Privacy, in plain English.

Who is responsible

The operator of Music GOAT Index is responsible for the processing described here. Privacy and data requests can be sent to partners@musicgoatindex.com. A formal legal-entity identity and postal contact must be published before commercial ad serving is enabled.

What we process

• Consent choices: analytics and advertising preferences stored on your device.
• Optional product analytics: a random session identifier, pages and features used, timestamps, device category and consent state. Analytics transport stays off until you allow it. We do not intentionally store raw IP addresses, user-agent strings, names, phone numbers or email addresses in product analytics.
• Sponsor inquiries: the brand, contact details, website, budget/timing choices and campaign description you submit so we can answer the request.
• Correction requests: the page, issue, explanation, suggested source and optional reply email you submit.
• Security and delivery data: hosting providers may process request information such as IP address, timestamp and technical logs to operate and protect the service.
• Form abuse prevention: public form requests use a short-lived pseudonymous identifier derived from a hosting-provider-verified IP address with a secret one-way HMAC. The raw IP address is not stored in the application rate-limit table.

Why we process it

• Necessary storage and security support the service and our legitimate interest in keeping it reliable.
• Optional analytics and optional advertising rely on your choice and remain off by default.
• Sponsor and correction submissions are processed to answer the request you chose to send, take steps toward a possible agreement and maintain the integrity of published information.

Providers and international processing

Vercel provides hosting and security delivery, Neon provides managed PostgreSQL storage, and Cloudflare provides authoritative DNS. Google advertising services are not currently active. If advertising providers change, this notice and the cookie policy will be updated before their code is served.

Some providers may process information outside Norway or the EEA. Where that happens, the operator must use the provider's applicable data-processing terms and transfer safeguards.

How long information is kept

• Consent choices remain on the device for up to 12 months unless you replace or clear them.
• Raw, consented analytics is designed for a 30–90 day review window; aggregated, non-identifying metrics may be kept longer.
• Sponsor and correction submissions are kept only while needed to answer, review or document the request and any resulting legal obligations. Unneeded or spam submissions should be deleted or anonymized.
• Infrastructure logs follow the relevant provider's security and retention settings.
• Form-abuse identifiers expire with their rate-limit window and may be removed after the expiry time plus a short operational cleanup period.

Your choices and rights

You can withdraw optional consent at any time on the Privacy choices page. Depending on the situation, you may also request access, correction, deletion, restriction, portability or object to processing. You may complain to the Norwegian Data Protection Authority (Datatilsynet).

No hidden ranking influence

Sponsor inquiries, advertising choices and analytics never change an artist's score or ranking. Paid placements must remain clearly labeled and separate from editorial scoring.