Legal

PRIVACY POLICY.

What we collect, why we collect it and the control you keep. Your music, your fans and your earnings data stay yours — we never sell them.

Last updated · 5 September 2026

Overview

ARTISTBREAD is a growth workspace for independent artists. Running it means handling personal data: artist accounts, fan accounts, catalog information, audience figures, support payments and verification documents. This policy explains what we collect, why we collect it, who we share it with, how long we keep it and what control you have.

We do not sell personal data. We do not sell your fan list. We do not use your music or artwork to advertise other artists without your permission.

For your ARTISTBREAD account, we are the data controller. When you use your workspace to collect and market to your own fans and mailing-list subscribers, you are the controller of that relationship and we act as your processor for the tools we provide.

Information we collect from artists

Most of what we hold comes directly from you as you set up and run your workspace.

Account details: name, artist name, handle, email address, password (stored only as a secure hash), account type and plan.
Profile and public page content: bio, avatar and cover images, links, page template choice, section visibility settings, booking email and phone number, and any custom domain you connect.
Catalog and release data: titles, release dates, release types, artwork, streaming and store links, and smart-link destinations, including details retrieved from a Spotify or Apple Music link you provide.
Verification data: photo identity documents, identity numbers, profile links and the outcome of automated and human review.
Earnings data: tips, product sales, membership subscriptions, amounts, currency, payment status and payout records.
Communications: contact form messages, support conversations and correspondence with our team.

Information we collect from fans

Fans can browse public artist pages without an account. When a fan creates a fan account, follows an artist, joins a mailing list or supports an artist, we collect the details needed to make that work.

Fan account details: name, email address, password hash and account preferences.
Follows, supports and activity: which artists a fan follows, tips and purchases made, membership status and support history.
Mailing-list sign-ups: name and email address, shared with the artist whose page the fan signed up on so that artist can contact them.
Payment records: the amount, currency, status and reference for a payment. Card and bank details are entered with our payment provider and are never stored by ARTISTBREAD.

Information collected automatically

When you or your visitors use ARTISTBREAD, we record technical and usage information needed to run, secure and measure the service: IP address, device and browser type, approximate location derived from IP, pages and features used, referring links, smart-link clicks and public page visits, timestamps and error diagnostics.

Analytics figures shown in your workspace — clicks, visits, audience trends — are aggregated from this activity. We use essential cookies and similar storage to keep you signed in and to keep the workspace working, plus limited analytics storage to measure performance.

Why we use your data, and our legal bases

We only use personal data where we have a lawful basis to do so.

To provide the service (performance of a contract): creating your account, running your workspace, publishing your public page, generating smart links, processing payments and delivering support.
To verify artists and prevent fraud (legal obligation and legitimate interests): reviewing identity documents, screening for impersonation, chargeback abuse and money laundering.
To improve and secure the platform (legitimate interests): diagnosing errors, measuring feature usage, protecting accounts and preventing abuse.
To generate AI guidance you request (performance of a contract): sending relevant workspace information to our AI provider so Zoe can return your next move.
To send service messages (performance of a contract) and product or marketing emails (consent, which you can withdraw at any time).
To meet legal, tax and accounting duties (legal obligation): keeping records of payments, invoices and verification decisions.

Verification documents and sensitive data

Identity documents are collected only to verify that an artist is real before earning tools are unlocked. They are stored in restricted storage, are not shown on your public page, and are accessible only to the small number of people who need them for review, fraud investigation or legal compliance.

Documents may be analysed by an automated AI review step that checks whether a document appears authentic and matches the account details provided. That analysis assists a human decision; it is never the only basis for refusing verification, and you can ask us to explain a decision or review it again.

We keep verification records for as long as your account uses earning tools and, after that, for the period required by anti-fraud and financial record-keeping obligations, then delete them.

What becomes public

Your public artist page is designed to be found. Your artist name, handle, bio, images, links, visible catalog, memberships, products and any booking email or phone number you add are publicly accessible once published, and may be indexed by search engines or shared on social platforms.

You control this from your profile settings: you can hide sections such as music, community, memberships and products, remove booking details, or unpublish your page. Note that content already indexed or cached by third parties may take time to disappear from their systems.

International transfers

ARTISTBREAD works with providers based in the United Kingdom, the European Economic Area and the United States, which means your data may be processed outside your country. Where data leaves the UK or EEA, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses, together with technical measures like encryption in transit.

How long we keep data

We keep personal data only as long as we need it for the purposes described here. Account, profile and catalog data are kept while your account is active. Payment and tax records are kept for the periods required by law, typically six to seven years. Verification records are kept for the anti-fraud and compliance period, then deleted. Technical logs are kept for a short period for security and troubleshooting.

When you delete your account, we remove or anonymise your personal data within a reasonable period, except where we must retain specific records by law or to resolve an open dispute, refund or chargeback. Backups are rotated and purged on a defined schedule.

How we protect data

We use encryption in transit, hashed passwords, row-level database access rules that restrict records to the account they belong to, role-separated administrative access, restricted storage for sensitive uploads, and monitoring for suspicious activity.

No system is perfectly secure. If a breach affects your personal data and creates a risk to you, we will notify you and the relevant regulator as required by law. Protecting your account also depends on you: use a strong unique password and tell us straight away if something looks wrong.

Your rights

Depending on where you live, you have rights over your personal data. To exercise any of them, contact us through the contact page; we will respond within one month and may ask you to confirm your identity first.

Access a copy of the personal data we hold about you.
Correct data that is inaccurate or incomplete, including your profile and catalog details.
Delete your account and personal data, subject to records we must legally keep.
Export your data, including your fan email list as a CSV file from your workspace.
Object to or restrict processing based on our legitimate interests.
Withdraw consent to marketing at any time, using the unsubscribe link or your settings.
Complain to your data protection authority — in the UK, the Information Commissioner's Office.

If you are an artist using fan data

Fan emails and community details collected through your ARTISTBREAD page are yours to use for a direct relationship with your audience — and that makes you responsible for handling them lawfully.

Only contact people who chose to hear from you, identify yourself clearly as the sender, honour unsubscribe and deletion requests promptly, keep exported lists secure, and never sell or rent your fan data. If a fan asks you to delete their details, do it, and let us know if you need help.

Children

ARTISTBREAD is not intended for children under 16, and earning tools are limited to adults. We do not knowingly collect data from children under 16. If you believe a child has created an account, contact us and we will remove it.

Changes to this policy

As we add features, this policy will be updated. We will change the date at the top of this page and, where a change materially affects how we use your data, tell you in the app or by email before it takes effect.

Contact us about privacy

For any privacy question, data request or concern about how your information has been handled, reach us through our contact page and mark your message for the privacy team.