Privacy Policy
Version 2026-08-08 · Effective 8 August 2026
CUE▶FWD is a sole proprietorship operating in Washington State, USA. This policy explains what the service collects, why it is collected, who it is shared with, and how to have it removed. It covers two different groups of people: artists, who hold accounts, and fans, who sign up to hear from an artist.
Who controls your data
For an artist account, CUE▶FWD is the data controller. For a fan mailing list, the artist is the controller and CUE▶FWD is the processor acting on their instructions — the artist decides what to send and to whom. Requests about a specific list are best directed to that artist, but you can always contact us at privacy@cuefwd.com and we will help.
What we collect from artists
- Account email and authentication credentials, handled by our authentication provider.
- Profile content you enter: display name, page address, tagline, location, and links.
- Media you upload: images, audio, and video, along with any press assets.
- Team membership and role, where more than one person works on an account.
- Billing details, held by our payment processor — we never see full card numbers.
- Two-factor enrollment data, where you turn it on.
What we collect from fans
When you join an artist's list we record a consent receipt. It exists so both you and the artist have proof of what you agreed to, and it contains:
- Your email address.
- The topics you chose — releases, nearby shows, or exclusives.
- The version of this policy in force when you signed up.
- Where the signup came from, such as which link or page.
- Timestamps for when you confirmed, and if you later unsubscribed.
Signup uses double opt-in: nothing is sent until you click a confirmation link, so an address cannot be added without the owner acting.
Analytics and tracking
We record page views and interactions so artists can see which links work. Visitor identifiers are hashed with a secret key and scoped to a single artist, so the same visitor cannot be correlated across different artists' pages, and the raw identifier is not retained.
We do not set advertising cookies, we do not sell personal information, and we do not share it with advertising networks. Cookies are used only to keep signed-in artists signed in.
Who we share it with
We share data with the following providers strictly to operate the service. Each processes it on our instructions:
- Supabase — Database, authentication, and file storage
- Vercel — Application hosting and content delivery
- Resend — Transactional and campaign email delivery
- Cloudflare R2 — Media and rendered video storage
- GitHub Actions — Scheduled background jobs
- Stripe — Payment processing, where billing is enabled
- Spotify — Pre-save authorization, where an artist enables it
Some of these are located in the United States. If you are in the UK or EU, your data is transferred there to provide the service you asked for.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, or stop using it. Fans can also change topics or unsubscribe at any time using the link in every email, with no need to contact anyone.
Fans can also ask for deletion directly: the unsubscribe and preference pages linked from every email carry a Delete my data option. For anything beyond that, email privacy@cuefwd.com. These requests are handled manually and actioned within 30 days. The button records the request; a person carries it out. We would rather say that plainly than imply an instant erasure that does not happen.
If you are in the UK or EU, you also have the right to complain to your local data protection authority.
How long we keep it
Artist account data is kept while the account is open. Fan records are kept while the artist's list is active. Consent receipts are kept even after an unsubscribe, because they are the record proving the original signup was lawful.
When you ask for deletion, your email address, tags, capture source, preferences, and any pre-save authorizations are destroyed. The consent receipt itself is kept, with your address replaced by a one-way hash — it no longer identifies you, and it is what proves the original signup was lawful. Deleting an artist account erases that account's whole audience the same way first.
Every commercial email includes a one-click unsubscribe link and standard unsubscribe headers, so your mail client can act on it directly.
Children
The service is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has signed up, contact us and we will remove the record.
Changes
When this policy changes materially we publish a new version and record that version against new consent. Receipts signed under an earlier version keep it, so it is always clear what a given person actually agreed to.