Privacy Policy

PRIVACY POLICY

BandStream (Private Alpha Phase)

Effective as of April 14, 2026, updated on October 7, 2026 (cookie linking a promotional offer); updated on September 24, 2026 (data protection contact; end-of-trial purchase declared by our servers to Meta and Google Analytics; Umami audience measurement exempt from consent; hash of the email address sent to Google Ads and TikTok upon a purchase or a sign-up; list of cookies and local storage, rate limiting, optional telephone number and Meta event of the measurement container; on September 21, 2026: YouTube videos on release pages; on September 19, 2026: recipients, consent cookie, Meta pixel and anonymous click counting)

Article 1: Data Controller

The data controller for personal data is BandStream SAS, 60 rue François 1er, 75008 Paris, France. RCS Paris 939 221 438; SIRET 939 221 438 00012; VAT FR 81939221438. Contact: [email protected].

Article 2: Data Protection Contact

Any question regarding the processing of personal data and any request to exercise data subjects' rights should be sent to: [email protected]. This address is read by the BandStream founding team, who respond within one (1) month of receipt of the request (Article 12(3) GDPR).

BandStream has not appointed a data protection officer: such an appointment is not mandatory for its activity (Article 37 GDPR).

Article 3: Alpha Context, Specific Information

The Platform is currently in a private Alpha phase. Access is restricted to Alpha Users who have received an Invitation from BandStream. This phase involves the following specificities regarding personal data:

(a) BandStream may collect data specific to the Alpha phase, such as experience Feedback, bug reports, detailed usage data, and satisfaction survey responses, for the purpose of improving the Platform.

(b) Technical security measures may be in the process of deployment and may not reach the level of a final commercial version. BandStream nevertheless implements reasonable measures to protect the data of Alpha Users.

(c) In the event of the end of the Alpha phase, Alpha User data will be processed in accordance with article 8 (retention periods), unless the Alpha User continues their use in the commercial version.

Article 4: Personal Data Collected

4.1 Alpha User Data

Identification data: artist name or pseudonym, email address.

Optional contact details: telephone number, if the User enters it in their settings, for the commercial management of their Account.

Connection data: IP address, browser type, operating system, date and time of connection, access logs.

Subscription data: plan type, subscription and renewal dates, billing history.

Content data: profile images, biography, links, event-related information.

Payment data: collected and processed directly by Stripe, Inc. Not stored by BandStream.

Alpha-specific data: experience Feedback, bug reports, detailed usage data (navigation paths, actions performed, features used), responses to internal surveys.

4.2 Visitor Data

Aggregated and anonymized browsing data: country, traffic source, pages visited, duration. "Privacy-first" approach. For the security of the Service, the Visitor's IP address and, when they enter one in a form, their email address are also used as the key of technical rate limiting counters, which prevent automated use of forms and links; each counter covers a window of one hour at most and is normally deleted less than two hours after the last request, at the latest during the following night's purge (Article 8).

4.3 Mandatory or Optional Nature of Data

Data marked with an asterisk (*) in the forms is mandatory for Account creation and the provision of Services. If this mandatory data is not provided, BandStream will not be able to create the User's Account or provide the Services. Other data is optional, and its non-provision does not prevent use of the Platform but may limit certain features (for example, the absence of a biography or profile image on the Artist Page).

Article 5: Purposes and Legal Bases

Note: The "Ad Campaign management" purpose (Google Ads, Meta Pixel, TikTok) is based on User consent and not on the performance of the contract, in accordance with the recommendations of the CNIL regarding advertising tracking. The placement of advertising cookies and pixels is subject to prior consent obtained through the integrated consent manager.

Article 6: Recipients and Processors

6.1 BandStream's Processors

Each processor is contractually bound to comply with the GDPR. BandStream may communicate data to competent authorities upon legal request.

6.2 Advertising Platforms Activated by Users (Pro Plan)

When a Pro Plan User configures a pixel on their Artist Page, the corresponding platform receives browsing events from that page's Visitors, only after their "marketing" consent has been obtained through the integrated consent manager. For Meta, TikTok and Snapchat, when the User has provided a conversions API key, clicks to streaming platforms and to ticketing points of sale are also sent from BandStream's servers, under the same consent condition. Two exceptions, which concern Meta only, are described in Articles 10.4 (loading of the pixel script before the Visitor has answered, with no cookie and no event) and 11.5 (anonymous click counting after a refusal). These platforms act as independent data controllers (see Article 11.4).

When a release page features a music video, Google LLC (YouTube) receives the Visitor's IP address and technical browser information when the player loads, which only happens after the Visitor clicks the video and agrees to the "YouTube videos" category (see Article 10.1). Before that agreement, no data is sent to Google. YouTube acts as an independent data controller.

6.3 Tags of the Site's Measurement Container

The Site's Google Tag Manager container (GTM-N9SS822J) is loaded only when the Visitor has granted both the "analytics" category and the "marketing" category. In addition to audience measurement (Google Analytics), it contains advertising tags used to measure BandStream's campaigns: Google Ads and TikTok, as well as an event of the Site's Meta pixel ("Lead") upon sign-up to the newsletter. When the Visitor grants the "analytics" category only, this container is not loaded: Google Analytics is then loaded on its own, with advertising signals denied, and no Google Ads or TikTok tag enters the page.

Measurement of purchases and sign-ups. When a User creates their Account or subscribes to the Pro Offer, a return page, located outside the logged-in area, sends this event to the container, only once, and only if the User has granted the "analytics" and "marketing" categories. For a purchase, the event carries the transaction identifier, the amount excluding taxes, the currency, any promotional code and the plan subscribed to. So that Google Ads and TikTok can attribute the purchase or the sign-up to a BandStream advertisement, it also carries the hash of the Account's email address: the output of the SHA-256 hash function applied to the address converted to lowercase and stripped of spaces (for Google Ads, also stripped of the dots preceding @gmail.com, as Google requires). The address itself is never transmitted. This hash remains pseudonymised personal data: Google and TikTok match it against the accounts of their own users, which is precisely its purpose. Without the "marketing" consent, no hash is sent; with the "analytics" consent only, Google Analytics receives the purchase or the sign-up without any data relating to the User. The Site's Meta pixel receives the purchase and the sign-up without any address or hash. BandStream keeps neither the hash nor the transmitted event; it only keeps a record that a purchase or a sign-up has already been counted, so as not to count it twice, until the Account is deleted.

End-of-trial purchase, declared by our servers. When a User starts a free trial of the Pro Offer, the return page only sends the start of the trial, under the conditions of the previous paragraph. The purchase itself only happens at the first payment, at the end of the trial, while the User is not on the Site: it is then declared directly by BandStream's servers, only once, according to the consents the User had given at the start of the trial, which are kept with it:

• with the "marketing" consent, to Meta's Conversions API, for the Site's pixel: a purchase event carrying the invoice identifier, the amount excluding taxes, the currency and the plan, the SHA-256 hashes of the email address and of the Account identifier, and the identifiers of the Site's Meta cookies (_fbp, _fbc) read at the start of the trial. As an exception to the above, Meta therefore receives, for this purchase only, the hash of the address; the address itself is never transmitted;
• with the "analytics" consent, to the Google Analytics Measurement Protocol: a purchase event carrying the invoice identifier, the amount, the currency, any promotional code and the plan, linked to the pseudonymous identifier of the _ga cookie read at the start of the trial, without any address or hash; advertising signals are only enabled with the "marketing" consent. Google Ads receives the purchase through the import of Google Analytics events.

Without the corresponding consent, nothing is sent. BandStream erases the cookie identifiers kept for this sending as soon as the purchase is declared, or when the trial ends without payment, and in any event with the Account. Meta Platforms and Google act as independent controllers for the data they receive in this way.

A tag transmits data only when it is actually triggered; Article 6.1 describes the contents of the container and the transmissions observed on the Site, not a systematic transmission on every visit. When the Visitor withdraws a consent while these tools are already active in the page, the page is reloaded once, so that they actually stop emitting. Google LLC and TikTok act as independent data controllers for the data they collect through these tags.

Article 7: Transfers Outside the EU

Data is primarily hosted in France and within the EU. Transfers outside the EEA are governed by standard contractual clauses or the EU-U.S. Data Privacy Framework.

In accordance with the recommendations of the European Data Protection Board (EDPB) and the Schrems II ruling (CJEU, case C-311/18), BandStream has conducted a Transfer Impact Assessment (TIA) for each processor located outside the EEA. These assessments are available upon request from the data protection contact at [email protected].

Supplementary measures (end-to-end encryption, pseudonymization, access segregation) are implemented when the TIA identifies a residual risk to the rights of data subjects.

Further information: [email protected].

Article 8: Retention Periods

Upon expiration, data is deleted or irreversibly anonymized.

Article 9: Data Subject Rights

Right of access (art. 15 GDPR): obtain confirmation of processing and a copy of the data.

Right to rectification (art. 16): correction of inaccurate or incomplete data.

Right to erasure (art. 17): deletion of data, subject to legal obligations.

Right to restriction (art. 18): temporary suspension of processing.

Right to data portability (art. 20): retrieval of data in a structured and readable format.

Right to object (art. 21): objection to processing based on legitimate interest, and objection to marketing at any time.

Right relating to automated decision-making and profiling (art. 22 GDPR): the User has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them. As of the date of this policy, BandStream does not engage in any solely automated decision-making or profiling producing legal effects with respect to Users. In the event of any change, this policy will be updated to inform Users accordingly.

Withdrawal of consent: possible at any time, without retroactive effect.

Post-mortem directives (art. 85 of the French Data Protection Act): directives regarding the fate of data after death.

Requests should be sent to [email protected] with proof of identity. Response within one (1) month, extendable by two (2) months. Complaints may be filed with the CNIL (3 Place de Fontenoy, 75334 Paris Cedex 07; www.cnil.fr).

Article 10: Cookies

10.1 Types of Cookies

Strictly necessary cookies: technical operation (session, authentication, security). No consent required.

Analytical cookies (Google Analytics): audience measurement. Consent required.

Audience measurement exempt from consent (Umami, self-hosted): visit statistics for Artist Pages (page views, clicks to streaming platforms and ticketing outlets, country, traffic source, device and browser type), presented to Users in aggregated form. This measurement meets the conditions set by the CNIL for an audience measurement tool to be exempt from consent (article 82 of the French Data Protection Act):

(a) it is used solely to measure the audience of the Platform's pages and to produce anonymous statistics;

(b) Umami sets no cookies and does not track the Visitor from one site to another: each Artist Page is measured separately;

(c) the IP address is never stored: at the time of the visit, it is only used to derive the country (never a location more precise than the city) and to compute a hashed session identifier, renewed every month;

(d) before sending, the page address is stripped of its parameters, except campaign parameters (utm_*), and the referring address of its query: no advertising identifier and no token is recorded;

(e) the data is hosted on BandStream's servers within the European Union, is not combined with any other processing and is not shared with any third party;

(f) it is automatically deleted after 25 months.

This measurement therefore operates whether the Visitor accepts or refuses cookies, and does not appear in the consent manager. The Visitor can object to it at any time, in two ways: by choosing to not be counted, which places in their browser a strictly necessary cookie (bs_audience_optout, 12 months) recording their objection for all Artist Pages; or by enabling the "Do Not Track" option of their browser. Their visit is then no longer counted.

Advertising cookies of the Site: Google Ads and TikTok, loaded by BandStream's Tag Manager container, and the Meta pixel of the Site (see Article 6.1). Consent required via the integrated consent manager.

Advertising cookies (Pro Plan): Meta, Google Ads, TikTok, Snapchat and X pixels configured by the User on their Artist Page (see Article 6.2). Consent required via the integrated consent manager.

YouTube videos: on a release page that features a music video, the YouTube player (Google LLC, youtube-nocookie.com domain) is only loaded after the Visitor clicks the video and agrees to the "YouTube videos" category, asked within the video frame or through the integrated consent manager. Before that agreement, no request is sent to Google: the image shown is a copy hosted by BandStream. Once the player is loaded, YouTube may set cookies and receive the IP address and technical browser information, as an independent data controller. The choice is stored in the privacy:consent cookie and can be withdrawn at any time.

10.2 Detailed List of Cookies

Cookies marked "third-party script" are set on the visited domain by the advertising platform's script, which sets their name and duration and may change them. A Google Tag Manager container declared by the User on their Artist Page may set other cookies, depending on what the User has placed in it; it is only loaded after the "analytics" and "marketing" agreements.

Browser local storage. The Platform also stores in the browser a few items strictly necessary for the requested service, which do not leave it or only through an action of the Visitor: umami.disabled, the objection to audience measurement; the time of the last reload after a consent withdrawal; drafts of a campaign brief, of an artist page started from the home page or of a support reply; the page to reopen after login; and, in the logged-in area, bs-passkey-here (a passkey exists on this browser), the passkey and Pro offer reminders already seen and the closed getting-started help.

This list is kept up to date whenever the tools integrated into the Platform change.

10.3 Consent Management

Consent banner displayed upon the first visit. Preferences may be modified at any time. Choice remembered for 12 months; proof of consent kept for 13 months, the period recommended by the CNIL. The exempt audience measurement described in Article 10.1 does not appear in it: it does not depend on consent.

10.4 Loading of the Meta Advertising Script Before Consent

The Meta pixel script (fbevents.js, provided by Meta Platforms, Inc.) is loaded as soon as the page opens, on the Site as well as on the Artist Pages that use it, in the "consent revoked" mode provided by Meta. In this mode the script is present but inert: it places no cookie on the Visitor's device and sends no browsing event to Meta. This early loading has a single purpose: to allow Meta's verification tools to confirm that the pixel is correctly installed, which is impossible when the script only appears after consent.

Downloading this script from Meta's servers nevertheless involves, as does any call to a third-party server, the transmission to Meta Platforms, Inc. of the Visitor's IP address and of the technical headers of their browser, including the domain name of the page being viewed. The pixel-specific configuration file, which carries the pixel identifier, is only requested from Meta after consent. No other data is communicated at this stage: no advertising identifier is created, and no page view or click is measured until the Visitor has granted consent to the advertising category through the integrated consent manager. Consent, and only consent, then triggers the placement of Meta cookies and the sending of events. A refusal, like a later withdrawal, leaves the script in place and silent.

Article 11: Redirection to Third-Party Platforms and Processing of Browsing Data

11.1 Leaving the BandStream Perimeter

The Platform allows Users to create Artist Pages containing hyperlinks redirecting Visitors to third-party music streaming platforms (including Spotify, Apple Music, Deezer, YouTube Music, Tidal, Qobuz) as well as to ticketing platforms or social networks.

When a Visitor clicks on one of these links, they leave the BandStream environment and access a site or application operated by an independent third party. From the point of redirection onward, the Visitor's personal data is collected and processed by the destination platform, acting as an independent data controller, in accordance with its own privacy policy. BandStream exercises no control over the data processing carried out by these third-party platforms and disclaims all liability in this regard.

BandStream encourages Visitors to review the privacy policies of third-party platforms before accessing them.

11.2 Data Collected by BandStream Upon Click

Prior to the redirection, BandStream may collect browsing data related to the click made by the Visitor on the Artist Page. This data includes: the Visitor's country of origin (approximate geolocation derived from the IP address), the traffic source (referrer), the streaming platform selected by the Visitor, the type of device and browser used, and the date and time of the click.

This data is processed in an aggregated and anonymized manner, as part of the traffic statistics provided to Users with a Pro Plan, in accordance with BandStream's "privacy-first" approach. It is collected by the audience measurement exempt from consent described in Article 10.1, including when the Visitor has refused cookies. The legal basis for this processing is the legitimate interest of BandStream and its Users (article 6.1.f GDPR), consisting in measuring the audience and performance of Artist Pages.

11.3 No Transmission of Personal Data to Streaming Platforms

BandStream does not transmit any personal data of Visitors to streaming platforms or to any other third party accessible via the links on the Artist Pages. The redirection is carried out by simple hyperlink: the Visitor's browser is redirected to the URL of the destination platform without any personal data being communicated by BandStream to said platform.

Streaming platforms are not processors of BandStream within the meaning of article 28 of the GDPR. They act as independent data controllers for the data they collect directly from Visitors after the redirection.

11.4 Third-Party Cookies and Pixels on Artist Pages

When a User activates the Google Tag Manager or Meta Pixel features on their Artist Page (features that may be offered free of charge during the Alpha phase or included in a future paid plan), third-party cookies and pixels may be placed on the devices of Visitors who view said Artist Page. These cookies and pixels are operated by Google LLC and Meta Platforms, Inc., acting as independent data controllers for the data they collect through these technologies.

The placement of these third-party cookies and pixels is subject to the prior consent of the Visitor, obtained through the consent manager integrated into the Platform, in accordance with CNIL recommendations and the ePrivacy Directive. In the absence of consent, no third-party cookies or pixels are placed. The Meta pixel script may however be loaded inertly before the Visitor answers, under the conditions and with the consequences described in article 10.4.

11.5 Anonymous Click Counting After a Refusal

Where a Visitor refuses advertising cookies on an Artist Page whose holder has configured a server-side conversion interface (Meta Conversions API), the click towards a destination platform or a ticketing point of sale is nevertheless sent to that interface from BandStream's servers, in a strictly anonymous form: without IP address, without browser identifier (user-agent), without cookie and without any advertising identifier, including those the Visitor's device might still carry from an earlier visit. Only the destination of the click and its nature (platform or ticketing), the identifier of the release concerned, the address of the Artist Page stripped of all parameters (advertising click identifiers such as fbclid are removed from it), a single-use technical event identifier and the timestamp are transmitted.

This processing allows neither the identification of the Visitor nor their attachment to a profile or an advertising campaign: it produces an aggregate statistic, a click count, and nothing more. Its legal basis is the legitimate interest of BandStream and of its Users (article 6.1.f of the GDPR) in measuring the performance of Artist Pages. In that case no data is sent to the other advertising tools (TikTok, Snapchat), whose interfaces require a Visitor identifier, nor to the User's tag container, which only runs in the Visitor's browser.

Article 12: Security

Technical and organizational measures in accordance with article 32 of the GDPR: HTTPS/TLS encryption, authentication, access restriction, backups, monitoring. During the Alpha phase, these measures are being progressively deployed; BandStream implements reasonable measures proportionate to the Platform's stage of development.

In the event of a personal data breach likely to result in a high risk to the rights and freedoms of data subjects, BandStream will notify the breach to the CNIL within seventy-two (72) hours of its discovery, in accordance with article 33 of the GDPR. If this deadline cannot be met, the notification will be accompanied by the reasons for the delay. BandStream will also inform the data subjects concerned as soon as possible, in accordance with article 34 of the GDPR, indicating the nature of the breach and the measures taken or recommended to mitigate its effects.

Article 13: Minors

The Platform is reserved for persons aged 16 and over (art. 8 GDPR, art. 7-1 of the French Data Protection Act). Data of minors under 16 collected without parental consent will be deleted.

Article 14: Policy Amendments

This policy may be amended at any time. Users will be notified by email at least thirty (30) days in advance of any substantial amendment. The updated version will be published on the Site.

Article 15: Contact

Data protection contact: [email protected] (founding team)

Customer service: [email protected]

Mail: BandStream SAS, 60 rue François 1er, 75008 Paris, France