Privacy Policy
Last updated 15 October 2026
This Privacy Policy explains how StagePanel handles personal data when you visit stagepanel.app, create an account, use the dashboard, visit an artist page or release page we host, or contact us. We write it for three groups of people: artists (account holders and the people they invite), fans (visitors of artist pages who may leave an email address) and website visitors.
We process personal data in accordance with Regulation (EU) 2016/679 (the "GDPR"), the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, and the Belgian Electronic Communications Act as regards cookies.
1. Who is responsible
The controller for the processing described in this policy is Bucky (eenmanszaak), trading as BuiltByBucky, Nieuwstraat 194/1, 3590 Diepenbeek, Belgium, enterprise number BE0766978604 ("StagePanel", "we"). We have not appointed a data protection officer because the law does not require one for our activities; privacy questions go through the contact form and are answered by the owner.
For email addresses that fans leave on an artist's release page, the artist is the controller and we are their processor. Section 10 explains this.
2. What data we collect
| Who | Data | Source |
|---|---|---|
| Artists (account) | Name, email address, hashed password, newsletter preference, time of last activity, the artists you manage and your role in them, dashboard settings. | You, when you register and use the dashboard. |
| Artists (profile and content) | Artist name, slug, biography, photos, colours, social and streaming profile URLs, events, release data (titles, artwork, release dates, ISRCs, platform links), audio previews, Twitch login and the access tokens needed to run your Twitch commands. | You, and the Spotify, Twitch, MusicFetch and Soundcharts APIs on your instruction. |
| Artists (billing) | Plan, subscription status and dates, Stripe customer and subscription identifiers, coupon redemptions, country and VAT number if you supply one. Card numbers are entered on Stripe's pages and never reach our servers. | You and Stripe. |
| Fans (notifications) | Email address, the release you want to hear about, time of sign-up and time the notification was sent. | You, on the release page. |
| Fans (download gates) | If the artist protects a download with a gate: email address (if the artist asks for it), which gate steps you completed, a keyed hash of your IP address (not the address itself), kept for 90 days, your browser's user agent, and anonymous event counts (country, device type). If a step asks you to follow or subscribe on Spotify, SoundCloud or YouTube, you log in on that platform and authorise us once; the access token is used once to perform that step. It passes through our cache for at most 2 minutes, sealed, and is then kept encrypted in your browser session for at most an hour and dropped when you unlock the file. We do not ask for or keep a refresh token for gate steps, and the token is never stored in our database. See Google and YouTube data and Spotify pre-save for the exception. | You, on the gate page, and the platform you authorise. |
| Fans (Spotify pre-save) | If an artist offers a pre-save and you choose it: your Spotify user ID, an OAuth refresh token (stored encrypted) that lets us add the track to your Spotify library on release day, whether you ticked "Follow the artist", the kind of device you used (phone, tablet or computer), and the time the track was saved or the save failed. We do not read your library, playlists or listening history. | You and Spotify, when you authorise us on the release page. |
| Fans (Apple Music pre-save) | If an artist offers a pre-save and you choose it: a Music User Token (stored encrypted) that lets us add the track to your Apple Music library on release day, a hash of that token to avoid duplicates, your Apple Music storefront (country), and the time the track was saved or the save failed. Apple does not give us your name, email address or Apple ID, and we do not read your library, playlists or listening history. | You and Apple, when you authorise us on the release page. |
| Artists (sign-up source and invites) | The campaign parameters (utm_source, utm_medium, utm_campaign, utm_content) of the link that brought you to registration, such as a "Powered by StagePanel" footer or an invite link; the referral code of the artist who invited you; and a salted hash of your IP address, used to detect self-referrals and abuse. |
The link you followed and your browser, automatically. |
| Visitors of release pages and smart links | Technical data on each page view and each click on a platform button: IP address, country (and city when our network provider supplies it), device type, operating system, browser family, referring page, time, and the platform clicked. | Your browser, automatically. |
| Everyone who contacts us | Name, email address and the content of your message. | You, in the contact form or by email. |
| All visitors | Server logs (IP address, URL, time, status, user agent), error reports, and, subject to your consent, analytics and marketing identifiers set by cookies (section 4). | Your browser, automatically. |
We do not deliberately collect special categories of data (health, religion, political opinions, etc.) and ask you not to put them in biographies or messages.
3. Why we use it and on what legal basis
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| Creating and securing your account, logging you in, running the dashboard, building and publishing your artist and release pages, syncing with Spotify and other platforms, sending the release notifications you trigger, running your Twitch commands. | Performance of our contract with you (art. 6(1)(b)). |
| Billing, invoicing, collecting payments, preventing fraud and chargebacks, keeping accounting records. | Contract (art. 6(1)(b)) and legal obligations under Belgian tax and accounting law (art. 6(1)(c)). |
| Service emails: welcome, trial ending, payment failed, security notices, changes to these terms. | Contract (art. 6(1)(b)) and our legitimate interest in informing customers (art. 6(1)(f)). |
| Newsletter about new features and tips. | Your consent (art. 6(1)(a)), given by ticking the newsletter box. Withdraw it any time via the unsubscribe link or in your settings. |
| Showing artists how their release pages perform: visits and platform clicks by country, device and referrer. | Our legitimate interest, and that of the artist, in measuring the pages we publish (art. 6(1)(f)). We only show aggregated figures to artists; IP addresses are used for de-duplication and abuse detection and are not shown. |
| Download gates: letting an artist offer a file in exchange for steps (email address, follow, subscribe), counting unlocks. For a YouTube step, the Google scope is used only to subscribe you to the artist's channel (section 5, Google and YouTube data). | Your request to unlock the file (art. 6(1)(b)) and, for the email address the artist receives, the artist's own legal basis (section 10). News from the artist, only if you tick the box and confirm by email: your consent (art. 6(1)(a)), which you withdraw with the unsubscribe link in any of their emails. |
| Spotify pre-save: adding the track to your Spotify library on release day and, if you agreed, following the artist; showing the artist how many fans pre-saved. | Your consent (art. 6(1)(a)), given by clicking "Pre-save on Spotify" and authorising on Spotify. Withdraw it any time by removing StagePanel under Apps in your Spotify account settings; we then cannot save the track and the refresh token stops working. |
| Apple Music pre-save: adding the track to your Apple Music library on release day; showing the artist how many fans pre-saved. | Your consent (art. 6(1)(a)), given by clicking "Pre-save on Apple Music" and authorising with Apple. Withdraw it any time by removing StagePanel's access in your Apple Music account settings; we then cannot save the track and the token stops working. |
| Measuring which links bring in artists (sign-up source) and running the invite programme, including checking IP hashes to prevent abuse of the rewards. | Our legitimate interest in understanding our marketing and preventing fraud (art. 6(1)(f)). |
| Radio, chart and streaming insights for the Insights plan. | Contract (art. 6(1)(b)). This concerns the artist's catalogue, not fans. |
| Keeping the Service secure and available: server logs, rate limiting, error monitoring, backups. | Our legitimate interest in running a secure service (art. 6(1)(f)). |
| Audience measurement and advertising measurement with Google Tag Manager / Google Analytics and the Meta pixel. | Your consent (art. 6(1)(a) and art. 10/2 of the Belgian Electronic Communications Act), asked through the cookie banner. No tags are loaded until you agree, and we also honour the browser signals Do Not Track and Global Privacy Control. |
| Answering your questions and requests, including data subject requests. | Our legitimate interest in responding to you (art. 6(1)(f)), or a legal obligation for GDPR requests (art. 6(1)(c)). |
| Enforcing our Terms, defending legal claims. | Legitimate interest (art. 6(1)(f)). |
Where we rely on legitimate interest we have weighed it against your interests and rights and concluded that the processing is limited, expected and does not override them. You can object at any time (section 8). We do not make automated decisions with legal or similarly significant effects about you.
4. Cookies, analytics and marketing tags
Strictly necessary
We set a session cookie and an XSRF token to keep you logged in and protect forms, and a "remember me"
cookie if you ask for it. These do not need consent and expire when you log out or after two hours of
inactivity (the remember cookie after five years or when you log out).
The sp_consent cookie remembers your cookie choice for 12 months and is also strictly
necessary.
Analytics and marketing (consent)
- Google Tag Manager / Google Analytics (Google Ireland Ltd): measures visits to our landing page and dashboard. Cookies
_ga,_ga_*, lifetime up to 13 months. - Meta pixel (Meta Platforms Ireland Ltd): measures sign-ups that follow our Facebook or Instagram ads and lets us show relevant ads. Cookie
_fbp, lifetime 3 months.
These tags are only loaded on our landing page, our comparison pages and the dashboard, only after you accept them in the cookie banner, and never when your browser sends Do Not Track or Global Privacy Control. They are never loaded on artist sites, release pages, download gates or the pages linked from fan emails. You can change your choice at any time through the "Cookie settings" link in the footer of those pages or by clearing your browser's cookies. An artist site only shows a cookie banner when the artist uses their own tracking pixels (see below); that choice is asked and stored separately for each artist site.
Embedded players
Release pages and artist pages can embed a Spotify player. It stays a plain button until you tap it; only then does your browser contact Spotify, which may set its own cookies under its own privacy policy.
5. Who receives your data (sub-processors)
We do not sell personal data. We share it with the providers below, who process it on our behalf under data processing agreements, and with authorities when the law requires it.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH (servers managed with Coolify) | Hosting of the application and database, and part of the server backups | Germany (EU) |
| Amazon Web Services EMEA SARL (Amazon S3) | Storage of download gate files, track previews and encrypted database backups | Sweden, eu-north-1 Stockholm (EU) |
| Cloudflare, Inc. | CDN and proxy in front of the website: every request passes Cloudflare, which sees the visitor's IP address, the requested page and the visitor's country, and filters attacks | Edge servers worldwide; USA-based company, under the EU-US Data Privacy Framework |
| Stripe Payments Europe Ltd / Stripe Inc. | Payment processing, invoices, subscription management, fraud prevention | Ireland; USA under the EU-US Data Privacy Framework |
| Brevo (Sendinblue SAS) | Sending transactional emails, fan confirmation and release emails, and the newsletter; newsletter contact list | France (EU) |
| Spotify AB | Reading your artist catalogue through the Spotify Web API; Spotify login for download gate steps and pre-saves (adding a track to a fan's library on release day, and following the artist if the fan agreed), only when a fan chooses to connect | Sweden (EU); Spotify's own policy applies to data it holds |
| Apple Distribution International Ltd. | Apple Music sign-in and adding a track to a fan's library on release day (pre-saves), only when a fan chooses to connect | Ireland (EU); Apple's own policy applies to data it holds |
| Soundcharts SAS | Radio airplay, chart and streaming data for the Insights plan (artist catalogue data only) | France (EU) |
| MusicFetch | Looking up links to your releases on streaming platforms (track titles and ISRCs only) | USA under standard contractual clauses |
| Twitch Interactive Inc. (Amazon) | Twitch login and chat bot, only if you connect Twitch | USA under the EU-US Data Privacy Framework |
| GlitchTip (self-hosted by us) | Error monitoring; reports contain the request URL, user id and technical context, never passwords. We run it ourselves, no third party receives these reports | Our own server in Germany (EU) |
| Laravel Nightwatch (Laravel Holdings Inc.) | Performance monitoring: request, query and job timings, with the request URL and technical context, a sample of requests only | USA, under standard contractual clauses |
| OpenAI Ireland Ltd / OpenAI, L.L.C. | Only when an artist uses the AI bio feature: the artist's name and public bio text from Beatport or SoundCloud are sent to write a draft bio. No fan data and no account data is sent | USA, under standard contractual clauses |
| Google Ireland Ltd | YouTube login for download gate steps, only when a fan chooses to connect | Ireland; USA under the EU-US Data Privacy Framework |
| SoundCloud Global Limited & Co. KG | SoundCloud login for download gate steps, only when a fan chooses to connect | Germany (EU) |
| Google Ireland Ltd | Tag Manager and Analytics, subject to consent | Ireland; USA under the EU-US Data Privacy Framework |
| Meta Platforms Ireland Ltd | Meta pixel, subject to consent | Ireland; USA under the EU-US Data Privacy Framework |
Google and YouTube data
If an artist adds a YouTube subscribe step to a download gate, you can sign in with Google on the gate page. We
request one scope, https://www.googleapis.com/auth/youtube ("Manage your YouTube account"). It is used
for one thing: to subscribe you to the artist's YouTube channel, when you click the button, with a single call to
the YouTube Data API (subscriptions.insert). We do not read your channel, subscriptions, videos,
playlists, comments, email address or profile, we do not create or change anything else, and we do not store
anything the API returns. We request online access only, so Google gives us no refresh token. The access token is kept
encrypted in your browser session, for at most an hour, and discarded when you unlock the file. We do not store
it in our database, and the artist never receives it or any other data from your Google account. You can revoke
access at any time at myaccount.google.com/permissions
and cancel the subscription on YouTube.
StagePanel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use this information only to provide the subscribe step you asked for, we do not transfer it to others, we do not use it for advertising, and no human reads it.
We update this list when providers change. Artists are informed of new sub-processors handling fan data as described in section 9 of the Terms of Service.
6. Transfers outside the EEA
Our servers, database, files and backups are in the European Union. Some providers listed above are established in the United States or may access data from there: Cloudflare (which handles every website request at an edge server near the visitor, so IP addresses can be processed outside the EU), OpenAI (AI bio text) and Nightwatch (performance monitoring). For those transfers we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on the Commission's standard contractual clauses (Decision 2021/914) together with additional safeguards such as encryption in transit. You can ask us for a copy of the relevant clauses through the contact form.
7. How long we keep data
- Account and artist data: for as long as your account exists. You can delete an artist, or your whole account with every artist only you manage, yourself under Settings in the dashboard: it is deleted straight away (an artist with many tracks within minutes). A deletion you ask us for through the contact form is done within 30 days. Data we must keep for the periods below is the exception.
- Address of a deleted artist: the artist's address on StagePanel is held for 30 days after the artist is deleted, so nobody else can take over its links, then it is released.
- Invoices and payment records: 7 years after the end of the financial year, as required by Belgian accounting and VAT law.
- Fan notification emails: until you unsubscribe, the artist removes you from their fan list, the artist asks us to delete them, or the artist or the artist's account is deleted (section 10).
- Unconfirmed fan sign-ups: if a fan never confirms their email address, the sign-up is deleted automatically after 30 days.
- Proof of fan confirmation: when a fan confirms their email address we keep the time, the version of the notice shown and a keyed hash of the IP address as proof of consent. The IP hash is deleted after 13 months; the rest stays with the sign-up.
- Release page visits and clicks: raw records including the IP address are kept for at most 13 months, after which only aggregated statistics remain.
- Download gate unlocks: the IP hash and user agent are deleted 90 days after the unlock. The email address stays with the gate until the artist deletes the gate or track, or the artist's account is deleted.
- Spotify pre-saves: the refresh token is deleted as soon as the track has been saved on release day, or when the save fails for good. Until then, it is kept only to perform that save. Afterwards the row (Spotify user ID, follow choice, saved or failed time) stays as the artist's pre-save count until the artist deletes the track or the artist's account is deleted. You can ask us to delete it sooner (section 8).
- Apple Music pre-saves: the Music User Token is deleted as soon as the track has been saved on release day, or when the save fails for good (at the latest a month after the release). Afterwards the row (token hash, storefront, saved or failed time) stays as the artist's pre-save count until the artist deletes the track or the artist's account is deleted. You can ask us to delete it sooner (section 8).
- Referral records and IP hashes: the referral record is kept as long as the accounts concerned exist; the IP hashes on it and on the account are deleted after 90 days.
- Contact messages: 2 years after our last exchange, unless needed longer for a legal claim.
- Failed and stuck email jobs: a queued email that failed to send, or never ran, is deleted after 30 days; it holds the recipient address until then.
- Server logs and error reports: 90 days.
- Newsletter list: until you unsubscribe or 3 years after your last interaction.
- Backups: data you or we erase can stay in our encrypted backups for up to 12 months (daily backups roll off after 30 days, monthly snapshots after 12 months) and is then gone. We do not restore backups except to recover from a disaster. If we ever do, we first re-apply every erasure made since that backup, using a record that holds only a coded fingerprint of your address or account, never the address itself, kept for the same 12 months.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy; you can download your account and artist data yourself under Settings in the dashboard (Download my data);
- rectify inaccurate or incomplete data (most account data you can edit yourself in the dashboard);
- erase your data ("right to be forgotten") where there is no overriding reason to keep it; you can delete your account yourself under Settings in the dashboard;
- restrict processing in the situations set out in article 18 GDPR;
- data portability: receive the data you provided to us in a structured, machine-readable format (the same download: JSON and CSV files in a ZIP);
- object to processing based on legitimate interest, and object at any time to direct marketing;
- withdraw consent at any time, without affecting processing before withdrawal (newsletter unsubscribe link, cookie settings, newsletter box in your settings);
- lodge a complaint with a supervisory authority.
To exercise a right, use the contact form from the email address linked to your account, or write to the address in section 1. We answer within one month; for complex requests we may extend by two months and will tell you why. We may ask you to confirm your identity. Requests are free unless they are manifestly unfounded or excessive.
The competent supervisory authority in Belgium is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, +32 2 274 48 00, [email protected], gegevensbeschermingsautoriteit.be. You may also complain to the authority of the EU country where you live or work.
9. Security
We protect personal data with measures appropriate to the risk: TLS encryption for every connection, passwords hashed with bcrypt, role-based access to the dashboard and admin area, separation between artists so one artist cannot see another's data, security headers, rate limiting on public forms, regular off-site backups, logging and error monitoring, and least-privilege access for the people who operate the Service. No system is perfectly secure; if a breach is likely to put your rights at risk, we will inform you and the Data Protection Authority as the GDPR requires.
10. Fans: artists as controllers
When you leave your email address on a release page to be notified about a release, you give it to the artist whose page you are on. The artist decides to collect it and uses it to email you on release day; StagePanel stores the address and sends that email on the artist's behalf as a processor, under the data processing terms in section 9 of our Terms of Service. We do not add fans to our own newsletter or use their addresses for anything else.
On some download gates the email step also has an unticked box, "Send me news from the artist". If you tick it, we email you a confirmation link, and only after you confirm can the artist email you news; we record that you ticked it, the wording version and when. Without the tick, the address is used only for the download.
We only send that email after you confirm your address through the link we email you when you sign up, and we keep a record of that confirmation (section 7). Sign-ups from before 14 October 2026 were made before this confirmation existed; they are marked as having no confirmation record. Every release email has an unsubscribe link: one click, no login, and your address is deleted from that artist's list straight away. You can also ask the artist to remove you, which they can do themselves from their fan list in the dashboard, or ask us through the contact form to delete your address at any time; we remove it within 30 days and inform the artist.
To remove your address from every artist's notify list and download unlocks in one go, use Delete my email: we email you a confirmation link, and confirming deletes the address everywhere and stops all email to it. Pre-save rows contain no email address, so they cannot be found this way; ask us through the contact form to delete those.
The technical data about visits and clicks on release pages (section 2) is collected by StagePanel as controller to provide artists with aggregated statistics. Artists never see individual IP addresses.
11. Children
The Service is intended for people aged 16 and over. We do not knowingly collect personal data from younger children. If you believe a child has given us data, contact us and we will delete it.
12. Changes to this policy
We may update this policy when our processing, providers or the law change. The current version is always published at stagepanel.app/privacy with its date. For material changes that affect account holders we send an email before they take effect.
13. Contact
Privacy questions and requests: use the contact form or write to Bucky, Nieuwstraat 194/1, 3590 Diepenbeek, Belgium.