Privacy policy

Data controller

Theo Dumont EI, 148 rue du Général De Gaulle, 69530 Brignais, France.

Data requests go to hello@starshine.fm. No data protection officer is appointed: that is only mandatory in specific cases, none of which applies here today.

Data we collect

This list matches what the database actually holds: it is drawn from the schema, not from a template.

• Account: email address, hashed password, creation date
• Profile: username, display name, biography, picture, language
• Declared location: country and city, chosen by you and not inferred from your IP address
• Date of birth, collected to check the minimum age and to gate purchases
• Music preferences: genres, and for solo artists, instruments played
• For artists: page address, name, biography, profile and cover images
• Progress through the sign-up flow
• Terms acceptance: which version of the terms of use and of the privacy policy you accepted, and when

For those who buy, order history and billing details are added. Card details are handled directly by our payment provider and never pass through our servers.

Finally, anonymised browsing data is collected for audience measurement, only from visitors who have accepted it.

We collect no advertising data, no precise location data, and no sensitive data within the meaning of the GDPR.

Purposes and legal bases

• Running the service and managing your account: performance of the contract
• Checking the minimum age: legal obligation and legitimate interest
• Displaying published artist pages: performance of the contract
• Keeping the service secure and preventing abuse: legitimate interest
• Sending account emails such as address verification: performance of the contract
• Processing purchases and meeting accounting obligations: performance of the contract and legal obligation
• Measuring site audience to improve it: consent, revocable at any time

No data is used for marketing without your consent, and none is sold.

What is public

A published artist page is public and indexable by search engines: its name, address, biography, images and city are visible to everyone.

Your date of birth and email address are never shown publicly.

Processors

• Supabase: database, authentication and file storage, hosted in Frankfurt
• Hetzner: the application server, in Falkenstein and Nuremberg
• Hostinger: sending our account and service emails
• Stripe: payment processing, Irish entity. Stripe receives the data needed for the transaction and acts as an independent controller for fraud prevention. Your card details never pass through or rest on our servers.

All hosting of your data is located in the European Union. Two exceptions, and only two. Stripe is an Irish entity whose US parent may access data to fight fraud, under the mechanisms the GDPR provides. And push notifications travel through your browser vendor (Google, Mozilla or Apple), which carries them without being able to read them: their content is encrypted end to end.

We use no analytics tool, no advertising tracker and no third-party delivery network. Nothing sits between your browser and our servers.

Each of these processors handles data only on our instructions, and only for what the service needs.

Retention

Account data is kept while the account exists. Some of it goes much sooner, on its own: RiffShots and conversation attachments after seven days, a studio activity log after two years, your cookie choice after six months.

Closing an account is immediate and final. There is no trash, no grace period and no way back: your pages, your posts and your files go with it, and we cannot return them.

Three things survive, and here is why. Purchase records, without your identifier: a completed sale is an accounting entry, and the law requires us to keep it. The flames you sent, because they belong to the artists who received them. And your comments, shown without your name, so that answers are not left without a question.

A band page you do not own alone does not disappear: it belongs to the band, and it stays with them.

Your rights

You have rights of access, rectification, erasure, restriction, objection and portability. Requests go to the contact address above and are answered within one month.

You may also lodge a complaint with the CNIL, the French data protection authority.

Security

Passwords are never stored in clear text. Traffic to the site is encrypted. Access to production data is limited to those who need it.

Account creation is capped per hour and per address, to prevent automated sign-ups. That counter does not keep your IP address: it only keeps an irreversible fingerprint of it, erased after two hours.