Privacy Policy

Who is responsible

Manuel Sant'Ana operates SAMPLEMENT in Portugal as a self-employed individual, not through a separate company, and is the controller of the personal data described here. For privacy questions or requests, use the Contact page or email contact@samplement.com .

Postal address: R. Fernão Lopes, Lt. 5, 1.º Gab. 4, 2765-091 Estoril, Portugal.

Tax identification number (NIF): 236198343.

Data we use and why

• Accounts and sessions. We process your username, email address, protected password hash, email-verification status, account dates, age self-attestation, and session information. Session records can include your IP address and browser user-agent. While you are signed in, we record the time of your most recent activity on SAMPLEMENT and the approximate administrative region and country Cloudflare derives from the connection's IP address. Depending on the country, the region may correspond to a district, state, province, or equivalent; the estimate can be inaccurate, for example when using a VPN, and is used to understand the broad geographic distribution of people using the site. The timestamp, region, country and whether you appear online are visible only to the primary and backup administrators, are not shown on public profiles, and are deleted with your account. We use this data to create and secure your account, send verification and account emails, provide the features you request, administer the community, and understand broad audience demographics. The legal bases are providing the service you request (GDPR Article 6(1)(b)) and our legitimate interest in security, account administration and understanding broad audience demographics (Article 6(1)(f)). We also keep a cumulative estimate of how long your signed-in browser tab remains open while visible, based on periodic presence updates. Only the primary and backup administrators can see this estimate. It starts being collected when this feature is enabled and does not include earlier time.
• Profiles and community activity. We process profile details you provide, such as a bio, avatar URL and optional social links, together with crates, likes, follows, Sampled This activity, Sampled In suggestions, reports and community points. Sampled In suggestions contain a track title, artist and optional release, and display the submitter's username beside the suggestion. This lets us provide the community features you request and moderate the service. The legal bases are providing those features (Article 6(1)(b)) and our legitimate interest in keeping the community safe and the catalogue reliable (Article 6(1)(f)).
• In-app notifications. We store notifications and their read status for new followers, approved music and video submissions, resolved reports and XP milestones. Administrators and moderators also see pending moderation counts calculated from current submissions and reports. Notification records are kept while your account exists and are deleted with it. The legal bases are providing account features you request (GDPR Article 6(1)(b)) and supporting reliable community moderation (Article 6(1)(f)).
• Saved Sample Chopper settings. If you are signed in and save chops for a catalogue track, we store its 16 chop positions and mode (automatic or manual) with your account so we can restore the set and keep it locked when you return. These settings are private to your account and are not shown on your public profile. The legal basis is providing the feature you request (GDPR Article 6(1)(b)).
• Music submissions and catalogue. We process track and artist names, release details, source links, BPM, key, genre, style, additional catalogue metadata, corrections and sampling information you submit or confirm. This includes Sampled In suggestions, which are community-submitted and are not automatically verified by SAMPLEMENT. We use these details to identify recordings, review submissions and operate the shared music catalogue. Submissions are linked to your account while it exists. The legal bases are providing the Add Music and catalogue features you request (Article 6(1)(b)) and moderation and catalogue integrity (Article 6(1)(f)). Music information may also come from public music databases and provider APIs.
• Community video submissions. When you submit a YouTube video, we store its link, the title you provide, video ID, chosen category and language, and your account ID to manage the Videos feature. User submissions stay pending until approved by a moderator or administrator; videos submitted by moderators or administrators are published when submitted. Published videos show the title, language, YouTube thumbnail and link in the public Videos collection; your username is not displayed there. Submissions remain linked to your account while it exists. The legal bases are providing the feature you request (Article 6(1)(b)) and moderating and maintaining the collection (Article 6(1)(f)).
• Contact and reports. If you use the Contact form, we process your name, email, subject and message to answer you. If you report content, we process the report and account information needed to review it. We use this information to respond to your request and protect the community; the legal bases are taking steps at your request (Article 6(1)(b)) and our legitimate interest in handling enquiries and reports (Article 6(1)(f)). The Contact form fields are needed to handle your message; without them, we cannot reply.
• Donations. If you support SAMPLEMENT through Ko-fi, Ko-fi or your chosen payment provider may pass your name or display name, email, amount and message to Manuel Sant'Ana. This information is used to record and respond to contributions. The legal bases are our legitimate interest in managing voluntary support (Article 6(1)(f)) and, where applicable, compliance with legal record-keeping obligations (Article 6(1)(c)).
• Service security. Cloudflare processes connection and request information, which can include IP address, browser and device details, and access events, to deliver and protect the site. For rate limiting, SAMPLEMENT stores short-lived one-way hashes derived from network addresses rather than the raw address in those rate-limit records. The legal basis is our legitimate interest in security and abuse prevention (Article 6(1)(f)).
• Advertising. If ads are served, Google and the ad technology providers selected in AdSense may process your page URL, IP address, cookie or other browser identifiers, device and browser details, and information about ad impressions or interactions. They use this information to deliver and measure ads, personalize them where enabled and permitted, and detect fraud. Where required by law, we rely on your consent for advertising cookies or similar identifiers and personalized advertising. You can opt out of Google's ad personalization in Google Ads Settings; when the Google consent message is available, use the Privacy and cookie settings link on this site to review or withdraw your choice. The providers' own privacy information is linked above.

Account registration currently requires a username, email address, password and a self-attestation that you are at least 16. We store the age attestation with its date and policy version to apply SAMPLEMENT's age rule; it is not an identity-document check. We also check that you accept the current Terms and Conditions during registration, but do not keep a separate acceptance record. Optional profile details are not required. Without the required registration details and confirmations, we cannot create an account for you.

What other people can see

SAMPLEMENT profiles are public by design. A profile may show your username, bio, avatar, social links you mark public, catalogue contributions, community points, achievement badge levels and activity such as liked tracks, Sampled This marks, and follower or following counts. Your email address is not shown on your profile. Sampled In suggestions appear on the relevant public track page with the submitting username; this attribution identifies the contributor and is not an endorsement. Track submissions are held for review; approved entries become part of the shared catalogue and may be associated with your public profile.

All Crates are public and appear in the Crates collection and on your profile. Anyone can view them, so only add information you are comfortable sharing publicly.

External services

• Cloudflare hosts and protects SAMPLEMENT, stores account and catalogue data, and may provide Cloudflare Access controls. It processes technical data needed to deliver and secure the site. Read the Cloudflare Privacy Policy .
• Resend delivers account emails and Contact form messages to the SAMPLEMENT inbox. Contact messages are not stored in the SAMPLEMENT application database, but may remain in Resend systems and the receiving mailbox while they are handled. Read the Resend Privacy Policy .
• Advertising. SAMPLEMENT has Google AdSense code installed and may display ads served by Google and other ad technology providers selected in AdSense. When the ad tag or an ad loads, Google may receive the page URL, IP address, cookie or other browser identifiers, device and browser details, and information about ad impressions or interactions. Google and its partners may use cookies or similar storage, web beacons and IP addresses to deliver, personalize where enabled and permitted, measure ads, and detect fraud. Personalized ads may be based on visits to this site or other sites. The providers used can change with the AdSense settings; their identities and privacy information should be disclosed with the applicable ad consent choices. Where consent is required, advertising cookies and personalized advertising must follow the choices you make. Read How Google uses data on partner sites and the Google Privacy Policy .
• Music lookup services. When you submit a YouTube link to Add Music, SAMPLEMENT sends its video ID to the YouTube Data API to retrieve public video details used for matching. In the Videos collection, approved entries display a thumbnail loaded directly from YouTube's image servers. MusicBrainz receives the title and artist search or a supported music-page URL to find recording and release information. If the GetSongBPM lookup is enabled, it receives the title and artist to look up BPM and key. These lookups are made to provide the relevant features; they do not send your SAMPLEMENT password or account email. YouTube/Google also receives connection and playback data when its player is loaded in Sample Chopper; catalogue audio is streamed by YouTube and is not stored by SAMPLEMENT. The three fixed drum loops in Sample Chopper are hosted by SAMPLEMENT and play without loading the YouTube player. Read the Google Privacy Policy and MetaBrainz Privacy Policy . Play Instrument generates piano, bass and synth notes locally in your browser using Web Audio. SAMPLEMENT does not record, upload or store those notes or performances. The 16 original Drum Pad sounds are hosted by SAMPLEMENT and are loaded into your browser when you select that pad bank; the three fixed drum loops are also hosted by SAMPLEMENT.
• Cover artwork. Add Music and Discover request artwork directly from external image providers. We first try the Cover Art Archive; when it has no image, Add Music can use the YouTube video thumbnail or an HTTPS image URL supplied by the contributor. SAMPLEMENT stores only the selected image URL and its source, not the image file. Your browser connects directly to the relevant image provider, which receives standard connection data such as your IP address.
• Discogs. While you review a record, SAMPLEMENT may send its title and artist from our server to the Discogs API and show current release references with links to their Discogs pages. These API results are temporary and are not copied into the SAMPLEMENT catalogue. If you open a result, your browser visits Discogs, which handles that visit under its own Privacy Policy .
• Donations. The Donate page takes you to Ko-fi. Ko-fi and the payment provider you choose process the payment, not SAMPLEMENT. Depending on your settings, Ko-fi may share your name or display name, email, amount and message with Manuel Sant'Ana, who uses them to record and respond to contributions and related requests. Read the Ko-fi Privacy Policy .

When you use an external service or its embedded player, that provider handles the data it receives under its own privacy policy.

Some providers may process data outside the European Economic Area. Where an international transfer is subject to the GDPR, it relies on an applicable adequacy decision or approved safeguards. You can use the Contact page to ask which safeguards apply to a particular provider or request a copy where available. Providers may also disclose data when legally required.

Cookies and browser storage

SAMPLEMENT uses cookies needed for sign-in and security, including Cloudflare Access cookies where Access is enabled. When you toggle the navigation sidebar, a first-party cookie records whether it is expanded or collapsed for up to seven days. Session storage is used to restore scroll positions while navigating, and a small local-storage message synchronizes sign-in changes between tabs; it does not contain the session credential. The selected dark or light display theme applies for the current visit and is not saved. You may save a highlight colour to your account profile; it is used on future visits and can be changed or reset at any time. The selected language is saved in your browser's local storage so it remains selected on future visits. Sample Chopper initializes its embedded YouTube player before playback, with autoplay disabled. A clean Chrome test observed YouTube cookies and a YouTube local-storage entry being created before Play; Google says the player sends basic data when it loads and may process additional data during playback. Google's privacy practices apply to that player. You can block cookies or clear browser storage in your browser, although sign-in, scroll restoration or YouTube playback may not work as intended.

The MPC display theme follows the same browser storage behaviour as dark and light themes; it is not saved.

The Google AdSense code is installed. When ads load, Google and its ad technology partners may store or read cookies or similar identifiers, use web beacons, and process the page URL, IP address, device and browser details, and ad interactions as described above. You can control Google's ad personalization in Google Ads Settings . You can also opt out of some participating providers through YourAdChoices . These controls do not replace consent choices required by law. When Google's consent message is available, use Privacy and cookie settings to reopen it and review or withdraw your choice.

How long we keep data

• Account and profile data are kept while your account is active. You can request account deletion in Account settings where available, or through the Contact page. Sessions expire after 14 days unless renewed.
• If you delete your account, your live account and profile are removed and identifying links to community activity are deleted. Catalogue entries, sample-credit suggestions or contribution records may remain where needed to preserve the shared catalogue, with the account association removed. Saved Sample Chopper settings are deleted with your account.
• Moderation archive. To document account enforcement and help protect the community, a separate restricted archive may retain a banned or deleted account's username, the reason recorded for the action, the staff account reference and username of the person who took it, the action time and, for bans, whether the ban was later cleared. Moderators and administrators can access this archive. It is separate from the live account and is kept only while needed for community safety, moderation and related claims. You can ask us to access, correct or erase this record through the Contact page; we assess requests under applicable data-protection law.
• Contact messages are kept in the receiving mailbox only as long as needed to answer and follow up on the request, and longer only where needed for legal obligations or claims. Expiring rate-limit records are periodically deleted.
• Donation information received through Ko-fi is kept only as needed to manage the contribution, respond to related requests and meet any applicable record-keeping obligations.
• Google and other advertising providers set retention periods for ad-delivery data under their own policies and settings. If a consent-management provider stores your consent choices, its privacy information explains how long those records are kept.

Your rights

Depending on the circumstances, you may ask to access, correct or erase your personal data, restrict or object to its processing, and receive data you provided in a portable format. Where processing is based on consent, you may withdraw it at any time without affecting processing that took place before withdrawal. To exercise a right, use the Contact page and identify the account or data concerned. We may ask for enough information to verify your identity. Requests are normally free and answered within one month; the law allows an extension of up to two further months for complex requests, and we will explain if that applies.

You may also complain to the Portuguese Data Protection Authority, the Comissão Nacional de Proteção de Dados (CNPD) .

Automated processing and updates

SAMPLEMENT uses automated matching to suggest music metadata and automated limits to prevent excessive requests. It does not make automated decisions about you that have legal or similarly significant effects or create its own advertising profile about you. Google and its ad technology partners may personalize ads as described above, subject to your choices and applicable law. We will update this policy if our data practices materially change and revise the date above.