Privacy policy
Last updated: 29 July 2026
1. Who processes the data
The data controller is , , SIRET 99208420200017. For any question or request about your data: .
Given the size of the business and the nature of the processing, appointing a data protection officer is not mandatory. None has been appointed.
2. What is recorded, and why
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| User accounts | name, email, hashed password, role, last sign-in date | opening and securing access to the tool | legitimate interest (art. 6(1)(f)) |
| Creators and editors | handle, profile link, platform, PayPal identifier, usual rate, notes | organising placements and paying for services | performance of a contract or pre-contractual steps (art. 6(1)(b)) |
| Clients | company name, contact name, email, postal address, company number, VAT number | issuing invoices and tracking payment | performance of a contract (art. 6(1)(b)) and legal obligation (art. 6(1)(c)) |
| Campaigns and invoicing | titles, artists, links to published content, amounts, deadlines, payment status | tracking campaigns and keeping the accounts | legal obligation (art. 6(1)(c)) |
| Rights holders and royalties | name, email, payout method, share percentages, amounts due and paid | splitting revenue and paying the people entitled to it | performance of a contract (art. 6(1)(b)) |
| Signed agreements | name typed at signature, date and time, IP address of the signatory | proving that each party agreed to the terms shown to them | performance of a contract (art. 6(1)(b)) and legitimate interest in holding proof (art. 6(1)(f)) |
| Demo submissions | artist name, email, track title, link, genre, message; Discord username when sent through the bot | receiving and reviewing tracks sent to the label | pre-contractual steps taken at the request of the person (art. 6(1)(b)) |
| Smart link statistics | page views and clicks per platform, counted in aggregate | knowing which platforms a release is opened on | legitimate interest (art. 6(1)(f)) |
| Audit log | account identifier, nature of the action, timestamp | tracing changes, finding an error, detecting abuse | legitimate interest (art. 6(1)(f)) |
No special category data within the meaning of Article 9 of the GDPR is collected. Information comes either from the people themselves or from public profiles on the platforms concerned.
3. How long it is kept
| Invoices and accounting records | 10 years from the end of the financial year (art. L123-22 of the French Commercial Code) |
| Client and creator records | duration of the business relationship, then 3 years |
| User accounts | until access ends, then erased within 3 months |
| Signed agreements and their proof of signature | 10 years from signature, as evidence |
| Royalty statements and amounts paid | 10 years, they are accounting records |
| Demo submissions | 12 months after the decision, then erased |
| Smart link counters | aggregate figures only — no visitor is identified, nothing to erase |
| Audit log | 12 months |
| Session cookie | 7 days |
| Everything, after a subscription ends | 30 days, then the whole workspace is erased — one warning is sent 7 days before |
4. Who has access
Only people holding an account on the tool, within the limits of their role. Nothing is sold, rented out or passed on for advertising purposes.
The service is shared by several labels, each in its own workspace. Every record carries the identifier of the workspace it belongs to, and every query filters on it: one label never sees another label's artists, statements or invoices.
Some pages are opened without an account, through a link that is impossible to guess: a rights holder's earnings statement, and a party's signing link for an agreement. Each link shows only that person's data. A link can be revoked at any time from the tool, which immediately makes the old one useless.
The only technical third parties are those required to run the service : Hetzner Online GmbH, host, acting as a processor within the meaning of Article 28 of the GDPR.
5. Cookies
A single cookie is set, named session. Its only purpose is to recognise you from one page to the next once signed in. It is httpOnly, cryptographically signed, and expires after 7 days.
No trackers, no analytics, no advertising. A cookie strictly necessary for the service requested is exempt from consent, so there is no banner.
6. Security
- Passwords are hashed with bcrypt and never stored in clear text.
- Access relies on a signed session, checked server-side on every request.
- Permissions are enforced on the server, never in the browser.
- A disabled account loses access immediately, without waiting for the cookie to expire.
- The service is served over HTTPS as soon as it goes online.
7. Your rights
Under Articles 15 to 22 of the GDPR, you have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to give directions about what happens to your data after your death.
To exercise them, write to . A response is provided within one month. Proof of identity may be requested in case of reasonable doubt.
If an answer does not satisfy you, you may lodge a complaint with the French supervisory authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or cnil.fr.
8. Transfers outside the European Union
Data is hosted within the European Union. No transfer outside the EU takes place.
9. Automated decision-making
The tool makes no automated decisions and performs no profiling. Every figure it displays — budgets, totals, deadlines — is a plain sum of what has been entered.
10. Changes
This policy may change along with the service. The last-updated date at the top of the page is authoritative.