Privacy Policy

Who we are

The data controller is WB Soft Wojciech Bator, ul. Braniborska 50/2, 53-680 Wrocław, Poland, NIP: 8943126279. CrowdRelay is operated by WB Soft. For any privacy request, contact contact@crowdrelay.music.

What we collect & why

When you sign up for a trial or subscribe, we process your name, email, billing details and company information to provision and operate your workspace. Legal bases: performance of a contract, your consent, and our legitimate interest in operating the service you asked for.

CrowdRelay aggregates fan data from sources you connect — Reddit, Meta, Spotify, Bandsintown, forums, press, live shows and others — to build a unified fanbase. We process fan identifiers, engagement signals, and contact details to grow and convert fans through genuine engagement. Legal bases: your legitimate interest as a business reaching your own audience, and consent where required by the source platform or applicable law.

We process operational telemetry — autopilot decisions, approval records, audit logs — to provide the service and maintain an auditable record of what the system changed and why.

Who processes your data

We share data only with processors needed to run the service:

• Stripe — payment processing
• PostgreSQL / EU-hosted cloud — primary database
• LLM providers — intelligence gathering and content drafting, as workers under our direction
• Source platforms (Reddit, Meta, Spotify, Bandsintown) — fan data sources you authorize

Where data lives

All fan data, tenant data and operational records are stored in the EU. We do not transfer personal data outside the EU without a valid adequacy decision or appropriate safeguards (Standard Contractual Clauses). LLM providers may process data outside the EU under their own DPA terms; we minimise what is sent and never send full fan PII to LLM workers.

Retention

We keep billing and invoicing data for as long as required by tax and accounting law. Fan data is retained for the life of your workspace and deleted within 30 days of subscription termination, unless a longer period is needed to establish or defend legal claims. Audit logs are retained for the life of the workspace plus 90 days.

Your rights

Under the GDPR you may access, rectify, erase, restrict or port your data, object to processing, and withdraw consent at any time. You also have the right to lodge a complaint with the Polish supervisory authority (UODO).

Fan data & deletion

Tenants may request deletion of individual fan records or their entire fanbase at any time through the control plane or by contacting us. Fan data deletion propagates to all derived views, search indices and LLM-generated intelligence within 30 days. A minimal pseudonymous tombstone and consent evidence may be retained for audit integrity.

Security

All data is encrypted in transit (TLS 1.3) and at rest. Access to production data is restricted to named operators with audit-logged access. We do not store full payment card details — Stripe handles card data under PCI-DSS.

Cookies

The marketing site uses only what is needed to function. The control plane uses strictly necessary HttpOnly session cookies for authentication. No third-party tracking cookies are set.

Site analytics: the marketing site uses PostHog (US cloud, IP addresses anonymised) to measure visits, page views and JavaScript errors, and to record anonymised sessions with every form field masked. PostHog stores a first-party identifier in your browser to recognise a returning visit. It is used to improve the site, not for advertising, and is not linked to the control plane unless you sign in there. The control plane itself uses PostHog for product analytics, error reports and masked session replay of operator sessions, under the same terms.