This privacy policy explains which personal data Groove Sheets (groovesheets.com) processes, why, and what your rights are. We collect as little as possible: in the free version, your charts never leave your device.
Last updated: 21 October 2026
Who is responsible
R2H B.V. is the controller of your personal data under the General Data Protection Regulation (GDPR, in Dutch: AVG).
R2H B.V.
De Slof 28A
5107 RJ Dongen
The Netherlands
Phone: +31 162 310167 (Monday to Friday, 9:00–17:00)
E-mail:
Chamber of Commerce (KvK): 18082715
VAT: NL815833076B01
What we process, and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Name, username, e-mail address, password (encrypted), date of registration and last visit | Your account: logging in, password reset and messages about the service | Contract | As long as you have an account |
| Your songs, categories and templates | Storing them in My songs and showing them to you on every device | Contract | As long as you have an account, or until you delete them |
| Songs, PDF files and setlists in Setlists, and your viewer choices | Storing them and showing them to you, and band songs to the members of the band | Contract | As long as you have an account, or until you or the band delete them |
| Bands: your membership and role, and the e-mail addresses of the people you invite | Sharing the library of a band, and sending an invitation and checking that the right account accepts it | Contract; for the person invited: legitimate interest of the band | As long as the membership or the band exists |
| Subscription and payment details (plan, period, amounts, invoices) | Pro subscription and administration | Contract and legal obligation | 7 years (Dutch tax law) |
| E-mails and messages you send us | Answering your question | Legitimate interest | Up to 2 years after the last contact |
| IP address, browser and time of a request (server and security logs) | Security, preventing abuse and solving errors | Legitimate interest | At most 6 months |
| Anonymised visit statistics (Matomo) | Understanding how the site is used, to improve it | Legitimate interest | At most 25 months |
In a band, the members see the songs, setlists and shared PDF files of the band and the names of the other members. The admins also see the e-mail addresses of open invitations.
We do not sell your data, do not use it for advertising and do not make automated decisions about you.
Data that stays on your device
Some data is never sent to us; it stays in your own browser:
- Drafts and settings: the editor keeps your latest text as a draft and your settings in the local storage of your browser.
- .txt and PNG files you save end up on your own device.
- Audio files in the practice player are stored as a copy in your browser (IndexedDB), on that device only. They are never uploaded.
- Offline setlists: a setlist you save for offline use is stored in your browser with its PDF files and chord sheets, on that device only. The options of Setlists are kept there as well.
You can remove this data at any time by clearing the site data in your browser.
Statistics with Matomo
We use Matomo to count visits. Matomo runs on our own server; the data is not shared with Matomo or any other party. We have set it up in a privacy-friendly way: it does not use cookies, IP addresses are anonymised, and visits are not linked to your account or followed across other websites. Because of this, we do not ask for your consent. You can object to it at any time (see Your rights below).
Third parties
- Hosting: the site and its database run on a server of our hosting provider in the European Union. This provider processes data only on our behalf, under a data processing agreement.
- Payments: Pro payments are handled by [payment provider]. They receive the data needed for the payment and are responsible for it under their own privacy policy.
- Spotify: the Spotify player is only loaded when you open it for a chart with a
@spotify:link. Spotify then receives data such as your IP address and may set cookies; Spotify’s privacy policy applies. - Fonts: all fonts are hosted on our own server. No data is sent to Google Fonts or other font services.
We do not transfer personal data to countries outside the European Economic Area, except where you choose to use Spotify.
Security
We protect your data with appropriate technical and organisational measures: the site uses an encrypted connection (HTTPS), passwords are stored encrypted, songs and PDF files are only available to the account that owns them or to the members of the band they belong to, and access to the server is limited. Backups are kept for a limited time and then overwritten.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted (including your account and songs);
- restrict processing, or object to processing based on legitimate interest;
- receive your data in a common format (data portability): your songs are plain text;
- withdraw consent, where processing is based on consent.
Send your request to
Complaints
If you are not satisfied with how we handle your data, please contact us first. You also have the right to file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
Children
The service is not meant for children under 16 without permission of a parent or guardian. We do not knowingly collect data of children under 16.
Changes
We may change this privacy policy. The latest version is always on this page; we tell account holders about important changes by e-mail. See also our cookie policy and terms and conditions.