Privacy Policy

Who is responsible

LL Platforms UG (haftungsbeschränkt), Wuhlestraße 7a, 12683 Berlin, Germany (“we”, “us”) is responsible for the processing described here (the controller under the GDPR). You can reach us at support@meloshare.com or by phone at +49 15679 817656. We are not required to appoint a data protection officer; for any question about your data, simply write to us.

There is one exception. When a fan signs up on an artist’s page to hear about new releases, the artist decides about that list and is its controller. We keep the list and send the emails on the artist’s behalf as a processor (Art. 28 GDPR), under our Data Processing Agreement. The section “Fan sign-ups” explains what happens.

Visiting meloshare.com and melo.la

meloshare.com carries our website and the app for artists. melo.la carries the pages artists share with their fans: release pages and bio links.

When you open a page, your browser sends the technical data every website receives: your IP address, the date and time, the address of the page, the page you came from, and your browser and operating system. We need this to deliver pages, keep them fast and fend off attacks. Legal basis: our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR). We keep technical logs for no longer than 30 days, unless we need them to investigate a specific attack.

Fonts and icons come from our own servers. We use no advertising, no social media plugins and no tracking tools from other companies.

Statistics on release pages and bio links

When someone opens a release page or bio link, or taps a platform or an extra on it, the page reports this to our own server. Nothing is stored on the visitor’s device for this: no cookies, no local storage.

For each of these events we store the page, what was tapped, the time, where the visit came from (the previous website, or a marker in the link such as a QR code or an email from the artist), the country and city derived from the IP address, the time zone, the type of device, and whether the page was opened inside an app such as Instagram.

So that someone who reloads a page counts only once a day, our server combines the IP address and browser details with a random key and keeps only the result, a pseudonymous code. The key changes every day and the previous one is deleted; from then on, the code can no longer be linked to an IP address or a device. The IP address itself is never stored. Known bots and link previews in messengers are not counted.

Artists see the result only as totals and shares, such as visitors and taps per day, platform, source, country, city, device and time of day. They never see individual visits. Purpose and legal basis: showing artists how their pages perform, our and the artist’s legitimate interest (Art. 6(1)(f) GDPR). You can object at any time, see “Your rights”. The events are kept as long as the page exists.

Covers and previews on release pages

A release page shows the cover of the song. When the cover comes from Spotify, Apple Music or Deezer, your browser loads it from that service’s image servers, which receive your IP address and browser details in the process. If you play a song’s preview, the audio is loaded from Apple or Deezer. Legal basis: our interest in showing the artwork and preview the artist chose (Art. 6(1)(f) GDPR). Images that artists upload themselves come from our own storage.

When you tap a platform, you leave meloshare. From then on, that platform’s own privacy policy applies.

Fan sign-ups

On an artist’s page, fans can ask to hear about new releases (“Remind me”, “Notify me”). We then store the email address, the artist and release the fan signed up for, the platform chosen under “Link opens in”, and the dates of sign-up, confirmation and unsubscribing.

A sign-up only counts once the fan confirms it with the link in our email (double opt-in). Until then, no other email is sent, and sign-ups that are never confirmed are deleted after 30 days.

What fans get: one email when the release is out, if they signed up for a countdown, and one for each new release from that artist. We send these emails in the artist’s name (“Artist via meloshare”). Every email has a link to unsubscribe with one click.

The artist can view the list, download it and remove fans. Legal basis: the fan’s consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time with the unsubscribe link or by writing to us; emails sent before stay lawful. We don’t use fans’ addresses for our own purposes and don’t combine sign-ups across artists.

The data stays until the fan unsubscribes, or until the artist removes the fan or deletes their account. After unsubscribing, we keep the address marked as unsubscribed, so it never receives that artist’s emails again (Art. 6(1)(c) and (f) GDPR). Questions about a fan list can go to the artist or to us; we pass them on and help the artist answer. If you are under 16, please ask a parent before signing up.

When you write to us

If you email us, we use your address and your message to answer you: to help with your account, a payment or a question (Art. 6(1)(b) GDPR, otherwise our legitimate interest in answering, Art. 6(1)(f) GDPR). Mail to our address is received and forwarded by Cloudflare (see “Service providers”) to the mailbox at our email provider. We delete the conversation once the matter is settled, unless we have to keep it by law, for example as a business letter.

Your artist account

To use meloshare as an artist, you create an account with your email address. We send you a link and a code to sign in; there is no password. We store what you enter and create: your artist name, your address on melo.la, bio, photo and links to your profiles, your releases with their links, designs and extras, the images you upload, your settings and your plan. Purpose and legal basis: providing meloshare to you (Art. 6(1)(b) GDPR). Much of it is public by design, because it appears on your pages.

When you paste a song link or look for your artist profile, our server searches the public catalogues of streaming services such as Spotify, Apple Music, Deezer, YouTube and TIDAL, to find the song on every platform. Only information about the song and the artist is sent, nothing about you.

Signing in with Google

If you choose this, Google confirms who you are and tells us your email address and, if you allow it, your name. Legal basis: Art. 6(1)(b) GDPR. What happens on their side is covered by Google’s own privacy policy.

How long we keep it

As long as you have an account. You can delete it at any time in Settings › Account: your pages go offline at once, and we delete your data within 30 days, apart from records we have to keep by law.

Emails

We send you the emails your account needs, such as sign-in links and notices about your plan (Art. 6(1)(b) GDPR). On top of that come the emails you can switch on or off in Settings › Emails: release day, new releases found on your profile, the weekly summary and new fans (Art. 6(1)(b) GDPR), and news about meloshare about once a month, only with your consent (Art. 6(1)(a) GDPR). Every one of them can be turned off with a click.

All emails, for artists and for fans, are sent through Resend, which processes the address, the content and delivery data, such as whether an email arrived. Our emails contain no tracking pixels. Links in emails to fans carry a marker, so the artist’s statistics can show how many visits came from emails; the marker says nothing about the recipient.

Paid plans and payments

Our paid plans are sold by our online reseller Paddle (Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom; for buyers in the USA, Paddle.com Inc.), the Merchant of Record for all our orders. Paddle handles checkout, payment, invoices, taxes and refunds as a controller in its own right; its privacy notice applies. We never see your full card details. The checkout window is loaded from Paddle’s servers when you open it.

From Paddle we receive what we need to run your plan: customer and subscription numbers, plan, billing interval, status, the next payment date, and the card brand with its last four digits. Legal basis: Art. 6(1)(b) GDPR. We keep this as long as your account exists, and longer where tax law requires it.

Cookies and storage on your device

We use no cookies for advertising or analytics, which is why there is no cookie banner. We only store what is needed for something you asked for (§ 25(2) No. 2 TDDDG):

• a cookie that keeps you signed in to the app,
• in your browser’s storage, your choice of light or dark mode and a page you started building before signing up,
• when you open the checkout, cookies Paddle needs for the payment and to prevent fraud.

Release pages and bio links store nothing on fans’ devices.

Service providers

These providers process data for us, only on our instructions and under a data processing agreement:

• Cloudflare, Inc. (USA): hosting, delivery and protection of our websites, and receiving and forwarding mail sent to our address. Transfers to the USA rely on the EU-U.S. Data Privacy Framework and the EU standard contractual clauses.
• Supabase Pte. Ltd. (Singapore): database, sign-in and file storage. Our data is stored in Frankfurt, Germany. Any access from outside the EU relies on the EU standard contractual clauses.
• Resend, Inc. (USA): sending emails. Transfers to the USA rely on the EU-U.S. Data Privacy Framework and the EU standard contractual clauses.

Paddle is not our processor but sells our plans as Merchant of Record, see above. Transfers to Paddle in the United Kingdom rely on the EU’s adequacy decision for the UK.

Your rights

You have the right to:

• know what data we hold about you and get a copy (Art. 15 GDPR),
• have wrong data corrected (Art. 16),
• have your data deleted (Art. 17) or its use restricted (Art. 18),
• receive your data in a portable format (Art. 20),
• withdraw a consent at any time, with effect for the future (Art. 7(3)),
• complain to a data protection authority, for example in the EU country where you live or work (Art. 77).

Right to object: where we rely on our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation (Art. 21 GDPR). We then stop, unless we have compelling reasons that outweigh your interests.

To use any of these rights, write to support@meloshare.com. For fan lists, we pass your request on to the artist and help them with it. We make no automated decisions about you that have legal or similarly significant effects.

Security

All connections are encrypted (HTTPS). Our providers store data encrypted, and access is restricted so that every artist sees only their own data.

Changes

We update this policy when meloshare changes. The date at the top shows the current version.