Privacy Policy

Who we are

The data controller is WB Soft Wojciech Bator, ul. Braniborska 50/2, 53-680 Wrocław, Poland, NIP: 8943126279. CrowdRelay is operated by WB Soft. For any privacy request, contact contact@crowdrelay.music.

What we collect & why

When you sign up or subscribe, we process your name, email, billing details and company information to provision and operate your workspace. Legal bases: performance of a contract, your consent, and our legitimate interest in operating the service you asked for.

CrowdRelay aggregates fan data from sources you connect — Reddit, Meta, Spotify, Bandsintown, forums, press, live shows and others — to build a unified fanbase. We process fan identifiers, engagement signals, and contact details to grow and convert fans through genuine engagement. Legal bases: your legitimate interest as a business reaching your own audience, and consent where required by the source platform or applicable law.

We process operational telemetry — autopilot decisions, approval records, audit logs — to provide the service and maintain an auditable record of what the system changed and why.

Data we read from Meta

A band can connect its own Facebook Page, Instagram professional account and Meta ad account through Facebook Login for Business. It picks the Page and accounts in Meta’s own window and can leave any of them out. We read only from what it connected, and only what the work around its nights and the report after them need:

• Private messages. When someone comments the band’s keyword under one of its posts to ask for a link, we send that person one private reply from the Page or the Instagram account, and keep the reply and whether it arrived. We do not read the rest of the Page’s or the account’s inbox. Permissions: pages_messaging, instagram_manage_messages.
• Comments on the band’s Page and Instagram posts. We read the comments under the band’s own posts, and the posts its Page is tagged in, to spot people asking for tickets or a link and to draft an answer for the band. We keep the comment and the name it was posted under. Permissions: pages_read_user_content, instagram_manage_comments, and pages_manage_engagement only to post the band’s answer under a comment.
• Page, Instagram and ad insights. The band’s own posts and how many people each one reached, follower counts, and, for a connected ad account, what each campaign spent and what it brought. These are counts, not people, and they go into the report for each night. Permissions: pages_show_list (to list the Pages the band can pick), pages_read_engagement, instagram_basic, read_insights, instagram_manage_insights, ads_read.

We read; the band decides what goes out. Nothing is posted, replied or sent in the band’s name until someone in the band approves it, or until the band itself switches on automatic answers for that account in the console. This connection only reads the band’s ads; we change an ad budget only where the band has agreed to that in writing first.

How long we keep it. For the life of the band’s workspace, as under Retention below, and deleted within 30 days of the band asking or of its subscription ending. Disconnecting the account in the console stops all reading at once and deletes the access Meta gave us.

Who decides about it. The messages and comments come from the band’s fans, and the band that connected the account is the controller of them. WB Soft processes them on the band’s behalf and uses them for nothing else; for the band’s own account details WB Soft stays the controller, as above. The band can export its fan list and delete single fans or the whole list at any time in the console, and can ask us at contact@crowdrelay.music to export or delete anything else we read from Meta. How deletion works, step by step: Data deletion.

Who processes your data

We share data only with processors needed to run the service:

• Stripe — payment processing
• PostgreSQL / EU-hosted cloud — primary database
• LLM providers — intelligence gathering and content drafting, as workers under our direction
• Source platforms (Reddit, Meta, Spotify, Bandsintown) — fan data sources you authorize
• PostHog, Google (Google Analytics 4) and Microsoft (Clarity) — analytics on this website, only after you say yes (see Cookies and analytics below); PostHog also for the control plane
• Cal.com — booking the onboarding call on the welcome page
• Google (YouTube API Services) — publishing videos to CrowdRelay’s own YouTube channel, and a band’s own channel when the band connects it (see YouTube API Services below)
• Google (Google Calendar API) — a band member’s calendar, only when they connect it (see Google Calendar below)

Google Calendar

A band member can connect their own Google Calendar so the band’s shows and the dates CrowdRelay proposes stay in one plan. They sign in through Google’s own window and choose what to allow. We ask for these permissions and use each only as described:

• calendar.app.created — to create one CrowdRelay calendar in the member’s account and keep the band’s shows in it. We do not touch any other calendar this way.
• calendar.freebusy — to read when the member is busy over the next 93 days, as start and end times only. We never see event titles, places, guests or descriptions. We read it about every 30 minutes and replace what we hold each time, so a show is not proposed on a day the member cannot play.
• calendar.calendarlist.readonly — to show the member the list of their calendars, so they can choose which ones count.
• openid and email — to know which Google account was connected.

Busy times are visible only to the band the member belongs to. We do not sell this data, use it for advertising, or let anyone outside the band read it, except where the member asks or the law requires. CrowdRelay’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

A member can revoke CrowdRelay’s access at any time in the Google security settings. After that we read nothing more from their calendar. To delete the busy times and the connection we hold, write to contact@crowdrelay.music.

YouTube API Services

CrowdRelay uses YouTube API Services in two ways: to upload the short videos it makes to CrowdRelay’s own YouTube channel, and to work with a band’s own channel when the band connects it. By using these features you agree to be bound by the YouTube Terms of Service, and the Google Privacy Policy applies to the data Google processes.

CrowdRelay’s own channel. We upload our short videos and read the channel’s ID and name to confirm we post to the right account. Its access token is kept on the one company computer that uploads, and is used for nothing else.

A band’s own channel. A band member can connect the band’s YouTube channel. They sign in through Google’s own window and allow:

• openid and email — to know which Google account was connected.
• youtube.force-ssl — to post the band’s replies to comments on its own videos, a comment of the band’s own under its uploads, and edits to its own videos’ descriptions; and a comment of the band’s under someone else’s video. A comment on someone else’s video always waits for a band member’s approval. Everything else waits too, unless a band member has switched on automatic posting on the band’s own channel in the settings.
• yt-analytics.readonly — to read the band’s own YouTube Analytics: views of its videos by traffic source, referring site and city, as counts, never individual viewers, so the band’s report can say what brought people.

With our API key we also read public data about the band’s channel: its videos and their statistics, its subscriber count, the comments on its videos, and the replies people write under the band’s comments. A comment is kept with its text, its author’s name and channel ID for at most 30 days, and is deleted sooner when it is deleted on YouTube. Comment text may be passed to the language-model providers listed above, only to draft the band’s reply. Statistics are kept as the band’s numbers over time for at most 90 days; the list of the band’s own videos is refreshed from YouTube while the channel is connected. The band’s access token is kept in our database and used only for the above. We do not sell YouTube data, use it for advertising, or share it with anyone else. CrowdRelay’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

This integration places no cookies on your device. The owner of either channel can revoke CrowdRelay’s access at any time in the Google security settings. To have the data we hold about a channel deleted, or with any question about this, write to contact@crowdrelay.music.

Where data lives

All fan data, tenant data and operational records are stored in the EU. We do not transfer personal data outside the EU without a valid adequacy decision or appropriate safeguards (Standard Contractual Clauses). LLM providers may process data outside the EU under their own DPA terms; we minimise what is sent and never send full fan PII to LLM workers. Analytics are the other exception: after your yes on this website, and on the control plane, PostHog, Google and Microsoft may process visit data in the US, on the terms given for each under Cookies and analytics.

Retention

We keep billing and invoicing data for as long as required by tax and accounting law. Fan data is retained for the life of your workspace and deleted within 30 days of subscription termination, unless a longer period is needed to establish or defend legal claims. Audit logs are retained for the life of the workspace plus 90 days.

Your rights

Under the GDPR you may access, rectify, erase, restrict or port your data, object to processing, and withdraw consent at any time. You also have the right to lodge a complaint with the Polish supervisory authority (UODO).

Fan data & deletion

Tenants may request deletion of individual fan records or their entire fanbase at any time through the control plane or by contacting us. Fan data deletion propagates to all derived views, search indices and LLM-generated intelligence within 30 days. A minimal pseudonymous tombstone and consent evidence may be retained for audit integrity.

Security

All data is encrypted in transit (TLS 1.3) and at rest. Access to production data is restricted to named operators with audit-logged access. We do not store full payment card details — Stripe handles card data under PCI-DSS.

Cookies and analytics

This website (crowdrelay.music) loads no analytics and stores nothing on your device for them until you say yes in the banner. Before you answer, it counts the visit without either: see “Counting visits without cookies” below. The one exception is the booking calendar on the welcome page (Cal.com, below), which loads because booking a call is what that page is for. Saying no is as easy as saying yes, and you can change your answer at any time with “Cookie settings” at the foot of every page. A no deletes the analytics cookies and stored entries listed below if an earlier visit left any; taking a yes back also stops the tools already running and reloads the page. Nothing on this website loads Meta (Facebook or Instagram) code.

The control plane (control.crowdrelay.music) signs you in with strictly necessary HttpOnly session cookies. It also runs PostHog for product analytics, error reports and session replay of operator sessions, with all text and form fields masked and images blocked. There PostHog stores the same ph_<project key>_posthog cookie described below, with a copy in localStorage. The control plane does not yet ask before PostHog starts; adding that question is open work. Legal basis until then: our legitimate interest in keeping the console working for the people who operate it (GDPR art. 6(1)(f)).

Your answer. We keep it in your browser’s localStorage under cr-consent — just “yes” or “no” and the date — for 12 months, then ask again. It is written only when you click, and storing it needs no consent: it is how we remember not to ask again.

PostHog (PostHog, Inc., US cloud; scripts from us-assets.i.posthog.com, data sent to us.i.posthog.com). Loaded only after your yes; after a no, this website sends PostHog nothing. Before you answer, it sends PostHog only the cookieless count described below. Purpose: count visits, page views and page exits, see which links are clicked, and catch JavaScript errors, so we can improve the site. It is not used for advertising. IP addresses are anonymised in our PostHog project.

• Stores a visitor id in a first-party cookie ph_<project key>_posthog on crowdrelay.music and its subdomains for 365 days, with a copy in localStorage and a tab id and window id in sessionStorage. The control plane uses the same cookie, so a visit here and a sign-in there can be linked.
• Records the visit as a replay: every piece of text and every form field masked, images and video blocked. The replay also keeps page load timings; it does not keep console messages.
• Retention: replays are deleted after 30 days; events are kept for the period our PostHog plan sets (1 year on the free plan, up to 7 years on a paid one), unless we delete them earlier on request.
• Legal basis: your consent. PostHog processes the data in the US under the Standard Contractual Clauses in its data processing agreement.

Counting visits without cookies. Before you answer the banner, each page sends PostHog one count of the page you opened, and a click on “Book a call” sends one more. The request carries the page’s address and nothing else from us: no script loads, no cookie is sent or set, and nothing is stored on or read from your device. PostHog combines the request’s IP address and browser name with a key that changes every day, keeps only the result, and does not keep the IP address, so a visit cannot be linked to you or to another day. After a no, or once a yes runs the tools above, this count stops. Purpose: know whether anyone visits and books a call. Legal basis: our legitimate interest in counting visits to our own site (GDPR art. 6(1)(f)); you can object by answering the banner with a no.

Google Analytics 4 (Google Ireland Ltd; script gtag.js from www.googletagmanager.com, data sent to google-analytics.com). Loaded only after your yes. Purpose: count visits and where they came from. Advertising features, Google signals and ad personalisation are switched off, and Google Analytics 4 does not store IP addresses.

• Stores the cookies _ga and _ga_<id> on crowdrelay.music for up to 2 years.
• Retention: Google keeps the event data for the period set in our property (Google’s default is 2 months; the longest available on the free product is 14 months).
• Legal basis: your consent. Google may process data in the US under the EU–US Data Privacy Framework.

Microsoft Clarity (Microsoft Corporation; script from clarity.ms). Loaded only after your yes. Purpose: heatmaps and session recordings that show where the page confuses people. Clarity hides what you type into form fields; other text on the page can appear in its recordings.

• Stores the cookies _clck (1 year) and _clsk (1 day) on crowdrelay.music, and Microsoft may set its own MUID cookie on clarity.ms (1 year).
• Retention: Microsoft deletes recordings after 30 days, unless we mark one as a favourite.
• Legal basis: your consent. Microsoft may process data in the US under the EU–US Data Privacy Framework.

Cal.com (Cal.com, Inc.; app.cal.com). Loaded only on the welcome page, where its calendar is the way to book your onboarding call; it loads with the page, before any answer in the banner, because booking is what you came to that page to do. Cal.com receives the details you enter in the booking form and may set cookies needed for the calendar to work. Legal basis: steps you asked us to take before a contract (GDPR art. 6(1)(b)). Cal.com keeps the booking under its own privacy policy; we keep the booking email with your customer record for as long as we keep that record (see Retention).