Heartist Privacy Policy

Heartist is the controller of the personal data described in this policy. We build a platform where listeners meet artists, and where artists and managers run their press kit, shop and professional relationships. For any privacy question, or to use your rights, write to privacy@heartist.app.

Data you give us:

• Account: name, email address and a password (stored only as a hash). If you sign in with Google or Facebook, the provider shares your name, email address and its own identifier for you; we never see your provider password.
• Profile: avatar, short bio, location, and for creators the artist profile, press kit, music, posts, shop items and links you choose to publish.
• Purchases: orders, coins balance and transactions, delivery details for merchandise and the billing details you enter at checkout. Card and wallet payments are handled by our payment provider; we do not store full card numbers.
• Messages and creator workspace: messages between artists and managers, contacts and notes in the CRM, follow-ups, bookings and projects. This data belongs to the workspace that created it; the people in your contacts are not Heartist users and are not told that you listed them.
• What you tell us when you contact support.

Data created by using the Service:

• Activity: what you play, like, follow and save, so we can show your collection, playlists and the creators you follow.
• Security and audit records: sign-in events, failed sign-in attempts, password changes, and the IP address and browser (user agent) they came from. We use these to protect accounts and to rate-limit abuse.
• Technical data: your time zone, language and device information needed to show the page correctly.

We do not sell your personal data, and we do not use it for third-party advertising.

• To provide the Service you asked for: create your account, play music, keep your library, process orders and run creator tools (performance of a contract).
• To keep Heartist safe: prevent fraud, abuse and unauthorised access, enforce our Terms, keep audit logs (legitimate interests, and legal obligations).
• To communicate with you: confirmation and password-reset emails, receipts, security alerts and replies to your questions (contract, legitimate interests).
• To improve the Service: understand which features are used and fix problems (legitimate interests).
• To meet legal duties: tax, accounting and requests from authorities (legal obligation).
• Where we rely on your consent, you can withdraw it at any time without affecting what was done before.

• Other users, as you choose: your public profile, published content, follower counts and, for creators, the press kit and shop are visible to anyone. Your listener library and playlists are private unless you share them.
• Creators you buy from receive the details needed to fulfil your order (for example, a delivery address for merchandise).
• Service providers that work for us under contract: hosting and storage, email delivery, payment processing, error monitoring and, for sign-in, Google and Facebook.
• Authorities, when the law requires it, or to protect rights, safety and the Service.
• A buyer or successor, if Heartist is involved in a merger or sale, under the same protections.

Our providers may process data outside your country. When personal data leaves the European Economic Area or the United Kingdom, we use safeguards recognised by law, such as an adequacy decision or standard contractual clauses.

We keep account data while your account is open. After you close it we delete or anonymise it, except what we must keep longer: orders and invoices for the period required by tax law, and security and audit records for a limited period to defend against abuse and legal claims. Backups are overwritten on a regular cycle.

Depending on where you live, you can ask us to give you access to your data, correct it, delete it, restrict or object to some uses, and receive a copy in a portable format. You can change your name, bio, location and password in your profile at any time.

Write to privacy@heartist.app and we will answer within one month. If you think we handled your data unlawfully, you can complain to your data protection authority.

Passwords are hashed, sessions use HttpOnly cookies, sign-in attempts are rate-limited, and changing your password ends your other sessions. No system is perfectly secure; if something affecting your data goes wrong we will tell you as the law requires.

Heartist is not directed at children under 16. If you believe a child has given us personal data without a parent's consent, write to us and we will delete it.

We will publish updates here with a new date and, for important changes, tell you through the Service or by email.