Privacy Policy

This policy explains what Artist CNTRL ("the Service", "we", "us") collects, why, who we share it with, and the choices you have. It covers the Artist CNTRL web app at artistcntrl.app, the Artist CNTRL iOS app, and the public pages bands publish through us (link-in-bio pages, smart links, press kits and venue advance pages).

1. Information we collect

Information you give us. Your name, email address, password (stored only as a one-way hash), phone number, profile photo, and the profile details you choose to add, such as travel details (for example a Known Traveler number or loyalty programs) and emergency contacts. When you apply for an account we collect what you put on the application. Bands and their teams also add the information that runs the band: shows, tours, travel, releases, tasks, contacts, messages, files, photos and money figures such as deals, expenses and settlements.

Information from accounts you connect. When you connect a third-party account we receive the data described in sections 6 to 11. You choose which accounts to connect, and you can disconnect them at any time.

Information collected automatically. Sign-in and security records (when you signed in, the device and app version, and whether you used a passkey or a one-time code), and, if you allow push notifications, a device token so we can deliver them. We do not use advertising or third-party analytics trackers, and we do not track you across other apps or websites.

Public music and social statistics. To show a band its audience and streaming numbers we obtain publicly available statistics about the artist (for example streams, listeners, followers and chart positions) from data providers such as Songstats and Chartmetric, using the artist's public identifiers.

2. How we use information

• To provide the Service: run your band's dashboard, schedule, releases, messaging, tasks and settlements, and show you your analytics.
• To review applications and create accounts.
• To send the emails and push notifications you have not switched off (Settings, Account, Communication preferences), plus the messages we must always send, such as sign-in codes, password resets and invites.
• To process subscription payments.
• To keep the Service secure, prevent abuse and fix problems.

We do not sell your personal information, and we do not use it for advertising or to build profiles about you unrelated to the Service. We do not use your data, or data from any connected account, to train machine-learning models.

3. Who can see your information

Artist CNTRL is a shared workspace. The people you work with in the Service (your band, its crew, and the management, label or booking companies the band works with) can see what they need to do their jobs: your name, photo and role, and, depending on their role, your contact details and the schedule and money information they are allowed to see. Friend bands can see a band's public profile. Anything a band chooses to publish (its link-in-bio page, smart links, press kit and venue advance pages) is visible to anyone with the link.

4. Service providers

We share information with companies that help us run the Service, only as needed to provide it:

• Amazon Web Services: hosting and file storage (United States).
• Stripe: subscription payments. Your card details go to Stripe and are never stored by us.
• Postmark: sending email.
• Apple: delivering push notifications and Live Activities to iOS devices.
• Google: place search and address lookup for venues and hotels (Google Maps Platform), and the Gemini AI service described in section 5.
• Cloudflare: bot protection on the application form (Turnstile).
• Songstats and Chartmetric: public music and social statistics, as described in section 1.

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a merger or sale of the business, in which case this policy continues to apply.

5. AI features

Some features send content to Google's Gemini AI service to be read on your behalf, only when you ask:

• Travel import: a screenshot or file of a flight or hotel confirmation you upload is read to fill in the travel details.
• Post analysis ("Get the Data"): for a post on your band's own account, the video (Instagram and Facebook) or the cover image and caption (TikTok), together with its statistics, are analysed to produce feedback on the post.

We use a paid Gemini service under which Google does not use this content to train its models. The analysis result is kept for a few hours and then discarded; the uploaded travel document is not kept by the AI service.

6. Facebook and Instagram (Meta) data

When you connect a Meta account you sign in with Facebook Login and choose a Facebook Page you manage (and, if linked, its Instagram professional account). We request only the permissions needed for the features you use:

• pages_show_list, to list the Pages you manage so you can choose one.
• pages_read_engagement, to read the selected Page's posts and their engagement.
• read_insights, to read the Page's insights (reach, views, follows).
• instagram_basic, to read the linked Instagram account's profile and posts.
• instagram_manage_insights, to read that Instagram account's insights, including follower locations.
• ads_read, to show your ad accounts, campaigns, spend and performance.
• ads_management, to create campaigns, change budgets and pause or resume ads, only when you take those actions in Artist CNTRL.

We store, encrypted, the access tokens Meta issues us, the connected Page and Instagram account IDs and names, and cached posts, metrics and ad performance so your dashboard loads quickly. We do not post to your Page or Instagram account and we do not change or delete your content. When you use post analysis, the post's video is sent to Gemini as described in section 5. We do not sell or transfer Meta data to third parties.

Meta data is kept only while the account is connected. You can disconnect in Settings, Connections, or remove Artist CNTRL in your Facebook Business Integrations settings. When you remove the app, Meta tells us through our deauthorize and data-deletion callbacks and we delete your stored Meta tokens and the data we hold from that connection.

7. TikTok data

When you connect TikTok we use TikTok Login Kit and the Display API with these scopes:

• user.info.basic, to show your TikTok name and avatar and confirm the right account is connected.
• user.info.stats, to show your follower and like counts.
• video.list, to read your own published videos and their view, like, comment and share counts.

We store your TikTok account ID, display name, avatar, follower and like counts, encrypted access and refresh tokens, and cached video details (title, ID, counts, publish time and cover image). We do not download, re-post, edit or delete your TikTok content. When you use post analysis on a TikTok video, its cover image, caption and statistics are sent to Gemini as described in section 5. We do not sell or transfer TikTok data to third parties.

TikTok data is kept only while your account is connected. You can disconnect in Settings, Connections, or at tiktok.com under Settings, Manage app permissions. When you disconnect we delete your tokens and cached TikTok data.

8. Google Calendar

You can connect your personal Google account from Settings, Account. We request only the https://www.googleapis.com/auth/calendar.app.created scope, which lets us create one calendar named "Artist CNTRL" in your Google account and manage the events in it. We use it only to add, update and remove the shows, travel days, days off and opportunities you are part of. We cannot read your other calendars or events.

We store, encrypted, the tokens Google issues us and a record of the events we created so we can update or remove them. We do not share Google data with third parties, use it for advertising, or use it to train AI models. Artist CNTRL's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time in Settings, Account, which deletes the stored tokens, or revoke access at myaccount.google.com/permissions.

9. YouTube

When a band adds its YouTube channel, we use YouTube API Services to read the channel's public statistics and videos and show them in the band's dashboard. By adding a channel you agree to the YouTube Terms of Service, and Google's handling of that data is covered by the Google Privacy Policy. We store the channel ID and cached statistics, and delete them when the channel is removed in Settings, Connections. If you have granted Artist CNTRL access to your Google account, you can also revoke it at security.google.com/settings/security/permissions.

10. Spotify

When a band connects Spotify we sign in with Spotify using the user-read-private scope, only to confirm the account, and record which Spotify artist the band is. We use Spotify's public catalogue to show the band's releases, tracks and artwork. Streaming statistics come from the data providers named in section 1.

11. Merch stores (Shopify, Square and Fourthwall)

When you connect a store we request read-only access: on Shopify read_orders, read_all_orders and read_products; on Square ORDERS_READ, ITEMS_READ, INVENTORY_READ and MERCHANT_PROFILE_READ; and read access to orders and products on Fourthwall. We never create, change or delete anything in your store.

We read your products and order-level sales figures (totals, line items, currency, dates and sales channel) to show your merch sales, attribute sales to your shows, and let you feature products on your link-in-bio page. We do not import your customers' names, email addresses, phone numbers or addresses, and we do not build a customer list from your store. We store your store's address and, encrypted, the tokens the store issues us. We do not sell or transfer store data to third parties.

Store data is kept only while the store is connected; disconnecting in Settings, Connections deletes the tokens. We honour Shopify's privacy webhooks, including requests to remove a customer's data or a store's data. If you subscribe to Artist CNTRL through Shopify, Shopify handles that billing.

12. Fan data collected by bands

Bands can collect fan sign-ups (for example from a merch-table QR code or their public sign-up page) and email those fans through the Service. For that fan data the band decides what is collected and how it is used, and we process it on the band's behalf. Every fan email includes an unsubscribe link, and a fan who unsubscribes is not emailed again. Fans can contact the band, or us, to have their data removed.

13. Cookies

We use only cookies needed to run the Service: your sign-in session, a trusted-device cookie if you choose to trust a device when signing in, and small preferences such as the last band or artist you viewed. We do not use advertising or analytics cookies.

14. Data security

Data is encrypted in transit, and access tokens for connected accounts are encrypted at rest. Each band's and company's data is kept separate at the database level, so one customer cannot read another's data. No system is perfectly secure, but we work to protect your information and will notify you as required by law if a breach affects it.

15. Data retention

We keep your information while your account is active. Data from a connected account is deleted when you disconnect it. Show chats expire on a schedule after the show; direct and group messages are kept until the account or conversation is removed. When an account is deleted we remove its personal data within 30 days, except where we must keep records by law (for example billing records).

16. Account and data deletion

To delete your Artist CNTRL account and its personal data, email support@cntrlglobal.com from the address on your account with the subject "Delete my Artist CNTRL account." We will confirm and permanently delete your account, profile, connected-account tokens and personal data within 30 days. Information that also belongs to the band or company you worked with (for example a show you were on) stays with that band, without your personal details. Deletion cannot be undone.

17. Your rights

You can see and correct most of your information in the app. Depending on where you live (for example in California, the European Union or the United Kingdom) you may also have the right to request a copy of your data, have it corrected or deleted, restrict or object to how we use it, or receive it in a portable format. We do not sell or share personal information for cross-context behavioural advertising. To make a request, email support@cntrlglobal.com. We will not treat you differently for exercising these rights. If you are in the EU or UK you may also complain to your data protection authority.

Our data is stored in the United States. If you use the Service from outside the United States, your information is transferred there.

18. Children

The Service is not intended for children under 13 (or under 16 in the EU and UK), and we do not knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.

19. Changes to this policy

We may update this policy. If we make a significant change we will tell you by email or in the app before it takes effect. The date at the top shows when it last changed.

20. Contact us

Questions or requests: support@cntrlglobal.com.