Privacy policy

Artist Office is a service for independent musicians. This page says what we collect, from where, why, how long we keep it, and how to delete it.

What we collect

• Your account: email address and stage name, plus either a password (stored hashed by our authentication provider) or, if you choose "Continue with Google", your Google account id, name and email address as Google returns them. Google sign-in asks only for your basic profile and email.
• What you tell us: your profile questionnaire, links to your material, the facts you confirm, notes to desks and chat messages.
• From Meta (Instagram and your Facebook Page), when you connect it: your account and media details, post and account insights, follower demographics, comments on your posts, posts you are tagged in, public hashtag media and public professional-account numbers you look up, and, if you choose an ad account, ad spend and campaign results.
• From Google (YouTube), when you connect it: your channel details, video list and statistics, YouTube Analytics reports, and comments on your videos.
• From Klaviyo, if you add a read-only key: the names and subscriber counts of your lists. We never read individual profiles.
• Spotify for Artists CSV files you upload.
• Email: messages we send on your approval, and replies sent to your office's reply address.

Why

Only to run your office: to show you your own figures, find opportunities, draft messages and posts for your approval, and do exactly what you approve. Nothing is sent, posted, replied to or created without your approval of the exact text.

Google user data

Artist Office's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request YouTube read, analytics, upload and comment scopes. We use YouTube data only to show you your channel's figures, read comments on your videos, post the replies you approve, and upload the videos you approve (as private by default). We do not sell Google user data, use it for advertising, or let people read it except where you ask us to or the law requires it. Text from your Google data may be sent to our AI provider (Anthropic) to prepare drafts and summaries for you; it is not used to train models.

Processors

Supabase (database, authentication, file storage), Google Cloud (the server that runs the app, in the United States), Anthropic (AI model calls), Resend (email). Each processes data only to provide its service to us. One session cookie keeps you signed in.

Security

Access tokens and API keys are encrypted (AES-256-GCM) before they are stored and are never shown to your browser. Each customer's rows are isolated by row-level security.

Retention

• Approval requests: deleted 14 days after they are closed (rejected, expired or executed).
• Action log: 30 days.
• Desk notes: 14 days after a desk has read them.
• Deleted items are first copied to an archive, which is kept until you ask us to delete your account.

Deletion

Disconnect any platform on the Connections page at any time; this deletes its stored tokens. To delete your account and all your data, email the address in the Terms. For Meta data, see Data deletion.