MeloDeal | Privacy Policy

This privacy policy ("Privacy Policy") explains how Kawan BV, with commercial name "MeloDeal", Vuurgatstraat 44, 3090 Overijse, Belgium, with company number 0676.972.995 (VAT BE 0676.972.995) ("MeloDeal", "we", "us"), collects and uses personal data.

We process personal data in line with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

This Privacy Policy describes what personal data we process, why, on which legal basis, who we share it with, how long we keep it, how we protect it, and the rights you have.

1. Applicability and our role

This Privacy Policy covers personal data we collect when you visit melodeal.io, create a MeloDeal account, install the MeloDeal app from the HubSpot Marketplace, connect a Sonos speaker, or contact us. Please read it before installing the app.

We act in two roles:

As controller for data about our customers and website visitors: account details, billing, support requests, website usage and marketing.
As processor for the CRM data our customers make available to us through HubSpot (such as deal names, amounts and deal owners). Here our customer, the company that installed MeloDeal, is the controller and decides what data is shared. We only process it on their documented instructions.

If you are a sales rep whose name appears in a jingle or a deal notification, your employer is your first point of contact for questions about that data. We will help them answer you.

2. Which personal data we process, and why

We only collect what we need to make your team's closed deals sing.

Data	Examples	Why we use it	Legal basis (GDPR art. 6)
Account and profile data	Name, work email, company name, role, password (hashed) or login method	Create and manage your account, deliver the Service, send service and product-update emails	Performance of a contract
HubSpot CRM data	Deal ID, deal name, stage, amount, pipeline, close date, deal owner name and user ID	Detect when a deal closes, apply your thresholds and deal types, pick the right jingle	Performance of a contract (we act as processor, see section 1)
Team and jingle configuration	Team members, their names or nicknames, assigned jingles, thresholds, custom audio or text you add	Personalise which jingle plays for whom	Performance of a contract
Sonos speaker data	Sonos household and speaker IDs, room names, access tokens	Connect to and play audio on the speakers you select	Performance of a contract
Payment and billing data	Company billing details, VAT number, invoices. Card details are handled by our payment provider; we never store full card numbers	Bill your subscription, meet accounting obligations	Contract; legal obligation
Support data	Name, email, your message, screenshots or logs you share	Answer your questions, fix issues, improve the Service	Contract (customers); legitimate interest (others)
Contact and marketing data	Name, email, your message, newsletter preferences	Reply to you; send news about MeloDeal	Legitimate interest (customers); consent (non-customers)
Usage and technical data	IP address, browser, timestamps of jingle triggers, error logs	Keep the Service secure and reliable, troubleshoot, measure usage	Legitimate interest

We do not use your data for automated decision-making or profiling that has legal or similarly significant effects on you.

3. Our commitments on HubSpot and Sonos data

Least access. We request only the HubSpot OAuth scopes needed to read deal data and deal owners: crm.objects.deals.read and crm.objects.owners.read. We never write to, change or delete your CRM records.
Purpose-bound. CRM and Sonos data is used only to run MeloDeal. We never sell it, use it for advertising, or use it to train AI models.
Minimal storage. We store only the deal fields needed to trigger and log a jingle, not your contacts, companies or emails.
You stay in control. Uninstalling MeloDeal from HubSpot, or disconnecting Sonos in your account settings, revokes our access immediately. Related tokens are deleted and stored CRM data is removed per section 6.

Your use of HubSpot and Sonos is also governed by their own privacy policies.

4. Sub-processors and other third parties

We share personal data only with service providers that help us run MeloDeal. Each is bound by a written agreement requiring them to:

apply appropriate technical and organisational security measures;
keep the data confidential, including their staff and subcontractors;
use it only for the purpose we gave them.

Provider	Purpose	Location
HubSpot, Inc.	CRM integration (source of deal data)	EU / US
Sonos, Inc.	Speaker control and audio playback	US
Vercel Inc.	App hosting and serverless functions	EU / US
Netlify, Inc.	Website DNS and hosting	US
Supabase Pte. Ltd.	Data storage	EU
Stripe, Inc.	Payments and invoicing	EU / US
Supabase Pte. Ltd.	Transactional and support emails	EU

We will update this list before adding a new sub-processor that handles customer CRM data.

We may also disclose personal data if we are reorganised, merged, acquired or declared bankrupt, or when required by law or a court order. Where possible, we will tell you beforehand.

We never sell personal data or make it available to direct-marketing agencies.

5. Processing location of your data

In case we transfer your personal data to a third country or international organisation (i.e., outside the EEA), we will make sure that your personal data is either transferred to third countries that are deemed to be offering an “adequate” level of protection by the European Commission (a list of adequate third countries is available on the European Commission's website), or alternatively, where your personal data is not sent to a country that provides an adequate level of protection, we will put in place appropriate safeguards with the entity receiving your personal data (e.g. the EU standard contractual clauses or binding corporate rules) to ensure that your personal data remains protected in accordance with Applicable Data Protection Law.

6. How long we keep your data

We keep personal data only as long as needed for the purposes above.

Data	Retention
HubSpot CRM data and Sonos tokens	Deleted within 30 days after uninstall, disconnection or account closure
Jingle trigger logs	12 months, then deleted or anonymised
Account and configuration data	While your account is active, then deleted within 3 years after it ends
Billing records and invoices	As long as Belgian accounting and tax law requires
Support and contact messages	2 years after the last exchange
Marketing preferences	Until you unsubscribe or withdraw consent

We may keep data longer when the law requires it or when it is needed for an ongoing dispute.

7. Security

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including:

encryption in transit (TLS) and at rest;
OAuth tokens stored encrypted and never shown in the app;
access to production data limited to the MeloDeal founders, with multi-factor authentication.

No system is completely secure, and we cannot guarantee that data sent over the internet will never be intercepted. If you notice a security issue or unauthorised access, email support@melodeal.io right away. If a personal data breach affects you, we will notify you and the authorities as the GDPR requires.

8. Your data, your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
rectify inaccurate or incomplete data;
erase your data ("right to be forgotten");
restrict how we process it;
port data you gave us, in a structured, machine-readable format;
object to processing based on our legitimate interest, including direct marketing;
withdraw consent at any time, without affecting earlier processing.

To exercise a right, email support@melodeal.io from the address linked to your account so we can verify your identity. We reply within one month. For CRM data we process for a customer, we will forward your request to that customer and help them respond.

You can also lodge a complaint with the Belgian Data Protection Authority: Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, +32 2 274 48 00, dataprotectionauthority.be.

9. Cookies

melodeal.io and the MeloDeal app use only cookies strictly necessary for the site and login to work. These do not need consent.

10. Children

MeloDeal is a business tool and is not intended for anyone under 16. We do not knowingly collect personal data from children.

11. Changes to this policy

We update this Privacy Policy when we meaningfully change how we handle personal data. The new version is posted on this page with a new "Last updated" date. For material changes, we will also notify account owners by email at least 30 days before they take effect.

12. Contact

For questions about this Privacy Policy or your personal data, contact Kawan BV (MeloDeal), Vuurgatstraat 44, 3090 Overijse, Belgium, at support@melodeal.io or via our support page.