This Privacy Policy explains how Artistic Alchemy ("we," "us," "our") collects, uses, and protects information when you use our platform, including your own account data and the data of fans or contacts you interact with through the Service.
Account Information. Name, email address, password (stored as an irreversible cryptographic hash, never in plain text), stage/artist name, home city and state, bio, and profile photo.
Business Data You Provide. Contact records (venues, sponsors, promoters) including names, emails, phone numbers, and notes you add; show and booking details; deal terms; uploaded media including photos and video/audio recordings.
Fan and Audience Data. Email addresses (and, optionally, names) submitted by visitors to your public artist site through our fan-capture form. This data is collected on your behalf, for your use in sending broadcast communications to your own audience — it is never merged with, or made available to, any other user's account, and we do not use it for our own marketing purposes.
Booking Inquiries. Information submitted by visitors through your public site's booking/inquiry form (name, email, message content).
Usage Data. Standard technical information such as IP address, browser type, and interaction logs, collected automatically for security, debugging, and service-improvement purposes.
We use the information above to: operate and provide the Service; authenticate your account; deliver features you use (AI content generation, Lead Scout, broadcasts, your public site); process payments once billing is enabled; send you service-related communications (including trial and dormant-account notices); and maintain the security and integrity of the Service.
We do not sell your personal information, or your fans' personal information, to third parties. We do not use your data to serve you advertising, and we do not display third-party advertising within the Service.
We share information only as follows:
Service Providers. We use the following third-party providers to operate the Service, each of which processes limited data solely to perform their function for us: Anthropic — receives content you submit for AI-assisted generation in order to generate that content; Google — receives search terms (city, category) you submit through Lead Scout in order to return venue and business results; Resend — receives fan/contact email addresses and message content in order to deliver the emails you send; OpusClip / Whisper — if you choose to connect your own API key for these services, raw video or audio you submit is sent to that provider for processing, under your own agreement with them; Stripe — once billing is enabled, receives payment information necessary to process your subscription; we do not store full card numbers ourselves.
Legal Requirements. We may disclose information if required by law, subpoena, or to protect the rights, property, or safety of the Company, our users, or the public.
Business Transfers. If the Company is acquired or merges with another company, your information may be transferred as part of that transaction, subject to this Policy or a successor policy of which you will be notified.
Data is stored using Cloudflare's D1 (database) and R2 (file storage) infrastructure. We take reasonable technical and organizational measures to protect your information, including encrypted password storage and access controls. No system is completely secure, and we cannot guarantee absolute security.
Retention. We retain your account data for as long as your account exists, including through any dormant period, so that your business history is preserved if you choose to return. The one exception is raw, unprocessed video recordings, which are deleted ninety (90) days after an account becomes dormant, as described in our Terms of Service. You may request deletion of your account and associated data at any time, subject to Section 7 below.
If you use our Service to collect fan email addresses or send broadcasts, you are responsible for ensuring your own compliance with applicable marketing laws (such as CAN-SPAM and, where applicable, similar international requirements) with respect to your communications to your fans, including honoring unsubscribe requests, which our broadcast tool supports automatically.
[Architectural note for counsel: for fan/audience data specifically, the more legally accurate structure under GDPR is likely that the artist is the data controller (deciding to collect their fans' emails for their own marketing) and Artistic Alchemy is the data processor (providing the tool on the artist's behalf) — similar to how Mailchimp is a processor for its users' mailing lists. If confirmed, GDPR Article 28 requires a separate Data Processing Agreement between Artistic Alchemy and each artist-user — a distinct legal document from this Policy, not yet drafted.]
All Users. You may access, correct, or request deletion of your account information at any time by contacting us at [privacy email], or via in-app account settings where available.
California Residents. Under the California Consumer Privacy Act (CCPA/CPRA), California residents have the right to: know what personal information we collect and how it's used; request deletion of personal information we hold about you; correct inaccurate personal information; opt out of the "sale" or "sharing" of personal information (we do not sell or share personal information as those terms are defined by the CCPA, so no opt-out mechanism is required, but we disclose this affirmatively); and non-discrimination for exercising these rights. To exercise these rights, contact [privacy email]. We will verify your identity before fulfilling a request.
EU/UK/EEA Residents. If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the GDPR (or UK GDPR) including the right to: access your personal data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to processing; data portability; and lodge a complaint with your local supervisory authority.
Our legal basis for processing is: performance of a contract (account data, necessary to provide the Service you signed up for); legitimate interest (security, fraud prevention, service improvement); and, where applicable, consent (fan/audience data collected via opt-in capture forms).
Where personal data is transferred outside the EEA/UK (including to our infrastructure and service providers based in the United States), we rely on [Standard Contractual Clauses / the sub-processor's own certified transfer mechanism — confirm which applies with Cloudflare's and Anthropic's current data processing terms, as these can change].
[Two items requiring direct confirmation, not determinable without counsel: (1) whether an EU representative must be appointed under GDPR Article 27, depending on the scale/nature of EU processing; (2) the DPA structure noted in Section 6 above, if fan-data processing is confirmed as controller/processor between Artistic Alchemy and its artist-users.]
[Insert specifics once finalized — e.g. "We use Cloudflare Web Analytics, which does not use cookies or track individuals across sites," or equivalent, matching whatever analytics tool is actually in use, if any.]
The Service is not directed to individuals under 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have done so, we will delete that information promptly.
We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-app notice before they take effect.
Questions about this Privacy Policy may be directed to [privacy/support email address].