Privacy Policy

1. Who we are

Promo-Chats is a music promo servicing platform operated under Spanish and European law. The Platform provides technology tools that enable music industry professionals ("Clients") to distribute promotional content to curators, DJs, journalists, and other industry contacts ("Recipients").

2. Roles and Responsibilities under GDPR

Under the General Data Protection Regulation (EU 2016/679), Clients who upload contact data and send campaigns act as independent Data Controllers. Promo-Chats acts as a Data Processor, processing personal data exclusively on behalf of and under the instructions of the Client. The terms of this processing relationship are governed by our Data Processing Agreement (DPA), available at /dpa, which forms part of the Terms of Service. Promo-Chats does not determine the purposes or means of processing Recipient data — this responsibility lies solely with the Client. Each Client is independently responsible for ensuring they have a lawful basis (such as explicit consent) to process and contact their Recipients through the Platform.

3. What data we collect

For Clients: name, company name, email address, payment information, and SMTP/channel connection credentials. For Recipients/Curators: name, email address, social media handles (WhatsApp, Instagram, Facebook, TikTok, X/Twitter, Telegram), professional role, venue, city, country, genre preferences, and channel preferences. Automatically collected: IP addresses when interacting with promo pages, consent links, or unsubscribe links; engagement data (opens, feedback); timestamps of all interactions.

4. Legal basis for processing

Client data: processed on the basis of contractual necessity (provision of the Service) and legitimate interest (platform operation and security). Recipient data uploaded by Clients: processed on the basis of the Client's lawful basis, which is the Client's sole responsibility to establish and maintain. Recipients who self-register at /join provide explicit consent. Platform operation data: processed on the basis of legitimate interest (security, fraud prevention, service improvement).

5. How we use your data

Client contact details and campaigns are used to deliver the promotional services requested. Recipient data is used exclusively to deliver promotional content on behalf of Clients, through the channels authorized by each Recipient. We do not sell, rent, or share personal data with third parties for marketing purposes. To keep unwanted mail down, the platform orders and schedules each send using previous interactions (whether a Recipient has opened a promo, downloaded a track, or left feedback) and the country inferred from the IP address recorded when they opened one. This decides who is contacted first and at what time of day — never whether someone is contacted at all, what they are charged, or any other matter with legal or similarly significant effects. It is carried out on the basis of legitimate interest (service improvement and protecting deliverability for every Client on the platform), and you may object to it at any time at privacy@promo-chats.com.

5b. The community area

Clients with an account can post threads and replies in the community area of the Platform. This area is not public: it can only be read by other signed-in Clients and by Promo-Chats staff, and it is not indexed by search engines. When you post, the name shown beside your text is your company name, or your personal name if no company name is set. Your email address is never shown. Posting is entirely voluntary; nothing you have not written yourself is published there. We process this content on the basis of legitimate interest (running a support and feedback space for Clients). Posts are retained while your account is active; you can delete your own threads and replies at any time from the interface, and you may request removal of anything you have written at privacy@promo-chats.com. Promo-Chats may hide or delete content that is unlawful, abusive, or off-topic. Do not post personal data about third parties — including Recipient names, email addresses, or contact lists — in the community area.

5c. Connecting your own assistant (API and MCP)

Clients may create API keys and connect an external assistant — for example ChatGPT (OpenAI) or Claude (Anthropic) — to their own account, at /developers. When you do this, you instruct that provider to process the data your assistant reads through the API. Promo-Chats has no relationship with the provider you choose and no control over what it retains: for that data, the provider is a processor acting on your instructions, not ours, and its terms and privacy policy apply. In particular, granting a key the "contacts:read" scope means the contact data it reads is transmitted to that provider. That scope is off by default and you should only enable it if you accept that transfer, including any transfer outside the EEA that the provider performs. Each key is scoped, can be revoked at any moment from Setup, and is stored only as a keyed hash — the key itself cannot be recovered by anyone, including us. Sending is a separate scope and additionally requires an explicit confirmation on every call, so an assistant cannot send on its own initiative. For security and abuse investigation we log, for each API call: the key, the account, the method, the path, the response status, the duration and the originating IP address. We do not log request bodies, message contents or recipient data. These logs are kept for 12 months.

6. Data sharing and third-party services

The Platform transmits messages through third-party services including WhatsApp (Meta), Instagram (Meta), Facebook (Meta), TikTok (ByteDance), X/Twitter, Telegram, and email (via SMTP). Each transmission is subject to the privacy policy and terms of the respective service. Promo-Chats does not control how these third parties process data once delivered. Payment processing is handled by Stripe, Inc., subject to Stripe's privacy policy.

6b. Sub-processors

In accordance with GDPR Article 28, the following sub-processors may process personal data on behalf of Promo-Chats: • Stripe, Inc. (USA, EU SCCs) — Payment processing. Data: billing name, email, payment card (tokenized). • Banahosting / Datacenter Europe (Spain/EU) — Server hosting and data storage. Data: all platform data. • Anthropic, PBC (USA, EU SCCs) — AI Profile Finder feature. Data: contact names and publicly available information only, no private data. • Meta Platforms, Inc. (USA, EU SCCs) — WhatsApp, Instagram, Facebook message delivery. Data: recipient handles and message content. • ByteDance Ltd. (Singapore/China, EU SCCs) — TikTok message delivery. Data: recipient handles and message content. • X Corp. (USA) — X/Twitter message delivery. Data: recipient handles and message content. • Telegram FZ-LLC (UAE) — Telegram message delivery. Data: recipient handles and message content. • Functional Software, Inc. / Sentry (USA, EU SCCs) — Error monitoring and performance tracking. Data: anonymized request metadata, error logs. No personal data is intentionally collected. We will notify Clients of any changes to sub-processors at least 30 days in advance via email. Clients may object to new sub-processors, in which case they may terminate their account.

7. Data retention

Client account data: retained for the duration of the account plus 12 months after deletion. Recipient data: retained for as long as the Client maintains an active account, or until the Recipient requests deletion, whichever comes first. Campaign logs and engagement data: retained for 24 months from the date of creation. Backups: automatically purged within 30 days of the primary data deletion.

8. Data security

We implement appropriate technical and organizational measures to protect personal data, including: encrypted data transmission (TLS/SSL), hashed password storage (bcrypt), session-based authentication with secure cookies, access controls and role-based permissions, and regular security reviews. Despite these measures, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Your rights (GDPR)

Under the GDPR, you have the right to: • Access: request a copy of the personal data we hold about you. • Rectification: request correction of inaccurate or incomplete data. • Erasure: request deletion of your personal data ("right to be forgotten"). • Restriction: request that we restrict processing of your data. • Portability: receive your data in a structured, commonly used, machine-readable format. • Objection: object to processing based on legitimate interest. • Withdraw consent: withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. To exercise any of these rights, contact us at privacy@promo-chats.com. We will respond within 30 days.

10. Unsubscribe and data deletion

Every promotional email contains an unsubscribe link that immediately removes you from all mailing lists. To request complete deletion of all your data from the Platform, email privacy@promo-chats.com or use the GDPR deletion feature in your account settings. Upon request, we will delete all personal data within 30 days and confirm deletion in writing.

11. Cookies

We use strictly necessary cookies only. We do not use tracking, analytics, advertising or profiling cookies, and we do not share cookie data with anyone. Under Article 5(3) of the ePrivacy Directive and the AEPD guidance on cookies, cookies strictly necessary to provide a service the user has requested are exempt from consent, so no cookie banner is shown. The cookies we set: • next-auth.session-token — keeps a Client signed in. Session or up to 14 days. Strictly necessary. • next-auth.csrf-token — protects sign-in forms against cross-site request forgery. Session. Strictly necessary. • next-auth.callback-url — returns you to the page you were on after signing in. Session. Strictly necessary. • curator_session — keeps a Recipient signed in to their promo inbox at /my-promos so they do not have to request a link on every visit. HttpOnly, SameSite=Lax, 30 days. Strictly necessary. No cookie is set by simply opening a promo page. Payments are completed on Stripe's own checkout pages, under Stripe's cookie policy; we do not load Stripe scripts on ours. The API and the MCP endpoint use bearer tokens and set no cookies at all.

11b. Open and click tracking in emails

Promotional emails sent through the Platform contain a 1×1 tracking pixel and rewritten links. When your mail client loads images, or when you click a link, we record that the message was opened or clicked, along with the time, your IP address and your mail client's user agent. Opening the promo page itself is recorded in the same way. This is used to tell a Client which recipients engaged with a release, to decide who receives a reminder and who does not, and to protect deliverability by identifying addresses that never engage. It is not used to build a profile beyond that, and it is never shared with anyone outside the Client who sent the message. The Client who sent the campaign is the Data Controller for this processing and relies on legitimate interest (measuring the effectiveness of a communication you have already received). You can prevent it entirely by blocking remote images in your mail client, which most clients do by default, and you can stop receiving the messages altogether through the unsubscribe link in every email. You may also object at privacy@promo-chats.com.

12. Data breach notification

In compliance with GDPR Articles 33 and 34, in the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, Promo-Chats will: • Notify the Spanish Data Protection Agency (AEPD) within 72 hours of becoming aware of the breach. • Notify affected Data Controllers (Clients) without undue delay, providing: the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach. • Notify affected individuals directly if the breach is likely to result in a high risk to their rights and freedoms. To report a suspected data breach or security incident, contact: security@promo-chats.com

13. International data transfers

Data is primarily stored and processed within the European Economic Area (EEA). Where data is transferred outside the EEA (for example, through third-party messaging services), such transfers rely on appropriate safeguards including Standard Contractual Clauses (SCCs) or the service provider's adequacy decision.

14. Children's privacy

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a minor, we will delete it promptly.

15. Disclaimer of liability for user-uploaded data

Promo-Chats provides technology tools and does not control, verify, or assume responsibility for the personal data uploaded by Clients or the communications they send. Clients are solely responsible for the lawfulness, accuracy, and appropriateness of the data they upload and the messages they distribute. Promo-Chats shall not be held liable for any damages, claims, or regulatory action arising from a Client's misuse of the Platform or unlawful processing of personal data.

16. Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of the Platform after any changes constitutes acceptance of the updated policy.

17. Contact

For any privacy-related inquiries or to exercise your data protection rights: Email: privacy@promo-chats.com You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

© 2026 Promo-Chats. All rights reserved.