FanStage

FanStage Privacy Policy

Last updated: 21.05.2026

1. Data Controller

The controller of your personal data is Fan Stage Mateusz Bednarski, seated in Łódź, ul. Małachowskiego 90, 90-159 Łódź, VAT ID (NIP): 7252021896, REGON: 363999620 ("Administrator" or "FanStage").

For matters regarding personal data protection, you can contact us at: privacy@fanstage.pl

For general matters related to the operation of the Service, you can write to: support@fanstage.pl.

2. Scope of the Policy

This Privacy Policy describes the rules for processing personal data in connection with the use of the FanStage platform available at fanstage.pl ("Service"), including in connection with:

  • creating and maintaining a User Account;
  • using social features, such as the Feed, Forum, friend system, Fanclubs, and Messenger;
  • using voting, following artists, Demand Signals, and other features related to community activity;
  • using the Discovery Module, including listening to presented musical materials and expressing Discovery Reactions;
  • submitting, verifying, and managing Artist Profiles;
  • using the Discovery Panel for Artists and promotional and analytical tools;
  • using the FanScore system, Account levels, benefits, and Referral Links;
  • integrating the FanStage Account with external services, in particular Spotify;
  • using the Service in Polish and English versions;
  • contacting the Administrator, complaints, reporting violations, and exercising rights under the GDPR.

3. What data we process

We process personal data that:

  • you provide during registration or later in the Account settings;
  • you generate while using the Service;
  • comes from voluntarily connected external services;
  • is collected automatically while using the Service;
  • you provide in correspondence with the Administrator.

Depending on how you use FanStage, we may process the following categories of data.

3.1. Account and login data

We may process:

  • e-mail address;
  • User identifier;
  • password stored as a cryptographic hash or in another secure manner consistent with the authentication mechanism used;
  • information about the registration date, logins, password changes, and security settings;
  • information necessary to handle authentication, recover access to the Account, and secure the Account.

3.2. Profile data

We may process:

  • nickname, username, profile picture, or avatar;
  • profile description, visibility settings, and Account preferences;
  • information about rank, Account level, FanScore points, and badges;
  • information about social relations, including friends, followed artists, and followed profiles, if a given feature is available.

3.3. Service activity data

We may process:

  • followed artists, bands, and Artist Profiles;
  • cast votes, indicated cities, saved notifications, and other Demand Signals;
  • activity on the Feed, Forum, in comments, and other social features;
  • messages sent via Messenger, to the extent necessary for the operation of the service, ensuring security, or handling reports;
  • use of Referral Links, invitations, and the referral system;
  • information about issued warnings, restrictions, blocks, or bans, if applied.

3.4. Data related to Fanclubs

If you use Fanclubs, we may process:

  • information about your membership in a specific Fanclub;
  • the date of joining or leaving a Fanclub;
  • notification settings regarding the Fanclub;
  • activity within the Fanclub's social features;
  • reactions to communications, activities, or content available in the Service within the Fanclub.

3.5. Data regarding musical preferences and personalization

We may process:

  • data regarding favorite artists indicated by you independently, e.g., within the TOP-5 list;
  • data regarding followed artists, bands, profiles, Fanclubs, events, and locations;
  • data about your interests and behaviors in the Service used to personalize content;
  • data obtained from voluntary integrations with external services, in particular Spotify.

3.6. Discovery Module data

If you use the Discovery Module, we may process:

  • identifiers of tracks, artists, or musical materials presented to you;
  • information about starting playback or preview of a track, completing the preview, number of repeats, and interaction time — to the extent necessary for the operation of the functionality;
  • information about Discovery Reactions, including skipping a track, marking a track as a favorite, undoing this mark, boosting a track, and navigating to an external music service;
  • session identifiers, technical event identifiers, and information necessary to ensure the correct operation of the Discovery Module, prevent multiple recordings of the same reaction, and prevent abuse;
  • information used to personalize the order of presented tracks, artists, and music recommendations.

3.7. Artist Profile submissions and Panel for Artists data

If you submit an Artist Profile, apply for the ability to manage such a profile, or use tools for artists, we may process:

  • data identifying the submitter, including first and last name, stage name, e-mail address, and contact details;
  • data regarding the musical project, including the name of the artist or band, biography, country or city of activity, musical genres, photos, descriptions, promotional materials, and links to streaming services, social media, and websites;
  • data or documents provided to confirm authorization to represent the artist, band, or musical project;
  • information about the course of the submission, verification, moderation decision, and the history of changes to the managed Artist Profile;
  • data regarding tracks submitted for qualification in the Discovery Module, including information about the source of the track, links to external services, qualification status, and moderation results.

3.8. Data from Spotify integration

If you voluntarily connect your Spotify account with FanStage, we may process data shared as part of this integration to the extent resulting from the permissions granted by you in Spotify and the currently available features of this service. This data may include, in particular, information about the most listened to artists, saved musical preferences, or other data available to FanStage based on the granted authorization. We use this data exclusively to the extent necessary for the operation of the integration, personalization of recommendations, and features explicitly described in the Service. You can revoke the Spotify Account connection in the FanStage settings or according to the mechanisms provided by Spotify.

3.9. Technical and operational data

We may process:

  • IP address;
  • session identifiers and system logs;
  • device type, operating system, browser type, and language settings;
  • data regarding technical errors, security, and diagnostics;
  • data regarding the use of cookies or similar technologies.

3.10. Contact and report data

We may process:

  • data provided in e-mail correspondence;
  • data contained in complaint reports, violation reports, privacy and personal data requests;
  • data needed to verify identity when exercising your rights.

4. Purposes and legal bases for processing

We process your personal data based on appropriate legal bases under the GDPR, in particular Art. 6 sec. 1 lit. a, b, c, and f of the GDPR.

4.1. Performance of a contract or taking steps prior to entering into a contract (Art. 6 sec. 1 lit. b GDPR)

We process data in order to:

  • create and maintain an Account;
  • enable logging into the Service;
  • operate social features, the Feed, Forum, Messenger, and Fanclubs;
  • save follows, votes, Demand Signals, notifications, and Account settings;
  • handle Fanclub membership, communication within the Service, notification settings, and social features related to a given Artist Profile;
  • implement features related to FanScore, Account levels, and benefits;
  • operate the Discovery Module, save Discovery Reactions, present the history of discoveries, and implement features related to likes, skips, and boosts of tracks;
  • implement personalization and recommendation features;
  • operate integration with external services, if you use it;
  • receive, evaluate, and verify Artist Profile submissions;
  • grant, limit, or revoke permissions to manage an Artist Profile;
  • operate the Discovery Panel for Artists and qualify tracks for the Discovery Module;
  • handle requests for Account deletion, password change, and other features related to Account security.

4.2. Legitimate interest of the Administrator (Art. 6 sec. 1 lit. f GDPR)

We process data in order to:

  • ensure the security of the Service;
  • detect abuse, fraud, attempts to manipulate voting, rankings, referral systems, FanScore, or Discovery Reactions;
  • prevent the automatic generation of Discovery Reactions, multiple registrations of the same events, or manipulation of track reception results;
  • combat spam, harassment, violations of the Terms, and other threats to the community;
  • protect the rights of third parties, verify the right or authorization to represent an artist or musical project, prevent impersonation, and protect the integrity of the public database of Artist Profiles;
  • maintain technical logs, diagnostics, and development of the Service;
  • pursue claims or defend against claims;
  • conduct internal statistics and analyses regarding the development of the Platform;
  • perform limited personalization of content and community organization based on activity in the Service.

4.3. Legal obligation (Art. 6 sec. 1 lit. c GDPR)

We process data when it is necessary to fulfill legal obligations, in particular regarding:

  • handling complaints;
  • handling requests concerning personal data;
  • fulfilling obligations towards public authorities;
  • maintaining documentation required by law.

4.4. Consent (Art. 6 sec. 1 lit. a GDPR)

Based on your consent, we process data in order to:

  • conduct traffic analytics using Google Analytics 4;
  • send marketing information via e-mail or other channels outside the Service;
  • use selected integrations with external services, if their activation requires your action and authorization;
  • share specific data with partners or campaign organizers to a wider extent, if such a feature is activated based on a separate consent.

5. Is providing data mandatory

Providing data marked as required during registration is voluntary but necessary to create and maintain an Account. Failure to provide them will prevent the use of features requiring login.

Providing additional profile data, using Spotify integration, adding favorite artists, joining a Fanclub, signing up for notifications, enabling marketing or analytical consents is voluntary.

The lack of additional data or consents does not prevent the use of the basic features of the Service, but may limit the level of personalization, recommendations, or access to some features.

In the case of submitting an Artist Profile, providing specific data, materials, or information may be necessary to carry out the verification process and grant permissions to manage the Artist Profile. Failure to provide the required information may prevent the positive processing of the submission.

6. Social features, Messenger, and moderation

Content published by you on the Feed, Forum, in comments, Fanclubs, or other social places may be visible to other Users according to the settings of a given feature.

Private messages in the Messenger serve for communication within the Platform. The Administrator does not constantly monitor all messages, but may access them to the extent necessary to handle reports, ensure User safety, prevent abuse, or fulfill legal obligations.

Data regarding warnings, blocks, restrictions, and bans may be processed to enforce the Terms, protect the community, and ensure the security of the Service.

7. Artist Profiles, Discovery Panel for Artists, and statistical data

FanStage may provide artists, bands, their representatives, or other partners with selected analytical and promotional tools related to the activity of the community centered around a given artist, event, voting, Fanclub, or Discovery Track.

Artist Profile Managers may receive aggregate analytical information regarding the activity of the community centered around a given artist, Fanclub, campaign, or Discovery Tracks.

This information may include in particular:

  • number of followers;
  • number of Fanclub members;
  • number of Demand Signals;
  • number or structure of Discovery Reactions;
  • data on likes, skips, boosts, and click-throughs to external services;
  • activity trends;
  • location data or audience structure.

Data shared in this scope generally has a statistical, aggregated, pseudonymized, or other character that does not allow for the direct identification of a specific User.

FanStage does not share direct identifying data of Users, such as e-mail address, IP address, login data, the content of private correspondence, or individual history of using the Service with artists, bands, or their representatives, unless the User has given separate consent or the transfer of data is required by applicable legal provisions.

8. Personalization and automated content matching

FanStage may use data about your activity, followed artists, favorite performers, FanScore, social activity, and data from voluntary integrations to better match recommended artists, content, voting, Artist Profiles, Fanclubs, and other elements of the Service.

FanStage may use data about your activity in the Discovery Module, including information about listens, likes, skips, boosts, and click-throughs to external services, to match the order and type of presented tracks, artists, and music recommendations.

In the personalization process, we may also take into account followed artists, favorite performers indicated by you, social activity, Demand Signals, and data from voluntarily connected integrations, including Spotify, within the scope of granted access.

Such actions are of the nature of content personalization and segmentation. They are not used to make decisions concerning you that produce legal effects or similarly significantly affect you within the meaning of Art. 22 of the GDPR.

9. Google Analytics 4 and analytics consents

If you consent, we use Google Analytics 4 to analyze traffic and how the Service is used.

In the absence of analytical consent, we do not launch Google Analytics 4 or other non-mandatory analytical mechanisms requiring consent, except when their limited use is permitted by applicable regulations and configured in a way that does not cause the saving or reading of non-mandatory information on the User's device.

You can withdraw your consent at any time via the cookies settings panel or settings available in the Service. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

10. Cookies and similar technologies

The Service may use cookies and similar technologies in order to:

  • ensure the proper operation of the Service;
  • maintain the User's session;
  • remember preferences;
  • ensure security;
  • conduct analytics — only to the extent consistent with your consent settings;
  • improve performance and develop the Service.

The following categories of cookies or similar technologies may be used in the Service:

  • strictly necessary – required for the proper operation of the Service, security, logging in, and session maintenance;
  • functional – used to remember selected settings and preferences;
  • analytical – enabling the analysis of traffic and how the Service is used;
  • marketing – used only when such mechanisms are activated and the User has given the required consent.

Strictly necessary cookies are used to the extent necessary for the operation of the Service. Analytical, functional, or marketing cookies, if they require consent, are used only after obtaining it.

Detailed information about the cookies used, their duration, and consent settings may be provided in the cookie banner, preference panel, or a separate Cookie Policy.

Non-mandatory cookies and tracking technologies should only be activated after obtaining voluntary, specific user consent, which the user can withdraw just as easily.

11. Data recipients and processors

Your data may be disclosed to entities that support us technically or organizationally in providing the Services. Data recipients may include in particular:

  • Supabase – database infrastructure, authentication, data storage, and backend services;
  • Google – Google Analytics 4, only upon your consent;
  • providers of hosting, technical infrastructure, e-mail, security, error monitoring, or tools supporting the operation of the Service;
  • external service providers with whom you connect your Account, to the extent necessary to handle the integration;
  • artists, bands, or their representatives – exclusively regarding statistical, aggregated, or pseudonymized data, and within the scope provided by a given feature of the Service;
  • partners and campaign organizers – exclusively within the scope described in a given feature, based on an appropriate legal basis;
  • entities authorized under the provisions of law.

The Administrator selects providers and data processors in a manner that takes into account the protection of personal data and concludes legally required agreements if necessary.

12. Data transfer outside the EEA

Some providers we use operate globally, which may involve transferring data outside the European Economic Area.

This may concern in particular providers of infrastructure, cloud services, security, or analytics, such as Google.

In such cases, we apply appropriate safeguards required by law, in particular standard contractual clauses or other mechanisms provided by the GDPR.

13. Data retention period

We store personal data for no longer than is necessary to achieve the purpose for which it was collected.

Account data is stored for the period of maintaining an active Account.

Service activity data, including follows, Fanclub memberships, Discovery Reactions, FanScore, settings, and feature usage history, are stored for the period of having an Account or until they are deleted, anonymized, or lose their usefulness for the pursued purpose.

Data from Artist Profile submissions and data provided in the verification process are stored for the duration of the verification process, and after its completion for the period necessary to defend against claims, prevent abuse, and fulfill legal obligations, no longer than 3 years from the end of the process, unless legal provisions require a longer period.

Data from the Messenger is stored for the period of maintaining the Account or the operation of the conversation, unless its earlier deletion is possible according to the Service's functionality or further storage is necessary due to a reported violation, security, or legal obligations.

Technical logs, security data, and event identifiers are stored for the period necessary to ensure security, detect errors, protect against abuse, and pursue claims, no longer than 12 months, unless longer storage is necessary in a specific case.

Data processed on the basis of consent is stored until its withdrawal or loss of usefulness for the purpose for which the consent was granted.

Data from correspondence, complaints, and reports are stored for the period necessary to handle the matter, and then for the time required by legal provisions or needed to defend against claims.

After initiating Account deletion, the Account is immediately hidden, and permanent deletion of data generally occurs after 30 days, subject to data that we must continue to store based on law or legitimate interest.

14. Your rights

You have the right to:

  • access your data;
  • rectify data;
  • delete data;
  • restrict processing;
  • transfer data;
  • object to processing based on the Administrator's legitimate interest;
  • withdraw consent at any time, if processing is based on consent;
  • lodge a complaint with the President of the Personal Data Protection Office.

To exercise your rights, you can contact us at: privacy@fanstage.pl

The Administrator may ask for additional information needed to confirm your identity if this is necessary for the secure execution of the request.

15. Account deletion and password change

You can change your Account password at any time via the security settings or another feature provided in the Service.

You can also initiate Account deletion at any time from the settings level or by contacting the Administrator.

Initiating deletion causes the Account to be immediately hidden in the Service.

After 30 days, the data is generally permanently deleted, subject to cases where further processing is necessary based on the law or to protect against abuse or claims.

16. Data security

We use appropriate technical and organizational measures to protect personal data, including authentication mechanisms, access control, infrastructure security, security monitoring, and restricting access to data to persons and entities that need it to perform specific tasks.

17. Changes to the Privacy Policy

The Privacy Policy may be updated in the event of changes in the law, changes in the functionality of the Service, technological changes, changes in the list of providers, or changes in the method of data processing.

We may inform about significant changes via a communication in the Service, e-mail, or in another appropriate manner.

18. Contact

Please direct any questions regarding privacy and personal data to: privacy@fanstage.pl

For general matters related to the operation of the Service, you can contact us at: support@fanstage.pl.