Privacy Policy — The Plug

1. Who is responsible for your data

The data controller is Nicolas Dufriche (professional name Nick Green), a sole trader based in the United Kingdom, operating The Plug. Contact for any privacy question or request: ngreen@nextplaymusic.io.

Postal address: 23 Waghorn Street, London, SE15 4LA, United Kingdom.

2. The data we collect

Account data: your email address, how you sign in (email link or password), your account type (Creator or A&R) and account status.
Profile data you add: such as your display name, profile picture, alias, bio, location, genres, skills, credits, publishing status and links to Spotify or SoundCloud. For A&Rs, the professional details you provide, such as your company or label and your taste profile, and the information in your application for an Industry account.
Consent records: your confirmation that you are 18 or older, the version of the Terms you accepted and when, your confirmation of the sample clearance policy and, if you buy a paid plan, your request for it to start immediately and when you made it (kept with your subscription at Stripe).
Music submissions: the audio files you upload, track titles and other track information, the opportunities you submit to, when you submitted, and whether you made a submission public.
Opportunities, reviews and feedback: opportunities posted by A&Rs, and the outcomes, ratings, feedback and pitches A&Rs give on submissions.
Messages and connections: who you are connected to and the messages you exchange on The Plug.
Subscription and payment data: your plan, submission allowance, and the Stripe customer and subscription references and payment status we need to manage your subscription. Your card details are entered on Stripe and handled by Stripe — we never receive or store them.
Activity and technical data: records of actions in your account (such as submissions made), moderation and administration records, and technical logs kept by our hosting providers (such as IP address, browser type and time of request).

3. Why we use your data and our legal bases

To provide The Plug — creating and running your account, showing opportunities, delivering submissions to A&Rs, delivering reviews and feedback to Creators, messaging and your public profile. Legal basis: performance of our contract with you.
To manage paid plans — taking payments through Stripe, applying your submission allowance and handling failed payments. Legal basis: contract; and legal obligation for the accounting and tax records we must keep.
To send service emails — sign-in links, account and subscription confirmations, notifications about your submissions, feedback, pitches, messages and deadlines, and weekly activity digests. Legal basis: contract, and our legitimate interest in keeping you informed about activity in your account.
To keep The Plug safe — approving Industry accounts, moderation, preventing abuse and fraud, security, and enforcing our Terms. Legal basis: our legitimate interests in running a safe and trustworthy service.
To keep records of your consent and age confirmation. Legal basis: legal obligation and our legitimate interest in being able to show what you agreed to.
To improve The Plug using activity within the service. Legal basis: our legitimate interests.

We do not sell your personal data, use it for advertising or send marketing emails. Automated music analysis is not enabled in the current production service. If this changes, we will update this policy before the processing begins and provide any choice the law requires. We do not use submitted music to train generative AI models.

4. Who can see your data

Authorised A&Rs and administrators can access private submission audio where needed to review, moderate or support it. Other Creators cannot access private submission audio. Content a Creator deliberately marks public may be visible to visitors.
Creators see opportunities, information about the A&Rs behind them, and the outcomes and feedback on their own submissions.
Anyone, including visitors without an account, can see Creator public profiles (the profile data listed above, badges and activity counts), submissions a Creator has chosen to make public, public opportunities and the Community ranking.
People you message see your messages.
Our administrators can access account data where needed for support, approvals and moderation. Administrative actions are recorded in an audit log.
Authorities, where the law requires it.

We use these service providers, who process data on our behalf:

Supabase — database, sign-in and file storage (including your audio and pictures). Our project is hosted in the EU (Paris, France).
Vercel — website hosting. Our application runs in the EU (Paris, France), and pages are delivered through Vercel's global network.
Stripe — payment processing and subscription management. Stripe also uses some payment data as an independent controller for its own purposes, such as fraud prevention and meeting its legal obligations, under Stripe's privacy policy.
Resend — delivery of our emails, from the EU (Ireland).
Spotify — we look up public artist and track information on Spotify (for example from links or artist names entered on The Plug). We do not send your account data to Spotify.

5. International transfers

Our main data storage is in the European Economic Area, which the UK recognises as providing adequate protection for personal data. Some of our service providers are based in, or may access data from, other countries, including the United States. Where personal data is transferred outside the UK, it is protected by safeguards recognised under UK law, set out in each provider's data processing agreement:

Supabase and Vercel — the EU Standard Contractual Clauses with the UK International Data Transfer Addendum issued by the ICO.
Resend — the UK Extension to the EU-US Data Privacy Framework, and the EU Standard Contractual Clauses with the UK Addendum.
Stripe — the UK-US Data Privacy Framework, or the EU Standard Contractual Clauses with the UK Addendum, as set out in Stripe's Data Transfers Addendum.

6. How long we keep your data

We keep your account, profile, submissions, reviews, feedback and messages for as long as your account exists. We do not currently delete this data automatically after a fixed period.
Opportunities that have expired stop being shown after 10 days but remain stored.
When you ask us to delete your account, we delete your account and the data linked to it. Internal activity records are kept, but no longer linked to you. We keep the records we must keep by law, such as payment and tax records, for as long as HMRC requires: at least 5 years after the 31 January Self Assessment deadline for the tax year they relate to.
Deletion from the live service may not immediately remove copies held for a limited period in provider backups or security logs. Those copies are isolated from ordinary use and expire under the provider's retention schedule.

7. How we protect your data

We use encrypted connections (HTTPS), database access rules that limit each user to the data they are allowed to see, restricted and audited administrator access, and keep secret keys on the server only. Card details are handled by Stripe and never reach us. No system is completely secure, but we work to protect your data and will act promptly if a problem occurs.

8. Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict or object to how we use it, to receive a copy of data you gave us in a portable format, and to withdraw consent where we rely on it. You can update much of your profile yourself in your settings. To exercise any right, including deleting your account, contact us at ngreen@nextplaymusic.io. We will reply within one month.

9. Complaints

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.

10. Cookies and similar technologies

The Plug uses sign-in cookies and browser storage needed to provide the service. We do not use analytics, advertising or tracking cookies. See our Cookie Information for the current details.

11. Children

The Plug is only for people aged 18 or older. If we learn that someone under 18 has created an account, we will close it.

12. Changes to this policy

We will update this policy when our practices change and show the date of the last update at the top. If a change requires your agreement, we will ask you to accept it before you continue using your account. See also our Terms of Service.

13. Contact

For any question about this policy or your data: ngreen@nextplaymusic.io.