is stored on the site — there is no database of contact messages. Your address is used only to reply.
When you play Mitxoda Board
The game keeps a player profile (your chosen name and avatar) so you can be recognised between games. Giving an email address is optional — it is used to send you the end-of-game zine and nothing else. Room access uses private session tokens, never the visible room code.
Who else sees your data
We use a small number of external services. Each one is listed here because it genuinely receives something.
- o2switch (France) — hosting. The site, its database and the audio files live on their servers.
- Dropbox (Ireland, with processing in the United States) — a copy of each submitted audio file is stored there as our working archive, named after the artist, the title and the date.
- Brevo (France) — delivers all our email, both confirmations and newsletters. Messages are sent from daily@news.mitxoda.be.
- Google (Gmail) (Ireland, with processing in the United States) — our mailbox, mitxoda@gmail.com. It holds your replies and contact messages, a hidden copy of the emails telling you your track was declined or approved, the alerts about new submissions, and reports that list artists’ email addresses and phone numbers.
- beehiiv (United States) — hosts the Mitxoda Weekly newsletter and its subscriber list. We link to it from our site, at weekly.mitxoda.be.
- Umami — page-visit statistics without cookies, on our own instance at analytics.governance.brussels, hosted by Hetzner in Germany. It is our only audience measurement. The address of the page is sent without its parameters, so personal links stay out of it.
- WonderPush (France) — powers the browser notification prompt. It loads only if you accept it in the cookie banner, and it sends you notifications only if you also accept them in your browser.
- Anthropic (Ireland, with processing in the United States) — our curator can ask an AI assistant to draft a few lines about a track. It receives the track’s title, artist name, genre, country, description and link. The audio file and your contact details are never sent.
Where one of these services processes data in the United States, it relies on its own safeguards, such as the EU-US Data Privacy Framework or standard contractual clauses. We do not sell your data, and we do not share your email address with third parties for their own use.
Radios and where your music goes
- OTAT247 (United States) — broadcasts the show. It is outside the European Economic Area, and sending it the files is needed to broadcast the show you submit your track to. It receives the audio and track details, not your email address. This transfer isn’t covered by an EU adequacy decision or by safeguards such as standard contractual clauses, and we have no contract with OTAT247 on this, so your data may have less protection there. Whatever you answered about rotation, once OTAT247 has a file we can’t see what it does with it, or check that it has deleted it. If you withdraw, we stop using your track and pass your request on, but we can’t guarantee the result.
- Mixcloud (Mixcloud Limited, United Kingdom), through OTAT247’s account — hosts the recorded episodes for replay online. To ask for an episode to be taken down, write to us: we pass the request to OTAT247, which runs the account, and we can’t promise a delay.
- My Indie Radio (France), Magic Music Rádió (Hungary) — replay the show. They receive the episode, not your track as a separate file.
Each radio is responsible for what it does with the files it receives, keeps them according to its own rules, and remains responsible for its own licences. What you confirm on the form doesn’t replace those licences, and Mitxoda doesn’t check who owns a track.
For now, no radio receives tracks under the “partner radios” permission.
Apart from OTAT247, which receives tracks for the show, files are sent to a radio by hand, by Mitxoda, only for tracks with the matching permission. We do not send your email address to radios.
AI declaration
For each track, the form asks whether AI was used to make it: not at all, a little (with an optional note on which part), or a lot or entirely. We keep your answer with the track. It only helps Mitxoda place the track in the right shows: it never blocks a submission and nothing happens automatically because of it. Everyday studio tools, such as noise reduction or automatic mastering, don’t count. The answer is entered by you and is not checked.
Proof of your permissions
Every time a permission is given, changed or withdrawn, we record which track, which permission, the answer before and after, where it was given (form or preferences page), the version of the text you saw, and the date and time. For partner radios, we also record the radios your yes covers. In that record your email address is pseudonymised: it is replaced by a keyed hash, never kept in clear. This is still personal data, because we hold the key and can match the hash to an address we already know. A withdrawal is added to the record; it does not erase what came before, because a withdrawal has to be provable too. Withdrawing applies to the future: it does not remove an episode that has already been recorded.
Permissions are based on your consent, except the show permission, which is part of the submission you ask us to handle. For tracks received before 31 October 2026, the show permission rests on our legitimate interest, and you can object at any time on your preferences page. Keeping the proof rests on our legitimate interest in being able to show what we were allowed to do.
Cookies
See our Cookie Policy. Our audience statistics run without cookies. The consent banner remembers your choice for six months, and honours your browser’s “Do Not Track” setting if you have it on.
How long we keep things
- Unfinished uploads — deleted within about a month, except those abandoned before October 2026, described above.
- Audio files of tracks we don’t select, on the website and in the Dropbox archive — no automatic deadline. We delete them when you ask.
- Audio files of tracks we select — kept with the submission record, on the website and in the Dropbox archive.
- Submission records (your name, email, track details, consents) — kept for as long as the track is still featured or its consent still stands, with no automatic deadline. You can ask us to delete them at any time.
- Automatic emails in our Gmail mailbox (hidden copies, alerts, reports) — deleted once a year.
- Messages you write to us — they exist only in our mailbox, for as long as the conversation needs them.
- Reports listing submissions, on our server — deleted after about 90 days, or up to a month later because the cleanup runs monthly.
- Technical logs — about 90 days, as explained above.
- Consent timestamps — kept for as long as the submission, including after a withdrawal.
- Permissions and AI declarations — kept with the submission.
- Proof of permissions (pseudonymised) — as long as the submission, then five years if the submission is deleted, so that we can answer a dispute.
- Site backups — weekly copies on Dropbox, the last two kept. Deleted data can remain in them until they expire, about three weeks.
- Database copies made on our server before maintenance — kept in a private folder and cleared once a year.
- Radios that received a file — each radio keeps it according to its own rules.
Your rights
You can ask to see your data, correct it, delete it, take it elsewhere, or object to how we use it. Write to mitxoda@gmail.com and say what you want — you do not need to use any particular wording.
Your preferences page, reached by the link at the bottom of most of our emails, lets you change your email choices, your permissions and AI declaration for each track, and Mitxoda Board consent. The footer link “Unsubscribe from all emails” turns off all email consents; it does not delete anything. To have your data deleted, use the request on the preferences page or write to mitxoda@gmail.com. A deletion request withdraws your permissions for the future at once. We handle it by hand, within one month, and keep only the proof strictly necessary.
If you believe we have handled your data badly, you can complain to your national data protection authority. In Belgium that is the Autorité de protection des données.
Children
Mitxoda is not aimed at children under 16. By submitting a track, you declare that you are at least 16, or that a parent or guardian has agreed. If you believe a child has sent us personal data, write to us and we will remove it.
Changes to this page
If we start using a new service that receives your data, or change how long we keep something, we update this page and change the date at the top.
