Privacy Policy

This Privacy Policy explains how Hernas OÜ (“Music24”, “we”, “us”) collects, uses, shares and protects personal data when you use music24.com, the Music24 web app at music24.com/app, the Music24 iPhone and Android apps, the Music24 API and MCP server, and the public SmartLink and pre-save pages that Music24 hosts for artists (together, the “Service”).

We process personal data under the EU General Data Protection Regulation 2016/679 (“GDPR”), the Estonian Personal Data Protection Act and other data protection laws that apply to us.

01Who is responsible for your data

The controller of your personal data is:

When an artist or a team uses Music24 to collect data from their fans (for example on a pre-save page), the artist decides why that data is collected, and we process it to run the page for them. Section 2.4 explains this.

02The personal data we collect

2.1Data you give us

• Account data: your email address. If you sign in with Apple or Google, we also receive the account identifier, and the name and email address that Apple or Google sends us. Music24 has no password: you sign in with a one-time code that we email to you, or with Apple or Google.
• Profile and workspace data: what you tell us during setup, your notification settings, your workspace name, the workspaces you belong to and your role in them, and the team invitations you send or receive.
• Content you create: your artists and their profiles, SmartLink and pre-save pages, trackers, images, audio and video clips you upload, Promote campaigns, captions and scheduled posts, and the artists, tracks and playlists you follow.
• Connected accounts: when you connect Spotify for Artists, Deezer for Creators, YouTube or a social network (see section 5), we store the access that service gives us. For Spotify for Artists, YouTube and the social networks this is an access token. Deezer for Creators has no such token, so when you connect it we store your Deezer for Creators email address and password, encrypted, and use them only to sign in to Deezer for Creators for you. All stored credentials are encrypted.
• Payment data: the plan you bought, its price, dates and status. Card payments on the web go through Stripe, and your card details stay with Stripe. Purchases in the iPhone or Android app go through Apple or Google, and we receive the receipt and its status. We never see or store your card number.
• Support messages: the messages and attachments you send to us.
• API tokens: when you create a personal API token, we store only a hash of it, its name, and when it was created and last used.

2.2Data we collect when you use the Service

• Usage data: the pages and screens you open, the actions you take, and session replays of clicks, scrolls and taps (see section 7).
• Device and log data: IP address, browser and device type, operating system, app version, language, time zone, the address that referred you, and the time of each request.
• Error reports: technical details of an error, the screen where it happened and your internal account number.
• API usage: which API endpoints and MCP tools your tokens call, and when. We use it to enforce rate limits and plan limits.

2.3Data from connected services and public sources

• Artist portals: the statistics that Spotify for Artists, Deezer for Creators and YouTube show you for your artists, such as streams, listeners, followers, playlists and audience locations.
• Social networks: the name, picture, handle and identifier of each channel you connect in Promote, and the status of the posts we publish for you. Once a day we also read the numbers that the network shows you for that channel: followers, and for each post its views, likes, comments, shares, saves and reach. We read your own channel only. We do not read other people's messages or accounts, and we do not sell this data. We use it to show your numbers in Music24 and in your reports.
• Public music data: Music24 analytics are built from publicly available data about artists, tracks and playlists on streaming services, such as chart positions, playlist placements and follower counts. Where this data is about an identifiable artist or playlist curator, it is personal data. We use it to provide charts, trends and alerts, based on our legitimate interest and the public interest in music statistics. You can object at any time (see section 9).

2.4Data about your fans

When a fan visits a SmartLink or pre-save page, we record the visit, the link they click and their country, so the artist sees page analytics. We do not store the fan's IP address or user agent with these events; we use them only to count unique visitors. When a fan pre-saves a release, we store their email address if they give one, whether they agreed to receive news from the artist, and the access that their streaming service gives us to save the release on release day. Artists can also add their own trackers (Meta Pixel, Google Analytics or Plausible) to their pages; those trackers are the artist's responsibility.

For this fan data the artist is the controller and we act as their processor. We delete a fan's streaming access once nothing needs it any more. If you are a fan and want your data removed, contact the artist or email [email protected].

03Why we use your data and our legal basis

04Emails we send

We send sign-in codes, team invitations, receipts and messages about your account and plan (such as the end of your trial). These are part of the Service. We also send daily or weekly reports and alerts about the artists you follow; you can turn them off in Settings > Notifications. Every report, alert, trial and Promote post pack email has an Unsubscribe link that works without sign-in. Where we send marketing emails, you can unsubscribe at any time.

05Who we share data with

We do not sell your personal data. We share it only with the service providers below, who process it for us under data processing agreements, and with the services you choose to connect.

5.1Service providers

5.2Services you connect

When you connect an account, we exchange data with that service on your instruction, and its own privacy policy applies to what it does with your data:

• Spotify for Artists: Spotify Privacy Policy
• Deezer for Creators: Deezer Privacy Policy
• YouTube (YouTube API Services): by connecting YouTube you agree to the YouTube Terms of Service and the Google Privacy Policy applies. Section 5.2.2 YouTube API Services explains what we access, store and delete, and how to remove our access.
• Facebook Pages, Instagram, Threads (Meta) and TikTok for Promote: we publish the posts you schedule to the channels you connect, and we read the numbers of that channel, under each network's own privacy policy. Before each post you see the account that gets it and the settings that the network asks you to choose. You can remove our access at any time in the network's own settings (for Meta, in the Business Integrations part of your Facebook or Instagram settings; for TikTok, in Security and permissions).
• Streaming services for pre-saves (such as Spotify, Apple Music, Tidal, Deezer and Amazon Music): we save the release to the fan's library on release day.

You can disconnect any of these in Music24 at any time. We then stop using the access and delete the stored credentials.

5.2.1Delete the data we got from a social network

To delete the data that we read from a social network (Facebook, Instagram, Threads, TikTok or YouTube), open Music24, go to Promote, Channels and choose Disconnect on the channel. We then stop using the access and delete the stored credentials. To delete everything, including the numbers and the posts that we read for that channel, delete your account in Settings, Account. You can also write to [email protected] from the email address of your account, and we delete the data within one month. If you remove Music24 in the settings of a network, that network stops our access, and you can ask us to delete the data in the same way. YouTube has stricter rules: a Disconnect deletes all YouTube data at once, and we delete it within 7 days in the other cases (see section 5.2.2).

5.2.2YouTube API Services

Music24 uses YouTube API Services. When you connect your YouTube channel in Music24 (in Promote, Channels, or in Catalog), you sign in with Google and allow Music24 to use YouTube API Services for your channel. By connecting, you agree to the YouTube Terms of Service, and the Google Privacy Policy applies to what Google does with your data.

What we ask Google for. We ask for three permissions: to upload videos to your channel (youtube.upload), to see your channel and its videos (youtube.readonly), and to see the YouTube Analytics reports of your channel (yt-analytics.readonly). We do not ask for your Google email address, and we cannot delete or edit your videos, read your comments or messages, or see other people's channels.

What we access, collect and store.

• Your sign-in: the access token and the refresh token that Google gives us, and the list of permissions you granted. We store the tokens encrypted.
• Your channel: the channel ID, name, handle, profile picture and link. We read them again every day.
• Your channel numbers: once a day we store the subscriber count, the total view count and the number of videos of your channel for that day.
• Your videos: for the videos of your channel from the last 90 days (at most 500), the video ID, title, description, thumbnail, link, publish time, length, format (Short or video), and the view, like and comment counts. We read them again every day and keep the counts of each day.
• YouTube Analytics: the daily views, likes, playlist adds and subscribers gained and lost of your channel, and the 50 videos with the most views in the last 28 days: the video ID, title, thumbnail, publish date and 28-day views, and the daily views, likes and playlist adds of each video.
• Videos you post with Music24: the ID and the link of each video that we upload for you, saved with your scheduled post.
• Technical logs: a log of each daily read, which for YouTube Analytics includes the answers that Google sent. We delete these logs after 30 days.

How we use it. We use this data only to provide the Service to you: to upload the videos you schedule in Promote at the time you choose, to show your channel, your videos and their numbers in Music24 (Home, Social, Streaming, the Calendar and Releases), to link your scheduled posts to their results, and to include your channel numbers in the daily or weekly report emails you choose to receive. We do not use YouTube data for advertising, we do not sell it, and we do not send it to AI models.

Who sees it and who we share it with. Inside Music24, the members of your workspace see the YouTube data of the artists in that workspace, and our support team can see the status and the name of your connection when they help you. Outside Music24, the data passes only through the service providers that run the Service for us (section 5.1): Scaleway stores it in Amsterdam, Backblaze keeps encrypted backups, Cloudflare carries it over the network, and Mailgun delivers the report emails that include your numbers. The videos you upload go to YouTube. If you add the Social links block to a SmartLink page, that public page shows the link to your channel. We share YouTube data with no one else.

Information on your device. Our YouTube integration does not store, access or collect any information on your device. You sign in on Google's own page. Section 7 describes the cookies and storage that the Service uses in general.

How to remove our access. In Music24, choose Disconnect on the YouTube channel in Promote, Channels, or on the YouTube card in Catalog. Music24 then asks Google to revoke the access and deletes all the YouTube data listed above at once. You can also remove Music24 at any time on the Google security settings page at https://security.google.com/settings/security/permissions (also at myaccount.google.com/permissions).

How long we keep it, and how to have it deleted.

• If you choose Disconnect in Music24, we delete the YouTube data at once.
• If you remove our access in your Google settings, or Google stops our access for another reason, our daily read notices it within one day. We keep the data for 5 more days, so that it is not lost if you connect again, and then delete it. The data is gone within 7 days after the access ended.
• If you delete your Music24 account, we delete the YouTube data at once, with the rest of your account (section 8).
• You can also ask us to delete your YouTube data by email to [email protected] from the email address of your account. We delete it within 7 days.
• We refresh the YouTube data every day. Data that we could not refresh for 30 days is deleted: a video that is no longer among the videos we read, a video that left the top 50, and all the data of a channel whose daily read failed for 30 days.
• Our encrypted backups expire within 30 days, so deleted YouTube data also leaves the backups by then.

When we delete your YouTube data, we keep what you created in Music24: your scheduled posts, their captions and the files you uploaded. We remove the YouTube video ID and link from those posts.

5.3Others

We share data with authorities when the law requires it, to protect our rights or the safety of others, and with a buyer or successor if our business is sold or reorganised, under this Policy.

06International transfers

We store our main databases and files in the EU. Some providers above (for example Stripe, Mailgun, Cloudflare, Microsoft, Google, Meta and xAI) may process data in the United States or other countries outside the European Economic Area. We transfer data only with appropriate safeguards: an EU adequacy decision, including the EU-U.S. Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses. Email [email protected] for a copy of these safeguards.

07Cookies, analytics and session replay

7.1On music24.com

When you first visit music24.com, a cookie bar asks you to Accept or Reject. Until you choose, and after you select Reject, we load only what the site needs to work and Plausible. Plausible counts page visits without cookies and without identifying you. If you select Accept, we also load:

• Microsoft Clarity: records how pages are used, as clicks, scrolls and a replay of the visit.
• Google Analytics: counts visits and measures how people use the site.
• Meta Pixel: measures whether our ads on Facebook and Instagram lead to visits and sign-ups.

7.2In the web app and the mobile apps

The web app shows the same Accept/Reject bar and uses the same choice as music24.com. Plausible always runs. Google Analytics, Microsoft Clarity, the Meta Pixel and Countly run only after you select Accept. In the iPhone and Android apps we use Microsoft Clarity and Countly. Once you sign in, these tools know you by an internal account number, never by your email address. In the mobile apps Clarity hides what you type, sign-in codes, API tokens, plan and purchase details and email addresses.

In the iPhone and Android apps we use Clarity and Countly based on our legitimate interest in finding errors and improving the apps (Art. 6(1)(f) GDPR), so the apps do not ask for consent. You can object at any time by email to [email protected].

7.3Meta Conversions API

If you selected Accept on music24.com or in the web app and then create an account, or buy a plan on the web, our server reports this event to Meta to measure our ads. If you selected Reject, or made no choice, we send nothing to Meta. We send a one-way hash of your email address and of your account number, your IP address and browser user agent, and Meta's own browser identifiers if they are present. Meta does not receive your email address in readable form. You can object to this at any time (see section 9).

7.4Needed cookies and storage

The web app stores your sign-in session and your preferences (such as the artist you last opened) in your browser. These are needed for the Service to work and do not need consent.

08How long we keep data

When you delete your account (in Settings > Account, as the Delete your account help article describes), we:

• cancel your Stripe subscription first, with no refund for the unused days, and replace your name and email address on the Stripe customer record;
• sign you out on every device and revoke every API token and every connected AI client;
• remove your Apple and Google sign-in links and revoke the Apple sign-in token;
• delete your artists, SmartLink and pre-save pages, fan subscriptions, Promote campaigns and channels, connected artist portals and their data, and uploaded files, and ask Google, Meta and TikTok to revoke the Promote tokens;
• erase your email address from your account and from the purchase records and receipts that we must keep.

We keep the purchase records (without your email address), a one-way hash of your email address and of your Apple or Google sign-in so that one person gets only one free trial, and the list of public artists, tracks and playlists your workspace followed, with no email address. Statistics that do not identify you, such as total SmartLink clicks, may remain. We cannot cancel an App Store or Google Play subscription for you. Cancel it in the store before you delete your account.

09Your rights

Under the GDPR you have the right to:

• access your personal data and get a copy of it (Art. 15);
• correct inaccurate data (Art. 16); you can change your email address in Settings yourself;
• have your data erased (Art. 17); you can delete your account in Settings yourself;
• restrict processing (Art. 18);
• receive your data in a machine-readable format (Art. 20);
• object to processing based on our legitimate interests, including the use of public music data and ad measurement, and to direct marketing at any time (Art. 21);
• withdraw your consent at any time (Art. 7(3));
• not be subject to a decision based solely on automated processing with legal effects (Art. 22).

Email [email protected] from the address of your account. We may ask you to confirm your identity. We answer within one month. You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the supervisory authority where you live or work.

10Security

We protect your data with encryption in transit (TLS), encryption of stored credentials for connected services, short-lived session tokens, hashed API tokens, limits on sign-in attempts, access controls for our team, and regular updates. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the authorities as the law requires. Please report security issues to [email protected].

11Children

You must be at least 16 years old to use Music24. We do not knowingly collect personal data from children under 16. If you believe a child under 16 gave us personal data, email [email protected] and we will delete it.

12Changes to this Policy

We may update this Policy when the Service or the law changes. The date at the top shows the latest version. If a change is significant, we will tell you by email or in the Service before it takes effect.

13Contact

Hernas OÜ
Kentmanni 4
10116 Tallinn
Estonia

Privacy: [email protected]
Support: [email protected]

Read also our Terms of Service and our Refund Policy.