Privacy Policy

1. Who is responsible for your data

For Artist accounts (people who sign up to build pages), fanfir.st is the data controller. For fanswho submit their email or phone to unlock content on an Artist's page, the Artist is the data controllerand fanfir.st acts as a data processor on their behalf — we store and deliver that fan list to the Artist, who is responsible for how they use it. If you're a fan and want your data removed, you can contact us or the Artist directly.

2. Information we collect

From Artists: your name/artist name, email, password (stored hashed) or Google sign-in profile, the public Spotify artist link and public stats you choose to connect, your page content, and billing details processed by our payment provider (we do not store full card numbers).

From fans (on Artist pages): email and optional phone number, marketing consent and the exact consent text, and — to keep a lawful consent record — the time, IP address and browser user-agent of the opt-in, plus which unlock they claimed.

Automatically: basic usage and device data, page views, and product analytics events, including via cookies and similar technologies.

3. How we use it

• Provide and operate the service and deliver unlock rewards.
• Maintain the Artist's owned, exportable fan list.
• Process subscriptions and prevent fraud.
• Understand and improve the product (analytics).
• Communicate about your account and important changes.

Legal bases (where GDPR applies): performance of a contract, your consent (fan opt-ins and non-essential cookies), and our legitimate interests in running and improving the service.

4. Service providers we share data with

We share data only with vendors that help us run fanfir.st, under appropriate terms: Creem (payments/subscriptions), PostHog (product analytics), Neon (database), Vercel(hosting & file storage), and Google (optional sign-in). We fetch public artist stats from Spotify. We do not sell your personal data.

5. Your fan list is yours

Artists can export their fan list at any time — this is never paywalled. We provide fans as a service to the Artist; we don't market to an Artist's fans on our own behalf.

6. Cookies & analytics

We use essential cookies for sign-in and to recognize returning fans, and analytics cookies (PostHog) to understand usage. You can control cookies in your browser; blocking essential cookies may break sign-in.

7. Data retention

We keep account and fan data for as long as the account is active or as needed to provide the service, then delete or anonymize it, except where we must retain records (e.g. consent logs, tax/payment records) to meet legal obligations.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your data, to object, and to withdraw consent at any time. EU/UK users may also lodge a complaint with their local data protection authority. To exercise any right, contact us below.

9. International transfers & security

Your data may be processed outside your country by the providers listed above, with safeguards such as standard contractual clauses where required. We use industry-standard measures (encryption in transit, hashed passwords, access controls) to protect data, though no method is 100% secure.

10. Children

fanfir.st is not directed to children under 16, and we don't knowingly collect their data.

11. Changes & contact

We'll update this policy as the service evolves and revise the date above. Questions or requests: ronalds.palacis@gmail.com.