Privacy policy.

Effective date: September 05, 2026

This Privacy Policy explains how MyCultBox collects, uses and protects your personal data when you use our service at www.mycultbox.com (the "Service"). We take your privacy seriously and aim to collect as little data as possible.

1. Who is responsible for your data

The data controller is Jan Hogewoning, a sole trader registered with the Belgian Crossroads Bank for Enterprises (KBO/BCE) under enterprise number 1028.233.850, at Guldensporenlei 8, 2300 Turnhout, Belgium. For any privacy question or to exercise your rights, contact us at support@mycultbox.com.

2. What data we collect

• Account data — your email address, name (if provided), password (stored only as a secure hash), language preference, and, if you sign in with Google or Apple, the identifier and basic profile information they share with us.
• Your content — the items you add (books, music, films, concerts), together with your reviews, notes, ratings, tags, companion names you record, and any images you upload.
• Subscription and billing data — if you subscribe to Pro, your plan, subscription status and billing identifiers. Payment-card details are entered with and held by our payment provider (Stripe); we do not receive or store full card numbers.
• Technical and usage data — limited information needed to run the Service securely, such as your IP address, browser type, and server logs (including for security and abuse-prevention).
• Communications — messages you send us, e.g. support emails.
• Audience measurement data — when you visit our public pages we record the page viewed, the site that referred you, and coarse location (country, region and city) and device information (browser, operating system, device type and screen size). This is aggregate only: it is not linked to your account and cannot be used to identify you. See sections 4 and 8.

3. How and why we use your data (legal bases)

• To provide the Service — creating your account, storing your library and showing it back to you. Legal basis: performance of our contract with you.
• To enrich your entries — when you add or import an item, we send the relevant query (such as a title, ISBN, URL or artist name) to third-party metadata sources to fetch covers, credits, tracklists and similar details. Legal basis: performance of contract.
• AI features — when you request an AI description, recommendation, biography or other AI-generated content, the relevant input (such as a title, the content of a page you import, or text you provide) is sent to our AI provider to generate the result. Legal basis: performance of contract / your request.
• Payments — to take payment and manage your subscription through Stripe. Legal basis: performance of contract and our legal obligations (e.g. tax/accounting).
• Service emails — account, security and transactional messages (such as password resets). Legal basis: performance of contract / legitimate interest.
• Security and improvement — keeping the Service safe, preventing abuse, and fixing problems. Legal basis: our legitimate interest in a secure, working service.
• Audience measurement — counting how many people visit our public pages, so we know whether the Service is growing. We use cookieless analytics that cannot follow you across days or across other websites. Legal basis: our legitimate interest in understanding how our public pages are used.

We do not sell your personal data, and we do not use advertising trackers or build profiles of you. We do measure how many people visit the Service, using privacy-friendly analytics that set no cookies and store no IP addresses — see section 8.

4. Who we share data with (processors)

We use a small number of trusted service providers ("processors") who act on our instructions and only for the purposes above:

• Hetzner — hosting and file/image storage, in data centres in Germany (EU).
• Cloudflare — content delivery and security in front of the Service.
• Plausible Analytics — privacy-friendly, cookieless audience measurement, hosted in the EU. It receives the page visited, the referring site, your approximate location (country, region and city) and device information (browser, operating system, device type and screen size). Your IP address and browser string are passed to it only in the moment of the request, to derive that location and a daily-changing anonymous identifier, and are stored neither by them nor by us. It sets no cookies and cannot track you across other websites.
• Stripe — payment processing for Pro subscriptions.
• SendGrid (Twilio) — delivery of our service emails.
• Anthropic — the AI provider that powers our AI features. Input you submit for an AI feature is processed to generate your result and is not used to train their models under their commercial terms.
• Sentry — error monitoring. When something goes wrong, it receives technical details of the failed request so we can fix the problem; we do not send it your IP address or account profile.
• Metadata sources — ISBNDB, Open Library, Google Books, Amazon, Apple, Spotify, Discogs, MusicBrainz (and its Cover Art Archive), Wikipedia, Bandsintown, The Movie Database (TMDB) and Setlist.fm receive only the query needed to return results (such as a title, ISBN or artist name); we do not send them your account details.

We may also disclose data where required by law, or to protect our rights, safety, or the integrity of the Service.

5. International transfers

We host your data in the EU. Some processors (such as our AI provider and, for some operations, Stripe, Cloudflare and SendGrid) may process data outside the EU, including in the United States. Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6. How long we keep your data

We keep your account and content for as long as your account is active. If you delete an item it is removed from your library; if you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must keep certain records longer (for example, billing and tax records, which Belgian law generally requires us to retain for seven years).

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• export your data in a portable format — you can do this yourself at any time from your account (CSV, ZIP and PDF export);
• restrict or object to certain processing; and
• withdraw any consent you have given, without affecting prior processing.

To exercise any of these rights, email support@mycultbox.com. You also have the right to lodge a complaint with your data protection authority. Ours is the Belgian Data Protection Authority — Gegevensbeschermingsautoriteit / Autorité de protection des données (dataprotectionauthority.be) — and you may also complain to the authority in your own country of residence.

8. Cookies

We use only essential cookies needed to run the Service — primarily a secure session cookie that keeps you logged in and protects your account. Our analytics provider, Plausible, sets no cookies at all. Visitor counts come from a hash of your IP address and browser combined with a secret that changes every 24 hours; your IP address and browser string themselves are never stored, and because that secret changes daily the hash cannot be linked back to you or followed from one day to the next. Because nothing is stored on or read from your device for analytics, no cookie-consent banner is required. Some embedded media (for example, audio previews or video) may set their own cookies if you choose to play it.

9. Security

We protect your data with measures such as encryption in transit (HTTPS), hashed passwords, access controls and EU-based hosting. No online service can be completely secure, so we also encourage you to use a strong, unique password and to keep your own exported backup of important data.

10. Children

The Service is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you (for example by email or in-app) before they take effect, and we will update the "Effective date" above.

12. Contact

Questions about your privacy? Email us at support@mycultbox.com.