Privacy Policy

This Privacy Policy explains how Artist Sonar ("we", "us", the "Service") collects, uses and protects personal data when you use the Service. We process personal data in accordance with the revised Swiss Federal Act on Data Protection (FADP/nDSG) and, where the Service is offered to users in the European Union, the EU General Data Protection Regulation (GDPR).

1. Controller

The controller responsible for data processing on this Service is:

As the controller is based in Switzerland, our EU/EEA representative under Art. 27 GDPR has not been designated; enquiries from EU users can be directed to the contact address above.

2. What data we process

Account data

When you create an account we process your email address, a hashed password (or the identifier returned by a social login provider), and your producer profile details (display name and any social/platform links you choose to add). Authentication and session management are handled by Better Auth.

Subscription and payment data

Subscriptions are processed by our payment provider, Polar. We store your subscription status and a customer identifier. Card and billing details are entered on the provider's hosted checkout and are handled by them — we do not receive or store full payment-card numbers.

Content and connected-service data

The Service lets you save artists, contacts, collections, beat packages and templates. When you connect a third-party account, we store the access/refresh tokens needed to use that integration on your behalf and the data you choose to move through it, for example:

• Apple Music, Last.fm — artist search, metadata, similarity and listener/play statistics.
• Dropbox — beat-package folders and files stored in your own Dropbox, plus shared links we generate at your request.
• Google / Gmail — when connected, tokens with the gmail.send scope so outreach emails are sent from your own address, and your connected account name/email.
• PayPal — when connected, OAuth tokens, your PayPal email/payer ID and cached transaction data used to show your revenue statistics.

Technical data

Like most online services, our hosting and infrastructure providers may process technical data such as your IP address, browser type and access timestamps in server logs for security and operation of the Service.

Error monitoring (Sentry)

To detect and fix technical errors we use the error-monitoring service Sentry, provided by Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. Our Sentry project is hosted in Sentry's EU region (Germany). When an error occurs in your browser or on our servers, an error report is sent to Sentry containing the error message and stack trace, the affected page URL, browser and operating system type, the app version, and a short log of preceding technical events (e.g. page navigations and requests made by the app). For errors that occur on our servers while you are signed in, the report includes only your internal, pseudonymous user ID.

We use Sentry for error reports only. We do not use Sentry's Session Replay (no recording of your screen, clicks or inputs) or performance tracing, and Sentry sets no cookies. We configure Sentry not to store IP addresses, and we strip cookies, request contents, authentication headers and access tokens from reports before they are sent. Email addresses and connected-account data are removed from reports as well.

3. Cookies

We use strictly necessary cookies to keep you signed in and to secure authentication (session and CSRF-state cookies, some set as httpOnly). We do not use advertising cookies. We do not use third-party analytics or cross-site tracking. Our error monitoring (Sentry, see above) sets no cookies and does not record sessions.

4. Purposes and legal bases

• Providing the Service (account, features, connected integrations) — performance of a contract (Art. 6(1)(b) GDPR; Art. 31 FADP).
• Processing subscriptions and payments — performance of a contract and compliance with legal obligations.
• Security, abuse prevention and operating our servers — our legitimate interests (Art. 6(1)(f) GDPR).
• Error monitoring and fixing technical problems (Sentry) — our legitimate interest in a stable and secure Service (Art. 6(1)(f) GDPR).
• Sending outreach emails on your behalf — carried out by you as the user; we act to enable the function you initiate.

5. Sharing and processors

We do not sell your personal data. We share data only with service providers ("processors") who help us run the Service, and only as needed: Better Auth (authentication), Polar (payments/subscriptions), Sentry (error monitoring; data hosted in the EU, Germany), Dropbox, Google, PayPal, Apple and Last.fm (the integrations you connect), and our hosting/database provider. Some of these providers are located outside Switzerland and the EU/EEA; where data is transferred abroad, it is safeguarded by appropriate mechanisms such as the EU Standard Contractual Clauses and equivalent Swiss provisions. For Sentry, possible access from the USA is covered by Sentry's Data Processing Addendum including the Standard Contractual Clauses and by the EU-U.S. and Swiss-U.S. Data Privacy Framework.

6. Retention

We keep account and content data for as long as your account exists. Deleting connected integrations removes the stored tokens. If you close your account, we delete or anonymise your personal data unless we are required to retain certain records (for example, for accounting or legal obligations). Note that within the app, saved artists are soft-deleted at the per-user level while the shared, non-personal music metadata is retained. Error reports in Sentry are deleted automatically after at most 90 days.

7. Your rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data;
• request restriction of, or object to, certain processing;
• receive your data in a portable format;
• withdraw any consent you have given, with effect for the future.

To exercise these rights, contact us at info@artistsonar.com. You also have the right to lodge a complaint with a supervisory authority — in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, your local data protection authority.

8. Data security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, including encrypted transport (HTTPS) and hashed passwords. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

9. Children

The Service is not directed at children and is intended for users who are at least 16 years old (or the age required to enter into a contract in their jurisdiction).

10. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available on this page, with the "Last updated" date at the top. Material changes will be communicated where required by law.

11. Contact

For any questions about this Privacy Policy or your personal data, contact us at info@artistsonar.com. See also our Impressum and Legal / Terms.