01What We Collect
- Account data: email address, display name, and hashed password (stored by Supabase Auth).
- Billing data: payment method and subscription status, handled by Stripe. We never store raw card details.
- Gate analytics: anonymised IP hashes, user-agent strings, and event counts (visits, downloads, social actions).
- Fan contacts: email addresses and phone numbers entered by fans on your gates or update pages. These are stored on your behalf and associated with your artist account.
02How We Use It
We use collected data to operate the Service, process payments, show you analytics, and communicate account information. We do not sell your data or fan data to third parties.
03Subprocessors and Service Providers
We use the following providers to run Unlockd. The information shared depends on the features you use and the services enabled for those features. Contact us for questions about a provider or a data-processing agreement.
- Netlify: website hosting and request processing, including network and browser information needed to deliver pages.
- Supabase: account authentication, database hosting, and file storage for profiles, releases, and fan contacts.
- Stripe: payment processing and subscription management. See Stripe's Privacy Policy.
- Brevo / Twilio SendGrid: delivery of account messages and email campaigns, including recipient addresses, message contents, and delivery status. The configured email provider handles each message.
- Twilio: text-message delivery and phone verification, including phone numbers, message contents, and delivery status.
- Cloudflare Turnstile: bot protection for public forms, using browser and request signals to assess whether a submission is legitimate.
- Sentry: error monitoring when enabled, including diagnostic events and technical context used to investigate failures.
- Upstash: shared rate limiting when enabled, including request counters and identifiers used to limit abuse.
04Connected Music Platforms
SoundCloud, Spotify, and YouTube integrations use the permissions you authorize to connect accounts or verify fan actions. Some connections, including Spotify pre-saves and Future Save, retain authorization credentials so a requested action can happen later. You can revoke an integration through the connected platform. External listening links and embeds are also subject to that platform's privacy practices.
05Fan Data Responsibility
When fans submit their email addresses through your gates, you (the artist) are the data controller for that information. You are responsible for obtaining any necessary consent and complying with applicable privacy laws when using those emails for marketing purposes.
06Data Retention
Account and gate data is retained for as long as your account is active. You may delete individual gates or your entire account at any time. Account deletion removes live records and uploaded files immediately; encrypted backup copies expire within 30 days.
08Your Rights
Depending on your location you may have rights to access, correct, or delete your personal data. To exercise these rights, email team@unlockd.app.
09Changes to This Policy
We may update this policy from time to time. We'll notify you of material changes by email or a notice in the dashboard.
10Contact
Questions? Email us at team@unlockd.app.