Skip to content

PRIVACY POLICY

Effective June 12, 2026

What data we collect

  • Account holders (Artists, Creators, Venues, Promoters, Festivals, Media, Record Labels, Talent Management, Booking Agencies, and Partners): email address, password (hashed), profile information (name, bio, genre, location), uploaded images, and content you add (releases, tour dates, events, social links). Account type is stored to customize your experience. Record Label, Talent Management, Booking Agency, and Partner accounts are admin-provisioned or invite-only and may not have a public-facing profile.
  • Fan geolocation (Quiet Hours & Tour Routing): when a fan submits city/state on an opt-in form, we send that text to Google Maps Platform's Geocoding and Time Zone APIs to derive an approximate latitude/longitude and IANA time zone. These values are stored alongside the subscriber row and used only to (a) hold messages until 8 AM in the fan's time zone (Quiet Hours) and (b) route tour-stop alerts to nearby fans (Tour Radius Routing). The city/state the fan already provided is the only data transmitted; no IP address or device-level location is used.
  • Fans: email address, first name, city, state, country, and phone number (if provided) — collected through fan page forms. This data belongs to the artist. bckstg℠ may use fan email addresses to send platform-level announcements as described in the Platform Announcements section below.
  • Spotify pre-save tokens: encrypted OAuth refresh token scoped to user-library-modify. Used only to save the release to the fan's Spotify library on release date. No other use.
  • Apple Music pre-add tokens: MusicKit tokens used solely to add a release to a fan's Apple Music library on release date.
  • SMS opt-ins: when SMS messaging is enabled on your account, phone numbers collected through fan opt-in forms are stored in your account and used only to send SMS messages you initiate. bckstg complies with A2P 10DLC and TCPA requirements. Fans can opt out at any time by replying STOP, and can re-subscribe by replying START.
  • Analytics: page view counts by country, referrer URLs, streaming platform click events (platform and release ID only — no PII), fan city request aggregates, and SMS click events (link clicked, timestamp — no PII) — collected when SMS messaging is enabled on your account.
  • Transaction Data: When you purchase Digital Goods through the Platform, your email address is collected for purchase verification and content delivery. Payment credentials are processed by Stripe — bckstg never sees your card details.
  • Seller Financial Data: When Sellers connect a Stripe account, Stripe processes their financial data per Stripe's Connected Account Agreement. bckstg receives only the Stripe account ID and payout status.
  • Advanced Analytics uploads: CSV files uploaded through the Advanced Analytics feature are processed entirely in your browser. This data is NOT sent to or stored on bckstg servers. It is discarded when you close the page.
  • Messages and communications: when you use the bckstg messaging system, we store message content, thread metadata (participants, timestamps, read status), and any booking context associated with threads. This data is used to deliver messages, maintain conversation history, and resolve disputes. Messages are not used for advertising or sold to third parties.
  • Imported subscriber lists: if you upload a subscriber CSV from a third-party service (Mailchimp, Laylo, Beacons, etc.), we store the email addresses you provide, along with the import source you identify and the import timestamp. This data is associated with your account and is used solely to populate your bckstg email list. bckstg will not use imported subscriber data to send platform announcements or any other communications from bckstg. Imported subscribers have consented to hear from you — not from us. We do not sell, enrich, or share imported subscriber data with third parties.
  • Media booking requests and project data: when you submit or receive a booking request through the Media Marketplace, we store request details including service type, event information, proposed fees, deliverables, and status changes. For media accounts, we also store portfolio items, availability windows, and booking preferences. Financial details within booking requests (quoted fees, payment status) are visible only to the participants in that booking.

How we use your data

  • To provide and operate the bckstg service.
  • To send transactional emails (password resets, subscription receipts, invitation emails).
  • To show artists their fan analytics.
  • We do not sell your data. We do not use your fan list or fan data for advertising. When an account signs up or completes a checkout, we share an encrypted conversion signal with Meta so we can measure our own ad campaigns — fan data is never included.

AI pitch and press release tools — important clarification

bckstg uses the Anthropic API to power its AI pitch and press release generation tools. When you use these features, the text information you have entered into your profile (artist name, genre, bio, and release details) is sent to Anthropic's API to generate your document.

These AI tools work exclusively with the text you provide. bckstg does not send any audio or music files to Anthropic or any other third-party AI service. No AI system on bckstg analyzes, learns from, or processes your music in any way.

bckstg's prompts are informed by DSP industry best practices drawn from professional masterclasses, conferences, and platform guidelines. This is not a generic AI writing tool — it is purpose-built for the music industry. Data sent to Anthropic via the API is not used to train Anthropic's models by default, per Anthropic's API data usage policy.

Track Vault

When you upload a track to the Track Vault, bckstg writes a unique, invisible identifier into the audio file. This identifier — called a watermark — is different for every copy shared. If a copy leaks, the watermark tells us exactly which share it came from.

This is a technical process, not an AI process. bckstg does not analyze your music, does not attempt to understand its content, does not run any machine learning against it, and does not use it to train any model. The watermark is a data tag written into the file. That is the full extent of what bckstg does with your audio.

bckstg does not share your audio files with any third party. Original files and watermarked copies are stored in your private storage and are not accessible to anyone without your explicit share invitation. You may delete your Vault tracks and all associated shares at any time.

No selling of data

bckstg does not sell, rent, or trade personal data of artists, creators, venues, promoters, or fans to any third party. Fan data collected through your fan page belongs to you. bckstg does not use it for advertising and does not sell, rent, or trade it to third parties. bckstg may use fan email addresses to send platform-level announcements — fans can unsubscribe from those at any time.

“Fan data collected through your bckstg page — emails, phone numbers, city requests, pre-save opt-ins — belongs to you. bckstg does not sell it, rent it, or trade it. bckstg does not use it for advertising or to promote other accounts. bckstg may send fans platform-level announcements about features relevant to them — fans can unsubscribe at any time.”

Website Analytics & Advertising

BCKSTG uses analytics and advertising cookies, including the Meta Pixel, on our own marketing and product pages to measure site traffic and improve our advertising. This tracks how visitors interact with bckstg.co. It does not access, include, or transmit any artist's fan subscriber list. Fan email addresses are never shared with Meta or any advertising platform. Visitors in regions where consent is required see a cookie banner on first visit and can change their choice anytime via the Cookie preferences link in the footer. We honor Global Privacy Control automatically.

Data storage and security

All data is stored via Supabase. We use row-level security (meaning your data is protected at the database level — queries cannot mix your data with another user's), encrypted connections (TLS), and hashed passwords. We perform regular backups.

Authorized account managers (labels, management, booking agencies)

Artist and creator accounts may grant a label, management firm, or booking agency access to act on their behalf. When you accept a roster invite, the parent account's admins and editors can:

  • Edit your releases, tour dates, and social links
  • Send email/SMS blasts as you
  • Access your subscriber list (and export it as a CSV)
  • View your analytics and Track Vault

Every action they take on your behalf is logged with timestamp and actor. You can review the full audit trail at /dashboard/account/activity and revoke access at any time from /dashboard/account/team. When your subscriber list is exported by anyone other than you, you receive an in-app notification.

A label/agency role does not grant access to fan accounts (your fans' data), Stripe payment details, password reset, or account deletion — those remain owner-only.

Third-party services

  • Supabase — database and authentication. Data stored in the EU. Subject to Supabase's Privacy Policy.
  • Stripe — payment processing and Stripe Connect for paid content. We never see or store full card numbers. Subject to Stripe's Privacy Policy.
  • Spotify — pre-save OAuth. Tokens stored encrypted, scoped to library modification only. Subject to Spotify's Privacy Policy.
  • Apple Music — pre-add flow via MusicKit. Tokens expire after ~6 hours. Subject to Apple's Privacy Policy.
  • SoundCloud — Listen & Repost flow. Fan actions performed with explicit consent. Subject to SoundCloud's Privacy Policy.
  • Ticketmaster — read-only event sync. No fan data transmitted. Subject to Ticketmaster's Privacy Policy.
  • Eventbrite — OAuth event import. No fan data transmitted. Subject to Eventbrite's Privacy Policy.
  • Twitch — OAuth live detection, scoped to stream status only. Subject to Twitch's Privacy Notice.
  • Kick — OAuth 2.1 live detection, scoped to stream status only. Subject to Kick's Privacy Policy.
  • YouTube — API key only, no OAuth, used for embeds and autofill. Subject to Google's Privacy Policy.
  • Audiomack — 2-legged OAuth via the Onelink Search API. Used to resolve release metadata (title, artist, cover art) and cross-DSP links from an Audiomack URL/ISRC/UPC. No fan data transmitted. Subject to Audiomack's Privacy Policy.
  • Google Maps Platform (Geocoding & Time Zone APIs) — when a fan submits city/state on an opt-in form, that text is sent to Google to derive an approximate latitude/longitude and IANA time zone, which power Quiet Hours and Tour Radius Routing. Only the city/state already provided is transmitted. Subject to Google's Privacy Policy.
  • MasterTour (Eventric) — when connected, your tour and itinerary data syncs with Eventric's MasterTour platform. bckstg stores your MasterTour OAuth credentials in encrypted form. Tour data is transmitted only to display and sync your itinerary. Subject to Eventric's terms.
  • Laylo — optional. Fans who opt in have email/phone sent to Laylo. bckstg never stores your Laylo API key in readable form. Subject to Laylo's Privacy Policy.
  • Resend — transactional email and blast delivery. Fan emails transmitted only at send time. Subject to Resend's Privacy Policy.
  • Signalhouse — SMS delivery. When SMS messaging is enabled, fan phone numbers are transmitted to Signalhouse solely to deliver messages initiated by the accounts they have opted in to. Subject to Signalhouse's Privacy Policy.
  • Cloudflare Turnstile — bot protection on auth forms (login, signup, password reset, fan page email capture, waitlist). Operates as an invisible challenge — no user interaction required. Subject to Cloudflare's Privacy Policy.
  • Cloudflare Stream — live video delivery and storage. RTMPS streams processed through Cloudflare infrastructure. Stream credentials (UID, stream key, playback URL) stored on your account. Stream metadata and viewer presence handled per Cloudflare's Privacy Policy.
  • Anthropic — two uses. (1) Pitch and press-release generation: text data from your profile (artist name, genre, bio, release details) is sent to Anthropic's API. No audio files are transmitted. (2) Roadie, the in-dashboard assistant: your typed questions plus a small slice of help-center context are sent to generate answers. No fan data, audio, or payment data is transmitted in either case. Per Anthropic's API policy, data is not used to train their models by default.
  • Meta (BCKSTG AMP) — optional. If you connect a Meta Business account through BCKSTG AMP, BCKSTG stores an encrypted access token used solely to create and manage ad campaigns you initiate from within BCKSTG. Meta charges your payment method on file with Meta directly for any ad spend; BCKSTG does not bill you for ad spend and does not hold, route, or settle ad-budget funds. Subject to Meta's business terms.
  • Vercel — hosting and CDN. Subject to Vercel's Privacy Policy.
  • Upstash — rate limiting infrastructure. IP addresses and session identifiers are processed to prevent abuse. No personal data is stored beyond the request window. Subject to Upstash's Privacy Policy.

Artist audience exports

Artists on a Pro plan can export their fan subscriber list as a hashed file for use in third-party advertising platforms such as Meta Ads Manager. Before any export is generated, every email address is normalized and converted to a SHA-256 hash — a one-way cryptographic process. The original email address is never included in the exported file and cannot be recovered from the hash.

BCKSTG does not transmit fan email addresses to Meta or any other advertising platform. The exported file is delivered only to the artist who owns that subscriber list. What the artist does with the file after download is governed by their own obligations under applicable privacy law and the terms of the platform they upload it to.

Fan email addresses are collected only with the fan's consent at the point of subscription on the artist's fan page. Fans can unsubscribe at any time via the unsubscribe link in any email or directly on the artist's fan page.

Artist-enabled tracking pixels

Creators on bckstg may connect their own Meta (Facebook) Pixel ID or Google Analytics Measurement ID through their account dashboard. When enabled, these scripts are injected on that creator's public fan page only, and fire a standard PageView event when a visitor loads the page.

bckstg does not control, receive, or have access to the data collected by these artist-installed scripts. The data collected is governed by Meta's Privacy Policy and Google's Privacy Policy, not by bckstg.

If you are a fan visiting a creator's page and do not want your visit tracked by third-party scripts, you may decline cookies via our banner, send Global Privacy Control (we honor it automatically), or use a browser extension that blocks tracking scripts (such as uBlock Origin or Privacy Badger).

BCKSTG AMP and custom landing page tracking

If you run ads through BCKSTG AMP or build a Custom Landing Page with a tracking pixel enabled, the pixel fires on the public landing page only and reports events directly to the ad platform (Meta) tied to your connected ad account. BCKSTG does not receive or store this pixel data; it flows from the fan's browser to Meta. The Meta access token BCKSTG stores on your behalf is used only to create and manage campaigns you initiate; BCKSTG never sees or holds ad-spend funds.

Profile backdrops

Pro and Lifetime accounts may upload a photo or video as an ambient background on their public fan page. Uploads are stored on BCKSTG and served through our CDN; the file is publicly accessible at its CDN URL when your fan page is loaded. You may remove or replace the backdrop at any time; removal deletes the file from storage.

Partner public profiles

Approved Partner accounts may opt in to a public profile at bckstg.co/p/{handle} displaying the partner's name, avatar, bio, featured link, and any press articles the partner has published through BCKSTG. Opting in makes these fields publicly indexable. Partner accounts that do not opt in have no public-facing surface. Partners may toggle the public profile off at any time from the dashboard.

Platform announcements to fan subscribers

When you subscribe to an artist's list on BCKSTG, the artist receives your email for their own list. BCKSTG may also occasionally email you about platform-level announcements (new features for fans, security notices, policy changes). You can unsubscribe from either at any time.

You can unsubscribe from bckstg platform communications at any time using the unsubscribe link in any email we send. Unsubscribing from bckstg platform emails does not remove you from any creator's individual list, and vice versa.

bckstg does not sell or share your email address with advertisers or any third party outside of the creator whose page you subscribed through.

Custom domains

Users on eligible plans may connect a custom domain to their bckstg fan page. When a custom domain is connected, bckstg registers that domain with our hosting provider (Vercel) to provision SSL and route traffic. The domain name itself is stored on your profile. No additional personal data is collected as a result of using a custom domain.

Email broadcasts

Artists and creators on eligible plans may send email broadcasts to their subscriber list via bckstg. Emails are delivered through Resend. Every broadcast email includes a one-click unsubscribe link. Fans who unsubscribe are immediately removed from future broadcasts. bckstg does not use your subscriber list for advertising, third-party promotions, or to promote other accounts on the platform. bckstg may send fans platform-level announcements about features relevant to them — see the Platform Announcements section.

Live Streaming

When you use BCKSTG Live Streaming as a creator, we collect and store your Cloudflare Stream live input credentials (stream UID, RTMPS URL, stream key, HLS playback URL) associated with your account. Stream start times and session metadata are stored to support dashboard features such as duration tracking and chat history.

When fans participate in a live stream chat, we collect their name and email address, which is added to the creator's subscriber list (with the fan's acknowledgment at time of submission). Chat messages, including message content, sender name, and timestamp, are stored and associated with the stream session. Deleted and moderated messages are soft-deleted (marked as deleted) and no longer displayed, but may be retained in our database for a period of time before permanent deletion.

We use Cloudflare Stream (cloudflare.com) to power live video delivery. Video streams are processed and delivered through Cloudflare's infrastructure. Please refer to Cloudflare's privacy policy for information about their data practices.

Viewer presence data (anonymous session tokens used to count concurrent viewers) is stored temporarily and automatically expires. We do not associate viewer presence data with personally identifiable information unless the viewer authenticates via the chat system.

18+ content and age gate

Fan pages with adult content enabled display an age confirmation gate. Visitors must self-confirm they are 18 or older before the page content is revealed. bckstg does not collect, store, or transmit any data as a result of this interaction. No record of a visitor's age confirmation is retained.

Theme preferences

User-selected fan page themes are stored on the artist's profile. No tracking data or analytics are associated with theme selection.

Your rights and data export

You have the right to access and delete your data at any time. Pro and Lifetime users can export data in CSV or JSON format from the dashboard. To request full data deletion, email us at support@bckstg.co and we will complete the request within 30 days.

Cookies

We use essential cookies to keep you signed in, plus analytics and advertising cookies (including the Meta Pixel) on our marketing pages to measure traffic and improve our own ad campaigns. Visitors in regions where consent is required see a banner on first visit and can change their choice anytime via the Cookie preferences link in the footer. We honor Global Privacy Control automatically.

Children's privacy

bckstg is not directed at children under 13. We do not knowingly collect data from children.

Changes to this policy

We will notify you by email at least 14 days before any material changes to this policy take effect.

Contact

BCKSTG

3564 Avalon Park E Blvd Ste 1-A1093

Orlando, FL 32828

Privacy questions? Email support@bckstg.co