BGplay.fm — Privacy Policy
Last updated: 8 May 2026. Effective immediately upon publication.
1. Introduction; Identity of the Controller
This Privacy Policy (this “Policy”) describes how BGplay.fm Ltd., an Israeli private limited company having its registered office in Tel Aviv-Yafo, Israel (“BGplay”, “we”, “us”, “our”), collects, uses, discloses, retains, transfers, and otherwise processes personal information in connection with the BGplay.fm streaming service, the website at https://bgplay.fm, the related applications, dashboards, APIs, and marketing properties (collectively, the “Service”). For the purposes of the Israeli Protection of Privacy Law, 5741-1981 (חוק הגנת הפרטיות, התשמ"א-1981) (the “PPL”), and, where applicable to visitors located in the European Economic Area, the United Kingdom, or Switzerland, the EU/UK General Data Protection Regulation (the “GDPR”), BGplay is the controller of the personal information described in this Policy. For data-protection inquiries the contact address is [email protected].
2. Scope
This Policy applies to all individuals who interact with the Service, including (a) account-holders and authorized users of Subscribers (e.g., the SMB owners and their staff who operate the BGplay player at the Premises), (b) visitors to the website, and (c) recipients of marketing communications. This Policy does not apply to (i) third-party sites linked to from the Service, (ii) the practices of the Suno Provider in respect of any data it independently collects from end-users (which are governed by Suno’s own privacy policy), or (iii) anonymous or statistical data that has been irreversibly de-identified.
3. Categories of Personal Information We Collect
3.1 Account & Identification Data
Name, business name, e-mail address, password hash (we never store passwords in clear text), telephone number, business identification number (e.g., Israeli VAT registration number, company number), the address(es) of the Premises, the type of business or vertical (gym, restaurant, hotel, retail, etc.), chosen locale, and authentication identifiers issued by us or by third-party identity providers (e.g., Google account ID, when signing in with Google).
3.2 Billing & Transaction Data
Plan tier, billing cadence, invoice records, transaction references, partial payment-card information (typically last four digits, card brand, and expiration date), Israeli ID number or business number for tax-invoice issuance where required, and VAT-related fields. Full primary account numbers are not stored on our systems; payment-card data is collected and processed directly by our payment processor (Polar.sh, acting as our Merchant of Record, with Stripe as the underlying PCI-DSS-certified card processor) or such other PCI-DSS-certified processor as we may engage.
3.3 Service Usage & Telemetry
Streams played, stations selected, prompts and station configurations submitted, like/skip/feedback signals, scheduling data, errors, device type and operating system, browser type, IP address, approximate geolocation derived from IP address, user-agent strings, screen size, language preference, time zone, session timestamps, referring URL, and pages and features accessed.
3.4 Communications
Support tickets, e-mail correspondence, chat transcripts, call recordings (where you have consented to recording for quality and training purposes), and feedback you choose to submit.
3.5 Marketing & Preferences
Newsletter subscriptions, marketing-consent state and history, click-through and open-rate data on marketing e-mails, and cookie/consent preferences.
3.6 Cookies & Similar Technologies
Authentication cookies, session cookies, locale preference cookies, CSRF tokens, anti-fraud cookies, and (where you have consented) analytics and performance cookies. See Section 11 (Cookies) for details.
4. Sources of Personal Information
We obtain personal information directly from you when you create an Account, sign in with a third-party identity provider, purchase a Subscription, configure the Service, communicate with us, or otherwise use the Service. We obtain certain technical information automatically when you use the Service. We may also obtain information from third parties such as identity providers (e.g., Google), payment processors (e.g., Polar.sh, Stripe), fraud- prevention vendors, and the Suno Provider.
5. Purposes of Processing
We process personal information to: (a) provide, operate, and maintain the Service, including authentication, streaming, scheduling, station configuration, and customer support; (b) process payments, invoicing, and tax compliance; (c) prevent fraud, abuse, and credential stuffing, and to enforce our terms; (d) communicate with you about the Service, transactions, outages, security incidents, and policy changes; (e) personalize the Service to your stated preferences and prior usage; (f) measure, analyze, and improve the Service, including the development of generative-AI features and the curation of the Catalog; (g) where you have opted in, send marketing communications and personalize them; (h) comply with Applicable Law, including the PPL, the Consumer Protection Law, the VAT Law, the Money-Laundering Prohibition Law, and any judicial, regulatory, or governmental request; and (i) establish, exercise, or defend legal claims (including, without limitation, claims relating to royalties, intellectual property, or contract).
6. Legal Bases (PPL and, where applicable, GDPR)
Under the PPL, we process personal information based on the consent of the data subject, the necessity of processing for the performance of a contract with the data subject, the legitimate interests of BGplay or of a third party (which we have balanced against the rights of the data subject), and the fulfilment of a legal obligation. Where the GDPR applies (i.e., to visitors and Subscribers located in the EEA, the UK, or Switzerland), we rely on the corresponding legal bases set out in Article 6(1) of the GDPR (consent, contract, legitimate interests, legal obligation, and, in narrow cases, vital interests or public-interest tasks).
7. Sharing & Recipients
We disclose personal information to the following categories of recipients, in each case under appropriate contractual and technical safeguards:
(a) Cloud and infrastructure providers: Google LLC and Google Cloud (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Run, Cloud Logging, Cloud Monitoring, App Check) — for hosting, storage, identity, analytics, and operations. (b) Payment processor: Polar.sh (our Merchant of Record), with Stripe as the underlying PCI-DSS-certified card processor — for payment authorization, capture, billing, and invoicing. (c) Generative-music provider: Suno, Inc. — for the generation of AI Music and, in limited cases, for product analytics agreed contractually between BGplay and Suno. (d) Customer-support and CRM tooling: e-mail platform, help-desk software, and customer-relationship management systems we engage from time to time. (e) Analytics and product-quality vendors: first-party and consent-based third-party analytics tools used to measure usage and improve the Service. (f) Legal, professional, and audit advisers: external counsel, accountants, auditors, and tax advisers. (g) Authorities: courts, the Israel Tax Authority, the Privacy Protection Authority, the Israel Police, regulators, and other governmental bodies, where required by Applicable Law or pursuant to a lawful request. (h) Successors and acquirers: in connection with any merger, acquisition, financing, reorganization, or sale of all or substantially all of our assets, subject to appropriate confidentiality undertakings.
We do not sell personal information to third parties. We do not use personal information to train any third-party generative-AI model. Any data shared with the Suno Provider is limited to that which is necessary for the generation, delivery, or analytics of the AI Music and is governed by our agreement with Suno.
8. International Transfers
Some of our service providers (including Google Cloud and Suno) process personal information outside the State of Israel, including in the United States and in the European Union. We rely on (a) the Israeli Privacy Protection (Transfer of Data Outside the State's Borders) Regulations, 5761-2001, and the corresponding adequacy determinations or recipient undertakings; (b) where the GDPR applies, on Standard Contractual Clauses, adequacy decisions, or other approved transfer mechanisms; and (c) appropriate technical and contractual safeguards, including encryption in transit and confidentiality undertakings.
9. Retention
We retain personal information for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. By way of example: (a) Account data is retained for the life of the Account and for up to seven (7) years thereafter to comply with Israeli tax-record retention requirements; (b) billing and transaction data is retained for seven (7) years; (c) usage telemetry is retained in identifiable form for up to twenty-four (24) months and may be retained thereafter in aggregated or de-identified form; (d) marketing consent records are retained for as long as the Subscriber has an active marketing-opt-in plus three (3) years thereafter; and (e) customer-support communications are retained for as long as is reasonably necessary to address recurrence of issues, plus three (3) years thereafter.
10. Security
We implement reasonable administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal information transmitted, stored, or otherwise processed. These safeguards include encryption in transit (TLS), encryption at rest where appropriate, role-based access controls, multi-factor authentication for staff with privileged access, vendor due diligence, security logging, and an incident-response plan. No method of transmission or storage is 100% secure, and we cannot guarantee the absolute security of personal information. In the event of a security incident affecting personal information, we will notify affected data subjects and competent authorities to the extent required by Applicable Law.
11. Cookies & Similar Technologies
We use cookies and similar technologies (including local storage, session storage, and pixels) to operate the Service and to analyze usage. Strictly necessary cookies (e.g., for authentication, session continuity, locale preference, and CSRF protection) are set without consent because they are essential. Optional cookies (analytics, performance, marketing) are set only after you have given consent through our consent banner, and you may withdraw consent at any time through the cookie- preferences control. The website may not function correctly if strictly necessary cookies are blocked.
12. Analytics
We use first-party analytics and, where you have consented, consent-based third-party analytics, to understand aggregate usage of the Service and improve features. Analytics data is used in pseudonymized or aggregated form wherever possible.
13. Marketing
We will send you marketing communications only if you have given the explicit consent required under Section 30A of the Israeli Communications Law (Telecommunications and Broadcasting), 5742-1982 (חוק התקשורת — בזק ושידורים, התשמ"ב-1982), or if another lawful basis applies (e.g., the soft-opt-in for existing customers in respect of similar services, where applicable). You may opt out at any time using the unsubscribe link in any marketing e-mail or by writing to [email protected]. Even after opting out of marketing, you will continue to receive transactional and account communications that are necessary for the operation of the Service.
14. Your Rights
14.1 Rights under the PPL
Under sections 13 and 14 of the PPL, you have the right to inspect personal information about you held in our database, and to request the correction, completion, or deletion of inaccurate, incomplete, or unlawful personal information. To exercise these rights, please write to [email protected] from the e-mail address associated with your Account, or use any equivalent in-Account control we make available. We may request additional information to verify your identity.
14.2 Rights under the GDPR (where applicable)
If the GDPR applies to you, you also have rights of access, rectification, erasure (“right to be forgotten”), restriction of processing, portability, and objection, as well as the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
14.3 Complaints
You may file a complaint with the Israeli Privacy Protection Authority (הרשות להגנת הפרטיות) or, if the GDPR applies, with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement.
15. Children
The Service is not directed to, or intended for use by, individuals under the age of eighteen (18). We do not knowingly collect personal information from children. If you become aware that personal information about a child has been provided to BGplay, please contact us at [email protected] and we will take appropriate steps to delete it.
16. Automated Decision-Making
BGplay does not, in the ordinary course, make decisions that produce legal or similarly significant effects about a data subject solely on the basis of automated processing. Certain recommendation, scheduling, and personalization features rely on automated processing, but their effects are limited to the configuration of the Service and do not produce legal effects.
17. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified to you by e-mail or in-Account notice no fewer than fifteen (15) days before they take effect. The “Last updated” date at the top of this Policy reflects the latest revision.
18. Contact & Data Protection Officer
For any question, request, or complaint regarding this Policy or the processing of your personal information, please contact us at [email protected]. Where required by Applicable Law, BGplay shall appoint a Data Protection Officer or representative whose contact details will be published on this page.