Privacy policy

This policy explains which personal data is processed when you use LabelRally – on the website, in the app and on the public pages (smart links, link-in-bio pages) that users create with LabelRally.

1. Controller

[Company name / name, legal form]
[Street and number, postcode, city, country]
E-mail: [privacy@your-domain.com]
Data protection officer: [name and contact, if legally required – otherwise remove]

2. Two roles: controller and processor

• We are the controller for your user account, billing, support requests, the security of the service and the visitors of our own website.
• We are a processor for content that you or your workspace store in LabelRally (e.g. data about artists, team members, releases, files) and for the fan e-mail list on smart links. The workspace owner (e.g. the label) is the controller for this data. Our data processing agreement applies: [link/annex DPA].

3. User account and app

• Account data: e-mail address, name, password (only as a hash at the authentication service), language, theme, optional profile photo, notification settings.
• Workspace content: artists, releases, tracks, calendar, tasks and comments (incl. @mentions), campaigns and budgets, social media planning, Content Studio designs, uploaded files, marketing plan templates, statistics.
• Logs: activity log in the workspace (who changed what), technical logs without content data.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR); for security and abuse prevention our legitimate interest (Art. 6(1)(f) GDPR).

4. E-mails

We send transactional e-mails that the service needs: account confirmation, password reset, team invitations, due-date reminders, @mention notifications, billing notices (e.g. a failed payment) and replies to support requests. You can turn off reminders and mention e-mails in your account settings. We only send product news with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

5. Billing

Paid plans are handled by Stripe. Stripe processes your name, e-mail address, billing address, VAT ID if provided and payment details; VAT is calculated from the billing address. Card numbers and bank details are processed only by Stripe and are not stored by us. We store the plan, subscription status, price, billing period and the Stripe customer ID. Legal basis: Art. 6(1)(b) and (c) GDPR (contract, statutory retention duties for tax purposes).

6. AI writing help

When you use the AI writing help, we send your input (e.g. instructions) and the release or artist details it needs (title, names, genre, date) to Anthropic (Claude API) to generate a text suggestion. We only store that and when a text was generated (for the monthly quota), not the text itself. [Check the provider's information on retention and use for training and insert it here.] The feature is only used when you actively start it. Please do not enter sensitive data about other people.

7. Streaming statistics

For YouTube statistics we request public view and subscriber counts for the video and channel links you have added via the YouTube Data API (Google). No data from your account is sent to Google. CSV files (e.g. from Spotify for Artists) are stored only in your workspace.

8. Public pages: smart links and link-in-bio

Workspaces can publish public pages for releases and artists. For visitors of these pages:

• No cookies are set and no third-party tracking services are used.
• We count page views and button clicks only as daily totals without personal reference. To prevent abuse and bots, the IP address is processed briefly and converted into a non-reversible, salted hash; this is only used to limit requests and is deleted after 2 days at the latest.
• Clicking a link takes you to the respective service (e.g. Spotify, Apple Music); their privacy policies apply there.

Legal basis: legitimate interest in secure operation and anonymous reach figures (Art. 6(1)(f) GDPR).

9. Fan e-mail list on smart links

When fans sign up for e-mail updates on a smart link, the respective workspace (e.g. the label) is the controller; its privacy policy is linked in the form. LabelRally processes the data on its behalf: e-mail address, language, time and the wording of the consent. The sign-up is confirmed via a confirmation e-mail (double opt-in). We delete unconfirmed sign-ups after 7 days and unsubscribes after 90 days. Apart from the confirmation e-mail, LabelRally itself sends nothing to these addresses; the workspace can export the confirmed addresses. Legal basis: consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time via the unsubscribe link.

10. Support requests

When you contact us via the contact form, the "Help & support" area or by e-mail, we process your e-mail address, your name if provided, topic, subject and messages to answer your request. Requests are deleted 24 months after the last activity; requests linked to a user account at the latest when the account is deleted. Legal basis: Art. 6(1)(b) GDPR (questions about the contract) or Art. 6(1)(f) GDPR (legitimate interest in answering).

11. Cookies

LabelRally only uses strictly necessary cookies:

• Sign-in session of the authentication service (only when you are signed in)
• lf_locale (language), lf_theme (light/dark), lf_ws (last opened workspace)

No analytics or marketing cookies are used. Legal basis: Section 25(2) no. 2 TDDDG and Art. 6(1)(b) or (f) GDPR. Should this change, we will ask for your consent first.

12. Recipients and processors

• [Supabase Inc.] – database, sign-in, file storage. Region: [e.g. EU (Frankfurt)]. DPA: [date]
• [Hosting provider, e.g. Vercel Inc.] – running the web application. DPA: [date]
• Stripe Payments Europe Ltd. – payment processing, invoices, tax calculation
• [Resend] – sending e-mails
• Anthropic – AI writing help (only when used, see section 6)
• Google – YouTube Data API (only public video/channel IDs, see section 7)

For transfers to third countries (in particular the USA) we rely on [adequacy decision / EU-US Data Privacy Framework / EU standard contractual clauses – check and enter per provider].

13. Retention

• Account data and workspace content: until the account or workspace is deleted.
• Trash (releases, artists): 30 days, then permanently deleted.
• Deleted workspaces: 30-day recovery period, then permanently deleted incl. files.
• Deleted files: removed from storage after 7 days.
• Fan e-mail list: unconfirmed 7 days, unsubscribed 90 days, confirmed until unsubscribe or deletion by the workspace.
• Support requests: 24 months after the last activity.
• Abuse prevention (hashed counters): 2 days at most.
• Invoice data: statutory retention periods (up to 10 years) – at Stripe.
• Backups: [insert retention of database backups at the hosting provider].

14. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and to withdraw any consent with effect for the future. You can export your data and delete your account directly in your account settings. For data a workspace is responsible for (e.g. the fan list), please contact the workspace owner; we will forward requests. You can also lodge a complaint with a data protection supervisory authority, e.g. [competent authority at the controller's registered office].

Contact: contact form or [privacy@your-domain.com].

15. Security

Transfer exclusively via HTTPS, access control at database level (row level security) with strict separation of workspaces, private file storage with time-limited download links, hashed tokens for confirmation links. Technical measures alone do not guarantee full legal compliance; organisational measures and contracts have to be checked separately.

16. Changes

We update this policy when the service or the legal situation changes. The current version is always available on this page.