Privacy Policy

Account information. When you sign up, we collect the email address, password (stored as a one-way hash), display name, and role you choose. For vendor accounts we also collect an organization domain or a no-domain attestation. For provider accounts we collect a self-attested annual revenue tier (which sets your subscription cost).

Payment information. Subscription and transaction payments are processed by Stripe. Vinylaunch does not store your card number, expiration date, or CVV — Stripe holds those directly under PCI-DSS-compliant infrastructure. Vinylaunch receives only the identifiers Stripe issues (customer ID, subscription ID, payment intent ID) and the amount of each transaction.

Profile and content you create. Anything you publish on the platform — campaign details, profile biography, uploaded media, reviews you write, comments you make, band-lineup credits — is content you control. Public profiles are public; private profiles default to private until you opt in.

Usage data. We log basic request data (URL, response status, timestamp, user agent, IP address) for operational and security purposes — debugging issues, detecting abuse, rate-limiting endpoints. We do not run third-party analytics, ad-network pixels, or behavioral profiling.

Sensitive identity data. If we ever collect EIN, SSN, or other sensitive identity information (e.g. for Stripe Connect onboarding or 1099 generation), it is encrypted at rest and accessible only to a service-role-authenticated server process. It is never displayed in admin interfaces without an explicit unlock action, and never exported to third parties outside the specific compliance context that required its collection.

Automated content moderation. Images and other visual content you upload to the platform — including profile photos, campaign cover art, and (when Phase 4 ships) any video content — are scanned by an automated content moderation service before publication to detect policy-violating content (CSAM indicators, explicit material, violence, weapons, hate symbols, drugs). The scanning service receives the image only for the duration of the scan and is not authorized to use uploaded images for any purpose other than returning a moderation decision to Vinylaunch. See § 3 for the specific processor used. The moderation decision (approved, rejected, flagged for human review) and confidence scores are logged alongside your account for audit and appeal purposes.

We use the information you provide to operate the platform — running your account, processing payments, delivering email notifications you’ve opted into, calculating royalty distributions, generating tax forms required by law, and fulfilling the specific features you use (campaigns, bidding, streaming, profile pages, etc.).

We use aggregated usage data to debug problems, identify abuse, and prioritize product improvements. We do not build behavioral profiles, sell aggregated data, or share it with advertisers.

Your city and state, only if you ask us to. Fans can turn on “Show me what’s happening in my city/state.” It is off unless you switch it on, and it lets us use the city on your profile — the one you chose, never your device — to decide what to put in front of you: shows near you, campaigns from artists in your area, and promos an artist has paid to reach their own market.

This does not give anyone your data. We do the matching ourselves. An artist buys “a thousand plays in Sacramento” and learns only that their promo ran there — never who heard it, never that you exist, and never a list they could export. That is the same way genre targeting already works, and the promise above still holds in full: nothing is sold, and nothing is shared with an advertiser. Turning this off stops it everywhere, immediately.

A separate setting decides what artists you support learn about you. The two are deliberately independent: saying no to one has never been a reason to assume the other. What that setting can and cannot do is spelled out next.

Hearting, favoriting or backing an artist never puts you on a mailing list. We think it would be presumptuous to hand over your name or your email address because you liked a song. So there are two separate paths, and only one of them involves your contact details.

If you heart or back an artist — they see that someone supports them, in what way, and since when. If you have turned on “City and state only,” they also see which city and state, so they can tell where their support actually is and where it might be worth playing. They never see your name or your email, and there is no setting that changes that. In their download you are an anonymous supporter, and the code that used to look up an address for that file has been removed rather than switched off.

If you join an artist’s contact list — which you do from that artist’s profile, on purpose, one artist at a time — you share your email address with that artist and nobody else, along with as much of your name as you choose: your full name, your first name only, or no name at all. You can see every list you have joined in one place, and leave any of them whenever you like.

Leaving removes you from every future download. It cannot reach into a file an artist has already saved to their own computer — that is true of any mailing list anywhere, and we would rather say so than imply a recall we cannot perform.

Vinylaunch uses the following third-party services as data processors. Each holds only the data needed to perform a specific function and is contractually bound by its own privacy and security commitments.

• •Stripe — payment processing. Holds card and payout details.
• •Supabase — database, authentication, and file storage infrastructure.
• •Resend — outbound transactional email (account confirmations, notifications).
• •Cloudflare — DNS, email routing, and CDN-level protection.
• •Mapbox — venue autocomplete on tour campaigns (queries leave the platform with the search string only; no user identifier attached).
• •Amazon Web Services (Rekognition) — automated content moderation on uploaded images. Receives the image only for the duration of a single scan and returns a moderation decision (approved, rejected, flagged for review). AWS's contractual terms do not permit the use of customer-submitted content to train AWS models.
• •Vercel — application hosting and serverless function execution.

We do not use Google Analytics, Facebook Pixel, Mixpanel, Segment, or any other third-party tracking, advertising, or behavioral analytics service.

Vinylaunch uses cookies only for functional purposes — keeping you signed in, remembering your operating context (for vendor team members), and any future feature that fundamentally requires a cookie to work. We do not set tracking cookies, advertising cookies, or third-party cookies.

When an artist shares an Instagram, TikTok, or Facebook post, we show it as a link rather than playing it inside our page. That is a deliberate choice, not a missing feature.

An embedded post is a live connection to that company’s servers, opened automatically the moment the page loads — before you tap anything. It hands them your IP address, your browser and device details, and the exact page you were viewing, and it can read cookies they have already set. Blocking third-party cookies reduces how precisely you can be identified, but it does not stop the connection: the request itself is the disclosure. There is no setting that lets us show you their video without telling them you watched it.

So we don’t. A link sends them nothing at all until you decide to tap it, and when you do, we strip the referrer so they don’t even learn which page you came from. The trade is one extra tap. We think that is the right trade, and we would rather explain it than let you think we absently forgot to offer this functionality. Yes, it does impact the fluidity between us and these widely used social platforms, but it’s a decision centered around your privacy and our desire to not feed other corporations’ data brokering schemes.

The same reasoning shapes the players we do host inline: YouTube runs in its privacy-enhanced no-cookie mode, and Vimeo runs with Do Not Track enabled.

Other users of the platform. Your public profile (and anything you publish to it) is visible to other users in the way you configured it. Private vendor profiles stay private until you opt in.

Stripe. Payment-relevant information flows to Stripe so transactions can settle. For Stripe Connect (when activated), your tax-ID information passes to Stripe for 1099 generation as required by law.

Legal compliance. We disclose information when required by valid legal process (subpoena, court order, statute). We do not voluntarily share user data with law enforcement and we resist over-broad requests.

We do not sell or rent your data. Not to advertisers, not to data brokers, not to anyone. This commitment is structural — Vinylaunch operates as a sole-owner LLC with no investors pressuring revenue diversification through data monetization.

You can access most of your data through your dashboard. You can edit your profile, delete content you’ve uploaded, and cancel your subscription at any time (we are month-to-month for every role).

You can request a full data export or account deletion by emailing info@vinylaunch.com. We aim to respond within 7 business days.

California residents (CCPA / CPRA). Vinylaunch LLC is a California limited liability company. If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the right to know what personal information we collect about you and how we use it; the right to request deletion of your personal information (subject to legally required retention); the right to correct inaccurate personal information we hold about you; the right to opt out of the “sale” or “sharing” of your personal information (we do not sell or share personal information for cross-context behavioral advertising, but you have this right regardless); and the right not to be discriminated against for exercising any of these rights. To exercise any of them, email info@vinylaunch.com with “California Privacy Request” in the subject line.

Outside California. If you live elsewhere you may have analogous rights under your local privacy law (for example, GDPR in the EU, the UK GDPR, or other state-level laws in the U.S.). We honor valid requests under those regimes regardless of where you live.

Account data is retained while your account is active. When you delete your account we delete your account profile, content, and direct identifiers.

Financial and ledger records (transactions, royalty distributions, tax forms) are retained as long as required by applicable financial and tax law. These records may be retained in pseudonymized form (linked by Stripe customer ID rather than by direct account identifiers) after account deletion.

Subscription pauses preserve account data for up to 18 months per the subscription pause policy described in our Terms of Service.

Vinylaunch uses Row-Level Security at the database layer so every table enforces owner-only or appropriately-scoped access on every read and write. Sensitive identity data is encrypted at rest with keys held only by the application server. Payment data is held by Stripe under PCI-DSS infrastructure. Email-confirmation flows use single-use tokens with limited validity.

No system is perfectly secure. If a breach affecting your data occurs, we will notify affected users in accordance with applicable breach-notification laws (typically within 72 hours of confirmation).

Vinylaunch is a U.S.-based LLC and primarily processes data in the United States. If you access the platform from outside the U.S., your data will be transferred to and processed in the U.S. By using the platform, you consent to that transfer.

The platform is not directed at children under 13, and we do not knowingly collect personal information from children under 13. Account creation requires age 13 or older. Paid features (subscriptions, crowdfunding pledges, direct artist support) require age 18 or older or, where applicable, parental consent under your local law.

If we discover an account belongs to someone under 13, we delete it.

We may update this policy from time to time. When material changes happen we will notify active users by email and post a notice on the platform. The current effective date is at the top of this page. Continued use of the platform after a change takes effect constitutes acceptance of the new policy.

Privacy questions: info@vinylaunch.com
Copyright / DMCA: dmca@vinylaunch.com (or see our DMCA policy)