Privacy Policy

1. Who we are

ChartVault (www.chartvault.fm) is operated by ChartVault (“ChartVault,” “we,” “us”). We are responsible for the personal information described here and are its “controller” or “business” under the laws that use those terms. This policy covers this website only, not other sites it links to.

2. What we collect

Information you give us

If you use the contact form, we receive your name, your email address, the subject and the message you write. Please don’t include sensitive information. To protect the form from abuse, the message we receive also records the IP address and browser type it was sent from and the time it was sent.

Information collected automatically

• Server logs. Like nearly every website, our web server records each request: IP address, date and time, the page asked for, the referring page, the browser and operating system reported, and whether the request succeeded. We use these logs to run, secure and fix the site.
• Abuse protection. To stop the contact form being used for spam, the site briefly counts how many messages come from each IP address. These counts are kept only in the server’s memory and expire within about a day.
• Cookies. A small number of cookies, described in section 4. Optional cookies are set only if you agree.

Browsing the chart archive, the song index and the artist index does not require you to tell us anything about yourself. We do not collect sensitive personal information, precise location, or biometric data, and we do not buy information about you from others.

3. How we use it, and why

We do not use your information for advertising, we do not build profiles of you, and we make no automated decisions that have legal or similarly significant effects on you.

4. Cookies and tracking

Cookies are small text files a website stores in your browser. ChartVault uses the following.

Strictly necessary cookies are needed for the site to work and can’t be switched off here, though you can block them in your browser (the contact form will not work without them). Analytics cookies are off until you turn them on in the cookie banner, and you can change your mind at any time with Cookie Settings, also in the footer of every page. Withdrawing consent stops further collection and deletes the analytics cookies we can reach.

We do not use advertising cookies, social media pixels, fingerprinting, or cross-site tracking. Our fonts and images are served from our own server, so loading a page does not send your information to font or image services.

5. Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We disclose it only:

• to service providers who handle it for us under contract: our email provider, which delivers contact form messages;
• when the law requires it, or to protect the rights, property or safety of ChartVault, our visitors or others;
• to a successor if the site is ever transferred, who would remain bound by this policy for information collected under it.

6. How long we keep it

• Contact messages: as long as needed to deal with your inquiry and any follow-up, and no more than 24 months after our last exchange.
• Server logs: up to 90 days, longer only if needed to investigate a specific security incident.
• Abuse counters: in memory, up to about 25 hours.
• Cookies: as listed in section 4.

7. Where it is stored

ChartVault is run from the United States, and the information described here is stored and processed in the United States. If you visit from outside the US, your information is transferred to the US, whose data protection laws may differ from yours. Where the law requires it, we rely on appropriate safeguards for those transfers, such as the European Commission’s Standard Contractual Clauses or a provider’s certification under the EU-US Data Privacy Framework and its UK and Swiss extensions.

8. Security

The site is served only over encrypted HTTPS. We limit who can reach our systems, keep software up to date, and protect the contact form with layered anti-abuse checks. No method of transmission or storage is perfectly secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires.

9. Your privacy choices

• Cookie settings. Change your choices at any time: open Cookie Settings.
• Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of any sale or sharing of your information and of optional analytics, for that browser, without your having to do anything else.
• Do Not Track. Because nothing optional runs unless you opt in, the site behaves the same way whether or not your browser sends a Do Not Track signal.
• Do not sell or share. We don’t sell or share personal information, so there is nothing to opt out of, but you may still ask us to confirm it.
• Email. We don’t send newsletters or marketing email. We only reply to messages you send us.

10. Your rights

Depending on where you live, you may have the right to:

• know and access the personal information we hold about you, and get a copy in a portable format;
• correct information that is inaccurate;
• delete information about you;
• opt out of the sale or sharing of personal information, targeted advertising, and profiling (we do none of these);
• restrict or object to our use of your information, and withdraw consent where we rely on it;
• appeal a decision we make about your request;
• complain to a data protection authority;
• not be discriminated against for using any of these rights.

How to make a request. Use the contact form and tell us what you’d like. We may ask for information to confirm your identity, usually the email address you wrote to us from, and we will use it only for that. You may use an authorized agent; we may ask the agent for proof of your permission and ask you to confirm your identity. We respond within one month under EU and UK law and within 45 days under US state laws, and will tell you if we need more time, as those laws allow. If we decline your request you may appeal by replying to our decision with “Appeal” in the subject; we will answer within the time your law requires (generally 45 to 60 days) and tell you how to contact your state Attorney General if you disagree with the outcome.

11. US state privacy rights

Residents of states with comprehensive privacy laws, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, have the rights in section 10, as their laws provide.

California notice at collection

In the past 12 months we have collected the following categories of personal information, from you and from your browser, for the purposes in section 3, and kept them for the periods in section 6:

We do not collect sensitive personal information as defined by California law, and we have no actual knowledge of selling or sharing the personal information of consumers under 16. Shine the Light: we do not disclose personal information to third parties for their own direct marketing. Nevada: we do not sell covered information.

12. EU, UK and other countries

If the EU or UK GDPR applies to you, the legal bases we rely on are listed in section 3, and you may complain to the data protection authority where you live or work. Visitors in Switzerland, Canada (including Quebec), Brazil and other countries with privacy laws may use the rights those laws give them in the same way, using the contact details below.

13. Children

ChartVault is a general-audience site and is not directed to children under 13 (or under 16 where local law sets that age). We do not knowingly collect personal information from children. If you believe a child has sent us information, please contact us and we will delete it.

14. Changes to this policy

We may update this policy as the site or the law changes. The date at the top shows the latest version. If we make a material change, such as starting to use a new kind of tracking, we will say so on the site and, where the law requires, ask for your consent again.

15. How to contact us

For questions about this policy or your information, use the contact form.