Privacy Policy

Last updated: October 15, 2026

1. Introduction

This Privacy Policy describes how we collect, use, store, and protect your personal information when you use our platform. The controller responsible for your data is the operator named in our Impressum.

2. Information We Collect

2.1 Account Information (Artists)

When you create an account, we collect:

  • Email address (required for account creation and communication)
  • Password (stored in encrypted/hashed format)
  • Name or artist name
  • Subdomain (unique identifier for your fan page)
  • Profile picture (optional, stored in cloud storage)
  • Social media links (optional: TikTok, Instagram, Spotify, Twitter, YouTube, Facebook, SoundCloud, Website, Apple Music, Tidal)
  • Custom color preferences and settings
  • Subscription and payment information (processed through Stripe)

2.2 Uploaded Content (Fans)

When you upload content, we collect:

  • Video files and associated metadata (filename, file size, file type, upload timestamp)
  • Original file creation date (if available from your device)
  • Consent acknowledgment and timestamp (when you agree to Terms of Service)
  • Song tags (if song recognition is enabled)
  • Optional: Email address and name (if you choose to subscribe to artist updates)
  • Optional: Instagram username (if provided during subscription)

2.3 Email Subscribers

If you subscribe to receive updates from an artist, we collect:

  • Name
  • Email address
  • Instagram username (optional)
  • Subscription timestamp

2.4 Event Information

Artists may create events with:

  • Event name and description
  • Location data (latitude, longitude, city, country) - optional
  • Upload scheduling information

2.5 Technical Information

We may automatically collect:

  • IP addresses (for security and analytics)
  • Browser type and version
  • Device information
  • Usage data and analytics
  • Session information (via NextAuth.js)

3. How We Use Your Information

We use the collected information for:

  • Providing and maintaining our service
  • Processing account registrations and authentication
  • Storing and displaying uploaded content
  • Enabling artists to collect and manage fan-uploaded videos
  • Processing subscription payments (via Stripe)
  • Sending email notifications (verification, password reset, updates)
  • Providing customer support
  • Improving our service and user experience
  • Detecting and preventing fraud or abuse
  • Complying with legal obligations

4. Data Storage and Security

Your data is stored securely using the following services:

  • Database: PostgreSQL database (Supabase) - stores account information, metadata, and settings
  • File Storage: Cloudflare R2 - stores uploaded video files and profile pictures
  • Payment Processing: Stripe - handles subscription and payment data (we do not store credit card information)
  • Email Service: Resend - sends transactional emails
  • Rate Limiting: Upstash - briefly stores IP-based request counters to prevent abuse

We implement appropriate technical and organizational security measures to protect your personal information, including encryption, secure password hashing, and access controls. However, no method of transmission over the Internet or electronic storage is 100% secure.

5. Data Retention

We retain your information for as long as necessary to provide our services and comply with legal obligations:

  • Account Data: Kept until you delete your account. An empty, inactive Free account may be closed as described in 5.4
  • Uploaded Content: Kept until the artist deletes it or deletes their account. Files in the bin are deleted after 30 days (5.1), and files over a plan's storage limit may be removed after notice (5.3)
  • Email Subscribers: Kept until you unsubscribe, the artist removes you, or the artist deletes their account. You can leave any artist's email list at aftershow.io/unsubscribe
  • Invoices and Billing Records: Kept for 8 years, as required by German tax law (§147 AO). They are stored with our payment provider Stripe. This also applies after an account is deleted
  • Consent Records: Stored with the uploaded file and deleted together with it

5.1 Deleted Files and the Bin

When an artist deletes a file, it moves to the bin. It stays there for 30 days and can be restored during that time. After 30 days it is deleted for good. Files in the bin do not count toward the artist's storage.

If you uploaded a video and want it removed, contact us through our contact page.

5.2 Storage Limits

If an account reaches its storage limit, new uploads pause until there is space again. Existing videos are not deleted. We email the artist when storage reaches 80% and again when it is full. These are service emails about the account.

5.3 Failed Payments and Plan Changes

If a payment fails, the artist keeps their paid plan while the payment is retried. If the payment still fails, the account moves to the Free plan. This happens when the subscription ends, or after 30 days, whichever comes first. Nothing is deleted because of this.

If a paid plan ends and the account is over the Free plan limits, all content is kept and new uploads pause. We will not remove content because of a plan change without emailing the artist at least 30 days in advance. Artists can download their videos at any time.

5.4 Inactive Accounts

We do not delete accounts automatically for inactivity. A Free account that is empty (no events, no videos and no email subscribers) and has had no activity for 24 months may be closed. We will email the artist at least 30 days before that happens. Accounts with content are not deleted for inactivity.

5.5 Deleting Your Account

When you delete your account, it is deleted right away. This removes your profile, events, uploaded videos and images (including files in the bin), email subscribers and settings. Any active subscription is cancelled. The only thing we keep is what the law requires us to keep, such as invoices and billing records. Copies in our database provider's automatic backups are removed when those backups expire, usually within about a week.

6. Legal Bases

We process account, billing, upload and service-email data to provide the service you signed up for (Art. 6(1)(b) GDPR). We keep invoices because tax law requires it (Art. 6(1)(c) GDPR). We use IP addresses for security and rate limiting because we have a legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). We send artist updates to fans only with their consent (Art. 6(1)(a) GDPR), which they can withdraw at any time.

7. Your Rights (GDPR/CCPA Compliance)

Depending on your location, you may have the following rights:

  • Right to Access: Request a copy of your personal data
  • Right to Rectification: Correct inaccurate or incomplete data
  • Right to Erasure: Request deletion of your personal data ("right to be forgotten")
  • Right to Restrict Processing: Limit how we use your data
  • Right to Data Portability: Receive your data in a structured, machine-readable format
  • Right to Object: Object to processing of your personal data
  • Right to Withdraw Consent: Withdraw consent for data processing

To exercise these rights, please contact us using the information provided in the Contact section below, or delete your account (and associated data) directly in your account settings under "Delete account" when signed in.

You also have the right to complain to a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.

8. Third-Party Services

We use the following third-party services that may collect information:

9. Cookies and Tracking

We use session cookies for authentication and to maintain your login state. We do not use tracking cookies or third-party advertising cookies. You can control cookies through your browser settings.

10. Children's Privacy

Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your country. Where data goes outside the EU, we rely on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we post the new version on this page and update the "Last updated" date. We will tell you about material changes in advance, by email or with a notice in the app.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

  • Email: aftershow.site@gmail.com
  • For GDPR/Data Requests: aftershow.site@gmail.com
  • For DMCA/Copyright: aftershow.site@gmail.com