गोपनीयता नीति

PRIVACY POLICY

BandStream (Private Alpha Phase)

Effective as of April 14, 2026, updated on September 21, 2026 (YouTube videos on release pages; on September 19, 2026: recipients, consent cookie, Meta pixel and anonymous click counting)

Article 1: Data Controller

The data controller for personal data is BandStream SAS, 60 rue François 1er, 75008 Paris, France. RCS Paris 939 221 438; SIRET 939 221 438 00012; VAT FR 81939221438. Contact: [email protected].

Article 2: Data Protection Contact

The data protection contact can be reached at: [email protected]. They are the point of contact for any questions regarding the processing of personal data and for the exercise of data subjects' rights.

Article 3: Alpha Context, Specific Information

The Platform is currently in a private Alpha phase. Access is restricted to Alpha Users who have received an Invitation from BandStream. This phase involves the following specificities regarding personal data:

(a) BandStream may collect data specific to the Alpha phase, such as experience Feedback, bug reports, detailed usage data, and satisfaction survey responses, for the purpose of improving the Platform.

(b) Technical security measures may be in the process of deployment and may not reach the level of a final commercial version. BandStream nevertheless implements reasonable measures to protect the data of Alpha Users.

(c) In the event of the end of the Alpha phase, Alpha User data will be processed in accordance with article 8 (retention periods), unless the Alpha User continues their use in the commercial version.

Article 4: Personal Data Collected

4.1 Alpha User Data

Identification data: artist name or pseudonym, email address.

Connection data: IP address, browser type, operating system, date and time of connection, access logs.

Subscription data: plan type, subscription and renewal dates, billing history.

Content data: profile images, biography, links, event-related information.

Payment data: collected and processed directly by Stripe, Inc. Not stored by BandStream.

Alpha-specific data: experience Feedback, bug reports, detailed usage data (navigation paths, actions performed, features used), responses to internal surveys.

4.2 Visitor Data

Aggregated and anonymized browsing data: country, traffic source, pages visited, duration. "Privacy-first" approach.

4.3 Mandatory or Optional Nature of Data

Data marked with an asterisk (*) in the forms is mandatory for Account creation and the provision of Services. If this mandatory data is not provided, BandStream will not be able to create the User's Account or provide the Services. Other data is optional, and its non-provision does not prevent use of the Platform but may limit certain features (for example, the absence of a biography or profile image on the Artist Page).

Article 5: Purposes and Legal Bases

Note: The "Ad Campaign management" purpose (Google Ads, Meta Pixel, TikTok) is based on User consent and not on the performance of the contract, in accordance with the recommendations of the CNIL regarding advertising tracking. The placement of advertising cookies and pixels is subject to prior consent obtained through the integrated consent manager.

Article 6: Recipients and Processors

6.1 BandStream's Processors

Each processor is contractually bound to comply with the GDPR. BandStream may communicate data to competent authorities upon legal request.

6.2 Advertising Platforms Activated by Users (Pro Plan)

When a Pro Plan User configures a pixel on their Artist Page, the corresponding platform receives browsing events from that page's Visitors, only after their "marketing" consent has been obtained through the integrated consent manager. For Meta, TikTok and Snapchat, when the User has provided a conversions API key, clicks to streaming platforms and to ticketing points of sale are also sent from BandStream's servers, under the same consent condition. Two exceptions, which concern Meta only, are described in Articles 10.4 (loading of the pixel script before the Visitor has answered, with no cookie and no event) and 11.5 (anonymous click counting after a refusal). These platforms act as independent data controllers (see Article 11.4).

When a release page features a music video, Google LLC (YouTube) receives the Visitor's IP address and technical browser information when the player loads, which only happens after the Visitor clicks the video and agrees to the "YouTube videos" category (see Article 10.1). Before that agreement, no data is sent to Google. YouTube acts as an independent data controller.

6.3 Tags of the Site's Measurement Container

The Site's Google Tag Manager container (GTM-N9SS822J) is loaded only when the Visitor has granted both the "analytics" category and the "marketing" category. In addition to audience measurement (Google Analytics), it contains advertising tags used to measure BandStream's campaigns: Google Ads and TikTok. When the Visitor grants the "analytics" category only, this container is not loaded: Google Analytics is then loaded on its own, with advertising signals denied, and no Google Ads or TikTok tag enters the page.

A tag transmits data only when it is actually triggered; Article 6.1 describes the contents of the container and the transmissions observed on the Site, not a systematic transmission on every visit. When the Visitor withdraws a consent while these tools are already active in the page, the page is reloaded once, so that they actually stop emitting. Google LLC and TikTok act as independent data controllers for the data they collect through these tags.

Article 7: Transfers Outside the EU

Data is primarily hosted in France and within the EU. Transfers outside the EEA are governed by standard contractual clauses or the EU-U.S. Data Privacy Framework.

In accordance with the recommendations of the European Data Protection Board (EDPB) and the Schrems II ruling (CJEU, case C-311/18), BandStream has conducted a Transfer Impact Assessment (TIA) for each processor located outside the EEA. These assessments are available upon request from the data protection contact at [email protected].

Supplementary measures (end-to-end encryption, pseudonymization, access segregation) are implemented when the TIA identifies a residual risk to the rights of data subjects.

Further information: [email protected].

Article 8: Retention Periods

Upon expiration, data is deleted or irreversibly anonymized.

Article 9: Data Subject Rights

Right of access (art. 15 GDPR): obtain confirmation of processing and a copy of the data.

Right to rectification (art. 16): correction of inaccurate or incomplete data.

Right to erasure (art. 17): deletion of data, subject to legal obligations.

Right to restriction (art. 18): temporary suspension of processing.

Right to data portability (art. 20): retrieval of data in a structured and readable format.

Right to object (art. 21): objection to processing based on legitimate interest, and objection to marketing at any time.

Right relating to automated decision-making and profiling (art. 22 GDPR): the User has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them. As of the date of this policy, BandStream does not engage in any solely automated decision-making or profiling producing legal effects with respect to Users. In the event of any change, this policy will be updated to inform Users accordingly.

Withdrawal of consent: possible at any time, without retroactive effect.

Post-mortem directives (art. 85 of the French Data Protection Act): directives regarding the fate of data after death.

Requests should be sent to [email protected] with proof of identity. Response within one (1) month, extendable by two (2) months. Complaints may be filed with the CNIL (3 Place de Fontenoy, 75334 Paris Cedex 07; www.cnil.fr).

Article 10: Cookies

10.1 Types of Cookies

Strictly necessary cookies: technical operation (session, authentication, security). No consent required.

Analytical cookies (Google Analytics): audience measurement. Consent required.

Cookieless audience measurement (Umami, self-hosted): visit statistics for Artist Pages (page views, clicks to streaming platforms, country, device type). Umami is a privacy-focused analytics tool: it sets no cookies, performs no cross-site tracking, and IP addresses are not stored. Data is hosted on BandStream's servers within the European Union and is not shared with any third party. For consistency with the management of other measurement tools, its activation is nevertheless subject to the "analytics" consent collected through the integrated consent manager.

Advertising cookies of the Site: Google Ads and TikTok, loaded by BandStream's Tag Manager container, and the Meta pixel of the Site (see Article 6.1). Consent required via the integrated consent manager.

Advertising cookies (Pro Plan): Meta, Google Ads, TikTok, Snapchat and X pixels configured by the User on their Artist Page (see Article 6.2). Consent required via the integrated consent manager.

YouTube videos: on a release page that features a music video, the YouTube player (Google LLC, youtube-nocookie.com domain) is only loaded after the Visitor clicks the video and agrees to the "YouTube videos" category, asked within the video frame or through the integrated consent manager. Before that agreement, no request is sent to Google: the image shown is a copy hosted by BandStream. Once the player is loaded, YouTube may set cookies and receive the IP address and technical browser information, as an independent data controller. The choice is stored in the privacy:consent cookie and can be withdrawn at any time.

10.2 Detailed List of Cookies

This list is provided for informational purposes and will be updated as the tools integrated into the Platform evolve. The up-to-date version is available in the integrated consent manager.

10.3 Consent Management

Consent banner displayed upon the first visit. Preferences may be modified at any time. Consent stored for 12 months, within the 13-month limit recommended by the CNIL.

10.4 Loading of the Meta Advertising Script Before Consent

The Meta pixel script (fbevents.js, provided by Meta Platforms, Inc.) is loaded as soon as the page opens, on the Site as well as on the Artist Pages that use it, in the "consent revoked" mode provided by Meta. In this mode the script is present but inert: it places no cookie on the Visitor's device and sends no browsing event to Meta. This early loading has a single purpose: to allow Meta's verification tools to confirm that the pixel is correctly installed, which is impossible when the script only appears after consent.

Downloading this script from Meta's servers nevertheless involves, as does any call to a third-party server, the transmission to Meta Platforms, Inc. of the Visitor's IP address and of the technical headers of their browser, including the domain name of the page being viewed. The pixel-specific configuration file, which carries the pixel identifier, is only requested from Meta after consent. No other data is communicated at this stage: no advertising identifier is created, and no page view or click is measured until the Visitor has granted consent to the advertising category through the integrated consent manager. Consent, and only consent, then triggers the placement of Meta cookies and the sending of events. A refusal, like a later withdrawal, leaves the script in place and silent.

Article 11: Redirection to Third-Party Platforms and Processing of Browsing Data

11.1 Leaving the BandStream Perimeter

The Platform allows Users to create Artist Pages containing hyperlinks redirecting Visitors to third-party music streaming platforms (including Spotify, Apple Music, Deezer, YouTube Music, Tidal, Qobuz) as well as to ticketing platforms or social networks.

When a Visitor clicks on one of these links, they leave the BandStream environment and access a site or application operated by an independent third party. From the point of redirection onward, the Visitor's personal data is collected and processed by the destination platform, acting as an independent data controller, in accordance with its own privacy policy. BandStream exercises no control over the data processing carried out by these third-party platforms and disclaims all liability in this regard.

BandStream encourages Visitors to review the privacy policies of third-party platforms before accessing them.

11.2 Data Collected by BandStream Upon Click

Prior to the redirection, BandStream may collect browsing data related to the click made by the Visitor on the Artist Page. This data includes: the Visitor's country of origin (approximate geolocation derived from the IP address), the traffic source (referrer), the streaming platform selected by the Visitor, the type of device and browser used, and the date and time of the click.

This data is processed in an aggregated and anonymized manner, as part of the traffic statistics provided to Users with a Pro Plan, in accordance with BandStream's "privacy-first" approach. The legal basis for this processing is the legitimate interest of BandStream and its Users (article 6.1.f GDPR), consisting in measuring the audience and performance of Artist Pages.

11.3 No Transmission of Personal Data to Streaming Platforms

BandStream does not transmit any personal data of Visitors to streaming platforms or to any other third party accessible via the links on the Artist Pages. The redirection is carried out by simple hyperlink: the Visitor's browser is redirected to the URL of the destination platform without any personal data being communicated by BandStream to said platform.

Streaming platforms are not processors of BandStream within the meaning of article 28 of the GDPR. They act as independent data controllers for the data they collect directly from Visitors after the redirection.

11.4 Third-Party Cookies and Pixels on Artist Pages

When a User activates the Google Tag Manager or Meta Pixel features on their Artist Page (features that may be offered free of charge during the Alpha phase or included in a future paid plan), third-party cookies and pixels may be placed on the devices of Visitors who view said Artist Page. These cookies and pixels are operated by Google LLC and Meta Platforms, Inc., acting as independent data controllers for the data they collect through these technologies.

The placement of these third-party cookies and pixels is subject to the prior consent of the Visitor, obtained through the consent manager integrated into the Platform, in accordance with CNIL recommendations and the ePrivacy Directive. In the absence of consent, no third-party cookies or pixels are placed. The Meta pixel script may however be loaded inertly before the Visitor answers, under the conditions and with the consequences described in article 10.4.

11.5 Anonymous Click Counting After a Refusal

Where a Visitor refuses advertising cookies on an Artist Page whose holder has configured a server-side conversion interface (Meta Conversions API), the click towards a destination platform or a ticketing point of sale is nevertheless sent to that interface from BandStream's servers, in a strictly anonymous form: without IP address, without browser identifier (user-agent), without cookie and without any advertising identifier, including those the Visitor's device might still carry from an earlier visit. Only the destination of the click and its nature (platform or ticketing), the identifier of the release concerned, the address of the Artist Page stripped of all parameters (advertising click identifiers such as fbclid are removed from it), a single-use technical event identifier and the timestamp are transmitted.

This processing allows neither the identification of the Visitor nor their attachment to a profile or an advertising campaign: it produces an aggregate statistic, a click count, and nothing more. Its legal basis is the legitimate interest of BandStream and of its Users (article 6.1.f of the GDPR) in measuring the performance of Artist Pages. In that case no data is sent to the other advertising tools (TikTok, Snapchat), whose interfaces require a Visitor identifier, nor to the User's tag container, which only runs in the Visitor's browser.

Article 12: Security

Technical and organizational measures in accordance with article 32 of the GDPR: HTTPS/TLS encryption, authentication, access restriction, backups, monitoring. During the Alpha phase, these measures are being progressively deployed; BandStream implements reasonable measures proportionate to the Platform's stage of development.

In the event of a personal data breach likely to result in a high risk to the rights and freedoms of data subjects, BandStream will notify the breach to the CNIL within seventy-two (72) hours of its discovery, in accordance with article 33 of the GDPR. If this deadline cannot be met, the notification will be accompanied by the reasons for the delay. BandStream will also inform the data subjects concerned as soon as possible, in accordance with article 34 of the GDPR, indicating the nature of the breach and the measures taken or recommended to mitigate its effects.

Article 13: Minors

The Platform is reserved for persons aged 16 and over (art. 8 GDPR, art. 7-1 of the French Data Protection Act). Data of minors under 16 collected without parental consent will be deleted.

Article 14: Policy Amendments

This policy may be amended at any time. Users will be notified by email at least thirty (30) days in advance of any substantial amendment. The updated version will be published on the Site.

Article 15: Contact

Data protection contact: [email protected]

Customer service: [email protected]

Mail: BandStream SAS, 60 rue François 1er, 75008 Paris, France