Privacy Policy

This Privacy Policy applies to our music social networking platform (the "Service"). We act as the Data Controller for all personal data processed through the Service.

As a Data Controller, we are registered under the UK Data Protection Act 2018 and comply with the UK General Data Protection Regulation (UK GDPR). We have appointed a Data Protection Officer (DPO) who can be contacted through the details in Section 14.

Our lawful bases for processing your data are: (a) contract performance - to provide the Service you signed up for; (b) legitimate interests - to operate and improve the platform; (c) consent - for optional features such as location sharing and non-essential cookies; and (d) legal obligation - when required by law.

We are committed to data minimisation. We do not collect:

• Financial or payment card information
• Health or biometric data
• Government ID numbers beyond what is necessary for artist verification
• Your contacts, calendar, or other device data
• Precise GPS location without your explicit, per-request consent
• Data from children under 13 - if we become aware a user is under 13, we will delete their account

We use your personal data only for the purposes described below and will not repurpose it without notifying you and, where required, obtaining fresh consent.

• To create and manage your account and profile
• To deliver and personalise the core Service features (feed, fandoms, messaging)
• To verify artist accounts and prevent impersonation
• To send transactional emails: email verification, password reset, and important account notices
• To detect, investigate, and prevent abuse, fraud, and security incidents
• To comply with legal obligations including law enforcement requests made in accordance with UK law
• To improve the platform through anonymised or aggregated analytics (only with your consent)

We do not use your data for automated decision-making or profiling that has legal or similarly significant effects on you.

The following information is visible to all users of the platform, including unauthenticated visitors:

• Your username and display name
• Your profile photo and biography
• Posts, comments, and reactions you make
• Fandoms you have created
• Social media links you choose to add
• Your verified artist status (if applicable)
• Approximate location of a post, if you explicitly tagged it

The following information is never publicly exposed:

• Your email address
• Your phone number
• Precise GPS coordinates of posts (exact coordinates are never returned to other users in API responses)
• Your private messages
• Your password or any authentication tokens
• Your IP address
• Artist verification documents

Location features are entirely optional. We obtain your explicit consent before accessing location in any form.

• Post tagging: if you tag a post with a location, the approximate area (not precise coordinates) is displayed to other users. Precise coordinates are stored server-side only for the Near Me distance calculation and are never returned to other clients.
• Near Me: your location is used only for the current session to filter posts within your chosen radius. It is not stored beyond the request.
• IP fallback: a city-level estimate from your IP address may be used as a fallback for Near Me - this is not stored beyond the request.

You can revoke location permission at any time through your browser settings. Previously tagged posts can be deleted from your profile.

We retain your personal data only for as long as necessary for the purposes described in this policy, or as required by law.

• Account data: retained for the duration of your account plus 30 days after deletion to allow recovery
• Posts and comments: deleted immediately when you delete them; copies may remain in backups for up to 90 days
• Messages: retained until you or the other participant deletes the conversation
• Security logs (IP, login timestamps): retained for up to 12 months for fraud and security purposes
• Artist verification documents: retained for up to 2 years after verification decision, then securely destroyed
• Email and server logs: retained for up to 30 days
• Backups: retained for up to 90 days in encrypted form

As a data subject under UK GDPR and the Data Protection Act 2018, you have the following rights:

• Right of access: you can request a copy of all personal data we hold about you (available via Settings > Export my data)
• Right to rectification: you can correct inaccurate data at any time through your profile settings
• Right to erasure ('right to be forgotten'): you can request deletion of your account and all associated data through Settings > Delete account
• Right to restriction: you can request that we restrict processing of your data in certain circumstances
• Right to data portability: you can download your data in a machine-readable format via Settings > Export my data
• Right to object: you can object to processing based on legitimate interests
• Rights related to automated decision-making: we do not use your data for solely automated decisions with significant effects
• Right to withdraw consent: where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us via the details in Section 14. We will respond within one calendar month as required by UK GDPR. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Our Service is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13.

If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us immediately. We will take steps to delete such data promptly.

Users between the ages of 13 and 17 may use the Service with parental consent. We encourage parents to monitor their children's online activity.

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.

• Passwords are hashed using a strong cryptographic algorithm (Argon2) - we never store plain-text passwords
• All data in transit is protected with TLS encryption
• Database access is restricted to authorised server-side code only
• Authentication tokens are signed and time-limited
• Admin access is separately controlled and logged
• Regular security reviews and dependency audits

Despite our best efforts, no security measure is perfect. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the ICO within 72 hours as required by UK GDPR.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will:

• Update the Last updated date at the top of this page
• Display a prominent notice within the platform
• Send an email notification to your registered email address

Your continued use of the platform after changes take effect constitutes acceptance of the revised policy. If you do not agree to the updated policy, you must stop using the Service and may request account deletion.

For all privacy-related enquiries, rights requests, or complaints, please contact us through the platform's support system or the email address on our website.

You can also contact our Data Protection Officer (DPO) directly via the same channels, clearly marking your message as 'For the attention of the DPO'.

We aim to respond to all requests within 30 days. For complex requests, we may extend this period by a further two months, in which case we will inform you within the first 30 days.

If you are not satisfied with our response, or believe we are processing your data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• ICO website: ico.org.uk
• ICO helpline: 0303 123 1113
• ICO postal address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We primarily store and process your data within the UK and European Economic Area (EEA). Where we use third-party service providers located outside the UK/EEA, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the UK ICO
• Adequacy decisions recognising equivalent data protection standards
• Binding Corporate Rules where applicable

A list of the countries where our processors operate is available on request.