Privacy Policy
Privacy Policy
Last updated: 4 November 2026
1. Who we are
CrateWire is operated by a sole trader based in the United Kingdom, who is the data controller for the personal data described in this policy. That means we decide how and why your personal data is processed, and we are responsible for protecting it.
For any data-protection matter, including a question, request, or complaint, contact us at support@cratewire.com.
2. What this policy covers
This policy explains the personal data we process when you use CrateWire, the subscription web app that identifies the tracks DJs play in their public Instagram posts. It covers what we collect, why we collect it, the legal bases we rely on, who we share it with, and the rights you have under UK GDPR.
It applies to the CrateWire web app and the marketing pages that link to it. It does not cover third-party sites or services we link out to, which have their own privacy policies.
3. Data we collect
We keep data collection tight and tied to running the service. Here is what we hold and who helps us process it:
Account and authentication
Your email address and authentication data, handled by our database and authentication provider, so you can sign in and we can secure your account.
Subscription and billing
Your plan, billing status, and payment records, handled by our payment processor. We never see or store full card numbers: our payment processor handles card details directly.
Tracked handles and track data
The public Instagram handles you choose to track, and the derived track-identification data CrateWire generates from those public posts.
Tracklists identified from public DJ set links (SoundCloud, YouTube, Mixcloud) scanned on CrateWire may appear on public set pages. They never show who scanned the set, and uploaded audio files are never published. To have a set page removed, use our removal page.
For DJs in our catalogue we keep a copy of their public Instagram profile picture so CrateWire can show it next to their name. A DJ who wants their photo or their whole profile removed can ask us to remove it; section 16 explains what we hold about DJs and how to ask.
Connected AI apps
If you connect an AI app such as Claude or ChatGPT to CrateWire, that app receives an access key that works only for CrateWire's AI connection, and the answers it asks for: track names, DJ handles, set titles, and links to posts and sets. It never receives your email address or your password, and it cannot sign in to CrateWire as you. We store the app's name, the address it connects from, and when you connected it and last used it. If you let an app start scans, the links it sends are scanned under your account and count against your plan, as if you pasted them in CrateWire. The app is run by its own provider under its own privacy policy. You can disconnect it at any time in Settings, and deleting your account disconnects every app.
Ad click identifier
If you arrive from one of our ads: the ad click identifier, kept with your account; only a click from the last 90 days is ever used, and declining the pixel removes it.
Technical and usage data
Basic technical and usage data, such as logs, needed to run, secure, and troubleshoot the service.
4. How we use your data and legal bases (UK GDPR)
Under UK GDPR we must have a lawful basis for every use of your personal data. Here is how our purposes map to those bases:
Performance of a contract
Providing the service and running your subscription: identifying tracks, building your feeds, and giving you access to the features your plan includes.
Legitimate interests
Securing, operating, and improving the product, and, outside the EU, UK and Switzerland, understanding how it is used, balanced against your rights and expectations.
Legal obligation
Keeping billing and tax records for as long as the law requires.
Consent
In the EU, UK and Switzerland: usage analytics, session recordings and advertising measurement in your browser, and optional marketing emails if we offer them. You can withdraw consent at any time, without affecting earlier processing.
5. Sub-processors
We share data with the following categories of providers only to run the service. Each acts on our instructions for the role listed:
- Hosting and infrastructureRunning the application, its background jobs and file storage
- Database and authenticationStoring your account and the data CrateWire generates, and signing you in
- Payment processingTaking payments and managing subscription billing
- Email deliverySending sign-in codes, receipts and the emails you choose to receive
- Product analyticsMeasuring how the product is used, including session recordings with anything you type hidden; in the EU, UK and Switzerland only after you accept
- Music recognition and data providersRetrieving public Instagram content (posts, stories, profile and follower-list data) and public set audio, and recognising tracks in audio
- AI text processingAutomated track extraction from post text, classifying public creator profiles for partnership outreach, and drafting replies to Instagram messages for a person to approve
- Google (YouTube API Services)Reading public YouTube video details and posting set tracklists as comments from the CrateWire YouTube channel, under the YouTube Terms of Service (youtube.com/t/terms) and Google's Privacy Policy (policies.google.com/privacy)
- Creator partner attributionRemembering which creator partner's link brought you to CrateWire, so that creator can be credited if you subscribe; loaded only with your consent where the law requires it
- Meta PlatformsAdvertising measurement (Meta Pixel and Conversions API); loaded only with your consent where the law requires it
6. International transfers
Some of our sub-processors are based outside the United Kingdom, for example in the United States. Where your data is transferred internationally, we rely on appropriate safeguards such as UK-approved standard contractual clauses, or a finding that the destination country offers an adequate level of protection.
7. Data retention
We keep your account and billing data while your account is active, and for as long as we need it to meet legal and tax obligations, after which we delete or anonymise it. Derived track data is retained to power the product, for example to keep your tracklists and the cross-DJ feed working over time. Stories in which we found no track are deleted 30 days after they were posted; see section 16.
8. Your rights under UK GDPR
Under UK GDPR you have the right to access your data, to have it corrected (rectification) or deleted (erasure), to restrict or object to how we process it, to data portability, and to withdraw any consent you have given.
To exercise any of these rights, email us at support@cratewire.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) if you are unhappy with how we handle your data, though we'd appreciate the chance to put things right first.
9. Account deletion and export
You can request an export or deletion of your account data at any time. Where the option is available, you can do this from your in-app account settings. Otherwise, email support@cratewire.com and we'll handle the request, subject to any data we must keep for legal or tax reasons.
10. Cookies and local storage
We use essential cookies and local storage for authentication and to keep you signed in. We also set an essential cookie that remembers whether this browser has used its one free scan; it holds a random identifier, never your name or email. With your permission we also use analytics cookies and local storage to see how CrateWire is used: the pages you visit and what you click, and for some visits a recording of the page with anything you type hidden. We also record a few account events on our own servers, such as starting a trial or completing a purchase, to run the service. When you sign up or buy, we use the Meta Pixel and Conversions API to measure whether our ads led to it; Meta receives a hashed form of your email, name and billing country, the click identifier from the ad link you arrived on, and your browser and IP address, never what you pasted. If you arrive through a creator partner's link, a cookie remembers which link it was, so that creator can be credited if you subscribe. In the EU, UK and Switzerland no analytics or advertising cookies are set, and nothing is recorded from your browser, until you accept. If you decline, or change your mind later, analytics and recordings stop straight away and their cookies are deleted. You can change your choice at any time here:
11. No selling of personal data
We do not sell your personal data, and we do not share it for other companies' advertising; we share hashed sign-up and purchase events with Meta only to measure our own ads. The only sharing we do is with the sub-processors listed above, purely to run CrateWire.
12. Children
CrateWire is not directed at children. You must be 18 or older to use it. If you believe a child has provided us with personal data, contact us and we will delete it.
13. Security
We take reasonable technical and organisational measures to protect your data, including working with established providers and limiting access to what is needed. No method of transmission or storage is ever 100% secure, so we cannot guarantee absolute security, but we work to keep your data safe.
14. Changes to this policy
We may update this policy from time to time. When we make material changes, we'll take reasonable steps to notify you, for example by email or an in-app notice. The “Last updated” date at the top always reflects the latest revision.
15. If we contacted you about a partnership
We sometimes message DJ and music-production creators on Instagram, or by email when their profile shows a public email address, to offer them a free CrateWire plan and a discount code for their audience. Each outreach message is written or approved by a person and sent one at a time.
What we use: information you have made public on your Instagram profile: your username and display name, your bio, the category and links on your profile, your follower count (and how it changes over time), any public email address, which other public accounts follow you or you follow, how recently you posted a story, and the like, comment and view counts on your recent public posts. We collect it through a data provider that reads public Instagram profiles. To judge whether an account fits, an AI model reads this profile information and, for some accounts, the captions of recent public posts; we do not store those captions. We do not use private accounts, and profile photos play no part in choosing who we contact.
Why, and our legal basis: to find creators whose audience is DJs and producers and send them a one-to-one partnership offer. We rely on our legitimate interest in telling relevant creators about CrateWire, kept to what that needs: public information only, a small number of individual messages, and an easy way to say no.
How long we keep it: 90 days after we collect your profile, we delete your bio, category, profile links, any public email address and the follower connections recorded up to then, unless our message to you is still waiting to be sent. After that we keep only basic account facts (your username, account identifier, display name, follower counts, and whether the account is verified or a business account) and how we classified it. If you say no, we make those deletions at once and keep your Instagram username and account identifier on a do-not-contact list, so that we never contact you again.
After we message you: we keep a record of the contact in our internal outreach records (your name and Instagram username, the email address if we wrote to you by email, the message we sent and any reply) to follow the conversation and any partnership that comes out of it. If you say no, we keep only what we need to never contact you again.
How to object: reply “no” to our message, or email support@cratewire.com. We will stop at once, delete your bio, profile links, any email address and the follower connections we stored, and add you to a permanent do-not-contact list. You also have the rights described in section 8, including the right to complain to the ICO.
16. If your public posts appear on CrateWire
CrateWire identifies the music DJs play in their public Instagram and TikTok posts, reels and stories. If you are one of those DJs, we hold some information about you even though you have not signed up. This section explains what we hold, why, and how to have it removed.
What we hold: your public username and display name; your profile photo, which we copy so your page loads quickly; public profile facts such as your follower, following and post counts, whether the account is verified or a business account, and its category; and, for each public post, reel or story we read, its date and link, the tracks we identified in it and how we identified them (for example from a song tag or by recognising the audio). We do not keep your photos, videos or the audio we listen to, and we keep no picture, video or text from your stories.
Where it comes from: content you published publicly on Instagram or TikTok, which we read through data providers that access public profiles, and public posts that CrateWire members paste into the app to identify a track.
Why, and our legal basis: to show DJs and music fans which tracks DJs are playing, in the CrateWire app and on public tracklist pages, charts and reports. We rely on our legitimate interest in helping people find the music played in public DJ content (Article 6(1)(f) UK GDPR). We only use content you made public, we never read private accounts, and you can object at any time.
Who can see it: your tracklist page, and the charts, reports and social posts that mention you, are public. CrateWire members see the tracks in their feed.
How long we keep it: while your public account appears in our catalogue. A story in which we found no track is deleted 30 days after it was posted; for other stories we keep only the date and the tracks we identified. If your account becomes private or is deleted on Instagram, we stop reading it.
How to object or have your profile removed: you can ask us to remove your profile, or only your photo, from the DJ profiles section of our copyright page. We give you a short code to send to @cratewire by Instagram direct message from your account, which is how we confirm the request comes from you. We can't act on a request we can't confirm this way, including one sent only by email, because anyone can write in someone else's name. If your page comes from a TikTok account, email support@cratewire.com and we will agree with you how to confirm it. Once confirmed, we delete your profile, photo, posts, stories and the tracks identified in them, take your pages off the site, its sitemap and search, and stop reading your account. We keep only your username and account identifier on a do-not-process list, so that your profile is never added again. If you only want your photo removed, choose that option and we remove just the photo. We delete the email address you give us 90 days after we close your request.
How fast: we complete a removal within 7 days of confirming the account is yours, and always within one month. Charts and reports already published stop showing your name at the same time, and if we tagged or featured you on our own Instagram account we remove that too. You also have the rights in section 8, including the right to complain to the ICO.
17. Instagram comments and messages
Keyword comments: when you comment a keyword we asked for on a post by @cratewire, we reply to your comment and send you a direct message with a button. When you tap it, we send you the link you asked for. If you have not tapped it after an hour, we may send one reminder. These replies are sent automatically, in wording we wrote in advance.
Direct messages: when you message @cratewire, an AI model reads your message and drafts a reply. A person reads every draft and decides to send it, change it or drop it. Nothing we draft is sent to you without a person approving it.
What we keep: your Instagram username and account identifier, the text of your comment or message, our replies, and whether you tapped the button or opened the link. We use it to answer you, relying on our legitimate interest in replying to people who contact us.
How long we keep it: up to 90 days, then we delete it. You can ask us to delete it sooner: see how to delete your Instagram data.
18. Contact
For any privacy question or data request, reach us at support@cratewire.com.