Privacy Policy

1. Two different roles

This one distinction decides who is responsible for what, so it comes first.

• For artist accounts — the people who sign up, subscribe and build campaigns — [LEGAL ENTITY NAME] is the data controller. We decide why and how that data is processed.
• For fan data collected through an artist's pages — e-mail addresses, platform actions, page analytics — the artist is the data controller and [LEGAL ENTITY NAME] is a processor acting on their instructions. If you are a fan and want your data removed, you can contact us and we will act, but the artist decides what their campaign collects and what they later send you.

2. What we collect

Artist accounts

• Identity and sign-in: e-mail address, display name, avatar, and the provider you signed in with (e-mail, Google or Apple) via Firebase Authentication.
• Profile and campaign content you enter: artist name, bio, links, uploaded audio and artwork, gate and smart-link configuration.
• Billing: subscription status and plan. Card details are handled by Polar and never reach our servers.
• Connected platforms: OAuth tokens for SoundCloud and Spotify, used only to perform the actions you configure.

Fans visiting a campaign page

• E-mail address, when the artist's page asks for one and you enter it.
• Platform identity and actions when you connect SoundCloud or Spotify: your public username and numeric id, plus the follow / like / repost / comment / pre-save the page asks you to complete. We do not read your private library beyond checking whether the requested action succeeded.
• Page analytics: country, city, device type, browser, operating system, referring URL and the event itself (view, click, unlock, download). We do not store your IP address alongside these events.

What we never collect

Card numbers, passwords for third-party platforms, and the contents of your SoundCloud or Spotify account beyond the specific action requested.

3. Why we process it

4. Marketing e-mail

An artist can e-mail fans who gave their address through that artist's pages. Two rules bind that, and they bind the artist as controller:

• Consent to marketing must be separate from getting the download. Entering an e-mail to unlock a track is not consent to a newsletter.
• Commercial electronic messages to recipients in Türkiye additionally require prior consent registered with İYS (İleti Yönetim Sistemi) under Law No. 6563. Registering and maintaining those consents is the sending artist's obligation, not ours.

Every broadcast carries an unsubscribe link. Unsubscribing is immediate and applies to that artist's list.

5. Who else sees the data

We do not sell personal data. We share it with the providers that make the product run:

Separately, an artist may switch on their own advertising pixels (Meta (Facebook) Pixel, Google Analytics 4 / Google Ads, TikTok Pixel) on their campaign pages. Those vendors then receive visit data directly. HypeLoves does not display a consent banner on an artist's behalf — an artist who enables pixels for visitors in the EU, UK or another consent jurisdiction is responsible for collecting that consent.

6. International transfers

Our providers operate globally, so data may be processed outside Türkiye and outside the EEA. Where that happens we rely on the provider's standard contractual clauses or equivalent safeguards.

7. How long we keep it

• Artist accounts and their content: for as long as the account exists. Deleting your account removes your profile, campaigns and uploaded files.
• Fan e-mail addresses: until the fan unsubscribes or the artist deletes the list or their account.
• Fan OAuth sessions: short-lived — the SoundCloud session token used to perform an action is held in cache for about an hour and is not stored in the database.
• Analytics events: retained to produce the artist's historical charts.
• Billing records: kept as long as tax and accounting law requires.

8. Your rights

Under KVKK (Law No. 6698) and, where it applies, the GDPR, you can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Where processing rests on consent, you can withdraw it at any time without affecting what was done before.

Write to [[email protected]]. We answer within 30 days. If you are a fan and your request concerns a specific artist's list, tell us which campaign so we can route it. You also have the right to complain to your supervisory authority — in Türkiye that is the KVKK Board (Kişisel Verileri Koruma Kurumu).

9. Security

Data is held on Cloudflare infrastructure, encrypted in transit. Access to production data is limited to people who need it to operate the service. No system is perfectly secure; if a breach affects your data we will notify you and the relevant authority as the law requires.

10. Children

HypeLoves is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has given us data, write to [[email protected]] and we will delete it.

11. Changes

We update this page when the product changes. The date at the top shows the current version. Material changes affecting artist accounts are announced by e-mail.

12. Contact

[LEGAL ENTITY NAME]
[REGISTERED ADDRESS, CITY, TURKEY]
[VKN / MERSIS]
[[email protected]]