TraxScout Privacy Policy
Version: 16 September 2026
1. Controller and contact
The controller responsible for the processing described in this notice is:
TraxScout GmbH
Leo-Kowalski-Str. 27
50859 Cologne, Germany
Email: info@traxscout.com
Website: https://traxscout.com/
Please contact us using these details with privacy questions or requests to exercise your data protection rights.
This notice covers our presentation website at traxscout.com and the TraxScout research application operated by us, including searches, saved results and exports. It does not describe independent services operated by third parties to which we link.
2. Scope of this notice
This notice explains how we process personal data when you visit our website, contact us or use the TraxScout search application. TraxScout researches music releases and publicly accessible music videos using search inputs and public catalogue or video metadata, particularly from Apple Music and YouTube.
Such information may be personal data where artist names, channel names or credits identify an individual.
This notice therefore also addresses individuals whose information appears in the researched sources.
3. Website access and hosting
When the website or application is accessed, technical data may include the IP address, request date and time, requested page or file, response status, transferred data volume, browser, operating system, referring page where supplied, and technical error or security information.
We process this information to deliver the service, maintain its security and investigate faults or misuse. The legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in reliable, secure operation. The application server is located in Germany.
Specific logs may need to be retained longer to investigate a concrete security incident or establish, exercise or defend legal claims, limited to what is necessary.
4. Contacting us
When you contact us by email, we process your email address, message and any other information you provide, such as your name and business contact details. We use this information to handle your request and associated correspondence.
Where necessary to enter into or perform a contract with you, the legal basis is Article 6(1)(b) GDPR. Other enquiries are processed on the basis of our legitimate interest in responding appropriately under Article 6(1)(f) GDPR. Correspondence is retained as needed for handling and documenting the matter, subject to applicable legal retention duties.
5. Search inputs and saved research
TraxScout processes artist and title inputs, selected platforms and search countries, search timestamps and identifiers, returned releases or videos, processing status, errors, saved result lists and generated exports.
Necessary query parameters are sent to the selected platform through our server.
Results can be reopened in the dashboard and exported. Research supports the identification and assessment of releases in our represented repertoire and discussions with music distributors and rights professionals. The legal basis for this research, insofar as personal data are processed, is Article 6(1)(f) GDPR. Our interest is to identify releases, investigate attribution and support rights administration, subject to the interests and rights of affected individuals.
A match alone is not proof of infringement or ownership. Removing a dashboard entry currently archives it; this action does not itself erase the underlying records.
The dashboard is shared rather than a private personal research account. People who can access the application and its result endpoints may be able to view saved searches and exports. Please do not enter confidential material or unnecessary personal data into search fields.
6. Apple Music
Apple Music research uses its catalogue API. Available fields include artists, tracks, albums, release type and date, Apple identifiers and links, ISRC, UPC/EAN, labels, copyright and contributor credits, composers, duration, genres, content ratings, artwork/preview URLs, territorial availability and scan timestamps. These data come from the public catalogue; the research does not access a user’s personal music library.
Searches start in selected countries. Availability of found releases may then be checked in additional countries by matching UPC/EAN. Artwork and previews may load directly from Apple or delivery servers, transmitting browser connection data including the IP address. Apple identifies Apple Distribution International Limited in Ireland as controller for EEA individuals. See Apple’s Privacy Policy (https://www.apple.com/legal/privacy/).
The purpose of external artwork and preview delivery is to identify a release and make the requested research result or listening preview available. Where personal connection data are processed for this purpose, our stated basis is Article 6(1)(f) GDPR, subject to the need for any separate consent for non-essential device storage or access.
7. YouTube API Services
7.1 Purpose and source
TraxScout uses YouTube API Services, including the YouTube Data API. We research publicly accessible videos using artist and song-title inputs. Remixes, bootlegs and other versions may qualify where the video title meets the matching criteria. Descriptions enrich accepted results but do not independently establish a match.
Information is obtained from public video metadata supplied through the API. Statements extracted from descriptions are attributed to that source and are not verified conclusions about ownership, licences or distribution arrangements.
7.2 Data processed
Depending on availability, we process and store:
- Video ID, title and YouTube URL; channel ID, name and URL.
- Publication date, duration, view counts and available like/comment counts.
- Descriptions, thumbnail URLs and reported regional restrictions.
- Description-based credits, including Provided by, label, distributor and licensing statements; performer, producer, composer, songwriter, publisher and remixer information; phonographic copyright and copyright notices.
- Search regions, retrieval timestamps and processing status. Fields are not available for every video. Comment counts do not mean that individual comment content is retrieved; the current research feature does not fetch user comments.
7.3 Queries sent to Google/YouTube
We send necessary search terms, region and pagination parameters, and video identifiers to the Google/YouTube APIs. Requests are made by our server. Google receives technical information about those API requests and the requesting server.
7.4 No personal Google-account access
The current feature does not require users to sign in with Google or YouTube. It uses a server-side API key and does not request OAuth access to personal accounts. It does not obtain private playlists, subscriptions, personal viewing histories or Google passwords.
The public API research does not reliably identify the Content ID claimant for a video. Claim verification is performed separately by appropriate rights professionals or the music distributor.
Our legitimate interest in this processing is research into releases associated with our represented repertoire and the review of attribution with the responsible distributors. Public availability does not remove the data protection rights of the individuals concerned.
7.5 Thumbnails and links
Video thumbnails are loaded directly from external image servers. When displayed, these requests may disclose your IP address, browser information and other technical connection data to the relevant provider. This connection may occur before you click a video link. Clicking a link opens YouTube, where its own privacy practices apply.
The current research feature does not download YouTube video or audio files and does not embed a YouTube video player.
The direct image connection supports identification of the selected research results. Processing of personal connection data for that purpose is based on Article 6(1)(f) GDPR, subject to any separate consent required for non-essential device storage or access. Loading a thumbnail is not an indication that a video is licensed to us.
7.6 Use and disclosure of research results
Results support research and communication with music distributors and other responsible rights professionals.
Selected links and metadata can be exported as CSV files and shared with these recipients where necessary and legally permissible for the specific review. Exports contain links and metadata, not downloaded videos.
7.7 Storage, refresh and deletion
Search results are stored so that a completed search can be reopened and exported. The current application does not yet automatically refresh or delete all stored YouTube API data after 30 days. Archiving a search does not trigger that process. The 30-day refresh/deletion procedure is not yet fully implemented.
YouTube’s API rules require public API data of this kind to be refreshed or deleted within 30 calendar days.
This requirement also concerns stored descriptions, raw responses and server-side exports. It is distinct from the application’s current technical behavior described above; the presence of this notice does not establish that the refresh/deletion process is operational.
To request correction or deletion of personal data stored by TraxScout, email info@traxscout.com and identify the relevant video or channel URLs where possible. We will assess the request under applicable data protection law and YouTube requirements. Deletion from TraxScout does not remove a video or other content from YouTube.
7.8 Google and YouTube information
Google’s policy generally identifies Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as the responsible entity for users in the EEA, subject to the scope of that policy. Read the Google Privacy Policy (https://policies.google.com/privacy?hl=en) and the YouTube Terms of Service (https://www.youtube.com/t/terms).
8. Recipients and service providers
Depending on the activity, personal data may be accessible to staff handling research, hosting and maintenance providers, communication providers, Apple and Google/YouTube, relevant distributors and rights professionals, and legal advisers, authorities or courts where a lawful basis exists. Processors require appropriate arrangements under Article 28 GDPR; platform providers may act as independent controllers for their own processing.
We disclose data only where a lawful basis exists and to the extent needed for the relevant purpose. Disclosure for rights-related review or legal claims is generally based on Article 6(1)(f) GDPR; disclosures required by law rely on Article 6(1)(c). Service providers acting on our behalf are subject to the applicable processor requirements. Information about the providers and safeguards relevant to your data can be requested at info@traxscout.com.
9. International processing
A German application server does not exclude international processing by platform providers. Google/YouTube and Apple services may involve processing outside the EEA. Google describes adequacy mechanisms and standard contractual clauses in its international transfer information (https://policies.google.com/privacy/frameworks?hl=en).
Transfers of personal data outside the EEA require an applicable basis under Articles 44 et seq. GDPR.
Depending on the recipient and service, this may be an adequacy decision or appropriate contractual safeguards. A US certification applies only within its actual scope. The relevant provider’s transfer information should be consulted for its own processing; you may also request information about transfers for which we are responsible.
10. Cookies, browser storage, fonts and analytics
Cookies or similar technologies may support technical functions and settings. Section 25(2) TDDDG may apply to storage/access strictly necessary for a service expressly requested by the user. Other consent-requiring access needs prior consent; subsequent personal-data processing also requires an appropriate GDPR basis.
The fonts used on our presentation website are hosted locally; displaying those fonts does not itself require a connection to Google’s font servers. We do not use tracking programs or social-media plug-ins on that website.
Connections created by external Apple artwork, previews and YouTube thumbnails are described separately in this notice.
You can control cookies through your browser settings and delete stored cookies. Session cookies normally expire when the relevant session ends; persistent cookies remain until their expiry or deletion. Blocking storage may affect functions that depend on it. This notice does not by itself constitute consent to optional tracking or third-party device access.
11. General retention and backups
Retention is determined by the purpose of the processing, applicable legal duties and the source-specific conditions. Research records are stored for follow-up checks, comparison and coordination concerning the relevant release. They are not automatically erased when a dashboard entry is archived. Prepared exports and backups may also contain copies. For the current YouTube retention behavior and its outstanding 30-day process, see section 7.7.
For correspondence, the criterion is completion and necessary documentation of the enquiry, subject to applicable statutory retention. For technical logs, the criterion is the period necessary for operational and security investigation. For a specific rights dispute, a separate assessment is required of the data needed and the applicable retention rules; the existence of a dispute does not provide a general exemption from YouTube API conditions. You may ask us for information about the retention of records relating to you.
12. Your data protection rights
Subject to the applicable legal requirements, you may request access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability (Article 20). You may object under Article 21.
Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. An objection to direct marketing may be made at any time. Consent may be withdrawn prospectively without affecting the lawfulness of earlier processing.
Contact info@traxscout.com. We may request proportionate information to verify identity and locate the affected records.
You may complain to a supervisory authority, including the authority for your habitual residence, workplace or the alleged infringement. The State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW) (https://www.ldi.nrw.de/kontakt) is relevant to our company’s location.
13. Provision of data and automated decisions
Technical connection data are required to deliver the website. A requested search cannot be performed without the necessary query inputs and parameters. Contact information is needed to respond to the corresponding enquiry.
TraxScout applies technical matching criteria and may sort results by views. This does not automatically determine an individual’s rights or the legality of a publication. Substantive rights assessments are performed by people.
14. Security and changes
Security measures must take account of the nature of the information and the risks involved. Our presentation website is available over HTTPS. That does not in itself establish encryption or individual access control for every separately hosted application endpoint. An HTTP address does not provide the transport protection of HTTPS.
We update this notice when processing practices, integrated services or relevant requirements change. The current published version is available through the privacy link on our service.
Version: 16 September 2026.