LapiloopLaw 25 · Quebec
Privacy policy
Effective
Lapiloop is an application that lets musicians record their part (audio and video) over songs, then send in their best recordings (“takes”) so they can be brought together in a video. It includes the website lapiloop.com, the web app app.lapiloop.com and, later, the iPhone and Android apps. Lapiloop is developed and operated by Codeshop, in Quebec.
This policy explains what personal information we collect, why, with whom it is shared, how long we keep it and how to exercise your rights, in accordance with Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25.
This English version is a translation of the French version, which is the original. Both have the same content.
1. Person in charge of the protection of personal information
Vincent Cantin-Bellemare, Codeshop. For any question or request: data@lapiloop.com. We answer within 30 days at most.
2. Information collected
We collect only what is necessary for Lapiloop to work.
| Information | When | Why |
|---|---|---|
| Google account: name, email address, profile photo, Google identifier | Signing in to the app (“Sign in with Google”) | Identify you, check that you are invited, credit you |
| Profile: photo, instruments and level, city (never your address), description, photos | Onboarding in the app and the Profile page, as you choose | Show your profile and, if you turn it on, your public profile |
| Takes you send: audio and video (and therefore your image and voice), with their technical data (offset, measured latency, rating, device, orientation, mix settings) | When you tap “Send” | Edit and mix the song’s video |
| Acceptance of the agreement: version, date and time, account | Before your first upload | Prove your consent to the use of the takes |
| Waitlist: email, platform, instrument (optional), date of consent and of confirmation | “Let me know at launch” form | Send you a single notice at launch |
| Contact form: name, email, message | When you write to us | Answer you |
| Technical logs: IP address, date, page or request, browser, errors | On every visit or request | Security, abuse prevention, troubleshooting |
| Technical browser signals processed by Cloudflare Turnstile | When you start filling in a form | Tell a human from a bot (anti-spam) |
What we do not collect: takes you don’t send. They stay on your device (browser or app storage) and are never transmitted. We do not collect your mailing address, your precise location or your contacts, and we never record the microphone or camera outside a take you start yourself.
3. Use
- Run the app: sign-in, song list, takes, uploading and storing takes.
- Produce and publish the songs’ videos, with the musicians’ credits.
- Send you app notices (take selected, video published, new song, closing soon).
- Answer your messages and let you know about the launch if you joined the waitlist.
- Protect the service against abuse and fix outages.
We sell no information, show no advertising and do no profiling. No decision about you is made by automated means.
4. Consent
We collect your information with your consent, given in a manifest, free and informed way, for the purposes described here. Each consent is requested separately (musician agreement, public profile, waitlist) and no box is ticked in advance. You may withdraw your consent at any time (section Your rights).
5. Musician agreement and publication on YouTube
Before your first upload, the app shows you a short agreement, in four points to tick:
- the audio and video you send are assigned to Lapiloop for editing and distribution;
- the final video may be published publicly, including on YouTube;
- your name is mentioned in the credits, with no royalties;
- a take you don’t send is never transmitted.
We keep the version of the agreement, the date and the account that accepted it. If the agreement changes, we ask for your consent again before any new upload. The full text of the agreement is shown in the app.
YouTube. Published videos show your image, your voice and your name in the credits. YouTube is a Google service, subject to its own rules. On lapiloop.com, the YouTube player is in “no-cookie” mode (youtube-nocookie.com) and only loads when you click on a video.
Public profile. Your musician profile on lapiloop.com is off by default. You choose, field by field, what is shown, and you can remove it at any time. Only your name always appears in the credits of the videos you took part in. Your individual takes are never visible to other musicians.
6. Waitlist
If you sign up, we keep your email, your platform (iPhone, Android or web), your instrument if you provide it, and proof of your consent. A confirmation email is sent to you: without confirmation, we do not write to you. The purpose is single: one notice at launch. Every email contains a one-click unsubscribe link.
6 bis. Band proposals
If your band proposes a song for a Lapiloop remix (“Bands” page), we collect: the band and contact person names, email, phone number, city and country if you provide them, your listening links (Bandcamp, YouTube, etc.), the song title and link, your message, and your two declarations (you own or represent the rights to the song; you agree to be contacted again). The purpose is to answer you and prepare a remix agreement. Only Vincent sees this information, and he answers every band himself; the phone number is never shown on the site. Your IP address is not kept with the request.
If a remix agreement is accepted, the proof we keep is: the version of the agreement, the SHA-256 fingerprint of its text, the date, the truncated IP address, the browser used (user agent) and the full name typed. Nothing is published without a signed agreement.
7. Contact form
Your name, email and message are sent to us by email (sent through the Gmail API of Codeshop’s Google Workspace). They are not stored on the website and are used only to answer you.
8. Cookies and audience measurement
lapiloop.com uses no audience measurement tool, no advertising pixel and no non-essential cookie. That is why the website shows no cookie banner. If this ever changes, nothing will be loaded before your consent and refusing will be as easy as accepting.
- Web app: a strictly necessary session cookie keeps you signed in (api.lapiloop.com). It is used for no other purpose.
- Language: a strictly necessary cookie (lapiloop_langue) remembers the language chosen with the FR | EN switcher, for one year. It is used for no other purpose.
- Cloudflare Turnstile: loaded only when you start filling in a form, to block bots.
- YouTube: loaded only when you click on a video, in no-cookie mode.
- Fonts: hosted by lapiloop.com, with no call to Google Fonts.
9. Hosting and sharing
Your information is disclosed only to the providers needed for the service, bound by contract and only for the purposes described here.
| Provider | Role | Location |
|---|---|---|
| Codeshop (server) | API, database, uploaded takes, profiles, agreement, waitlist | Quebec, Canada |
| Cloudflare | Hosting of the lapiloop.com website and the web app (Workers); technical logs; DNS, encrypted tunnel to the server, abuse protection, Turnstile, relay for data@lapiloop.com | Global network |
| Sign in with Google, sending emails (Gmail), publishing videos (YouTube) | United States and global network |
Some of these providers process information outside Quebec. Before doing so, we assessed the privacy factors (sensitivity of the information, purposes, protection measures, applicable legal framework) and chose providers that offer adequate protection. Takes, profiles and the agreement are stored on Codeshop’s server in Quebec; they travel through Cloudflare’s encrypted tunnel.
10. Retention
| Information | Period |
|---|---|
| Account and profile | As long as the account exists; erased within 30 days after the account is deleted |
| Uploaded takes not selected | Up to 12 months after the song closes, or until the account is deleted |
| Takes selected for a published video | As long as the video is online (production files) |
| Proof of acceptance of the agreement | Life of the account, then 3 years (proof of the rights assigned) |
| Waitlist | Until the launch notice or unsubscription; proof of consent 3 years |
| Contact form messages | 730 days after the last exchange |
| Technical logs | 30 days |
At the end of these periods, the information is destroyed or irreversibly anonymized.
11. Security and incidents
Encrypted connections (HTTPS) everywhere, server access restricted and protected by Cloudflare Access, application accounts with minimal rights, regular backups. Only the people who need it to run Lapiloop have access to the information.
In the event of a confidentiality incident that presents a risk of serious injury, we promptly notify the Commission d’accès à l’information (CAI) and the people concerned, we take measures to reduce the risk, and we record the incident in a register.
12. Your rights
- Access: know what information we hold about you and get a copy of it.
- Correction: have inaccurate, incomplete or ambiguous information corrected. Most of it can be changed directly in your profile.
- Portability: receive your information in a structured, commonly used technological format.
- Withdrawal of consent: turn off your public profile, unsubscribe from the waitlist (link in every email), or stop sending takes.
- Account deletion: in the app (Profile, then “Delete my account”) or by writing to data@lapiloop.com. Your account, your profile and your unused takes are erased. Videos already published are not re-edited; on request, we remove your profile and your name from the lapiloop.com archives.
- De-indexing: ask that information about you stop being disseminated.
To exercise a right, write to data@lapiloop.com from the address linked to your account. We answer within 30 days at most. If you are not satisfied, you may file a complaint with the Commission d’accès à l’information du Québec (1 888 528-7741).
13. Delete your account and data
You can delete your account and your data yourself, at any time, on the page app.lapiloop.com/compte/donnees (sign-in required). What is erased and the time frames are described in the sections Retention and Your rights.
No longer have access to your account? Write to data@lapiloop.com: we check that the request really comes from you, then we delete the account for you.
14. Minors
Lapiloop is intended for people aged 14 and over. We do not knowingly collect information about a child under 14 without the consent of the person having parental authority. If we learn that such an account exists, we delete it. A parent can write to us at data@lapiloop.com.
15. Changes
We may change this policy. The effective date at the top of the page changes with each change. If a change affects how your information is used, we notify you in the app before it applies, and we ask for your consent again when the law requires it.