Privacy policy

Data controller

PRAGM.AGENCY (SARL, RCS Aix-en-Provence 902 529 726), 12 avenue de la Cible, 13100 Aix-en-Provence, France. Dedicated contact: privacy@awarefan.com. No data protection officer (DPO) has been appointed, as the organization is not required to do so.

Data processed, purposes and legal bases

Account

Data: email, language, language preferences, timezone

Purpose: Account creation and management, authentication

Legal basis: Performance of the contract (requested service)

Code-based login (passwordless)

Data: email, one-time code (hashed)

Purpose: Login via a code sent by email

Legal basis: Performance of the contract

Login via a third-party provider (OAuth)

Data: provider identifier, email, display name, access tokens (encrypted)

Purpose: Login via Google, Discord, Twitch, MusicBrainz, Genius, Last.fm or Discogs

Legal basis: Consent (at the time of linking) and performance of the contract

Artist subscriptions

Data: followed artist, date, frequency, email and push preferences

Purpose: Personalizing the feed and sending the requested notifications

Legal basis: Performance of the requested service

Email and push notifications

Data: email, browser push subscription (endpoint, keys)

Purpose: Sending news about followed artists

Legal basis: Performance of the requested service and consent (push: browser permission)

Newsletter

Data: Email address, consent date and IP, consent text version, status (pending/subscribed/unsubscribed)

Purpose: Send you the awarefan newsletter (news about awarefan, sometimes a big music story, never commercial partners or ads)

Legal basis: Consent (GDPR art. 6.1.a), withdrawable anytime via the unsubscribe link or your account

Waiting list

Data: Email, IP address (proof of consent), referral code and arrival channel.

Purpose: Notify you when access opens, manage referrals (your position in the queue) and measure our acquisition channels without third-party trackers.

Legal basis: Consent (double opt-in: email confirmation).

Feedback (beta)

Data: email, message, relevant page

Purpose: Improving the service during the beta

Legal basis: Legitimate interest

Technical logs

Data: account identifier, IP address, technical events

Purpose: Security, abuse prevention, diagnostics

Legal basis: Legitimate interest

Audience measurement

Data: anonymized IP address, pages viewed, referrer, browser, approximate country and city (derived from the anonymized IP)

Purpose: Aggregated, anonymous traffic statistics computed from our server logs by a Matomo instance we self-host, for our own needs, with no cookie or third-party tool

Legal basis: Legitimate interest

awarefan runs no targeted advertising, no profiling with legal effects, and uses no third-party trackers (see the cookies page).

Retention periods

• Account: kept as long as it is active. An account with no login for 33 months receives a reminder email; without reactivation, it is deleted at 36 months (3 years).
• Notifications (history): 12 months.
• Newsletter: kept until you unsubscribe; an unconfirmed sign-up is deleted after 30 days; an unsubscribe is kept as proof.
• Waiting list: deleted after 30 days if unconfirmed, otherwise kept until the closed beta ends (or until you ask to be removed).
• Beta feedback: deleted at the end of the beta phase.
• Technical logs: 90 days.
• Audience measurement: anonymous aggregates kept for at most 25 months.
• Login codes and email verification tokens: from a few minutes to 24 hours (validity period), then purged.
• If an account is deleted, all associated data (subscriptions, third-party identities, push subscriptions, notifications, feedback, session tokens) is erased.

Recipients and processors

Your data is never sold. It is processed by PRAGM.AGENCY and by the following technical processors:

• Hetzner Online GmbH (Germany, EU): hosting of the site and database.
• Brevo (Sendinblue SAS) (France, EU): sending emails (verification, login code, notifications).
• Browser push notification services: Google (FCM), Apple, Mozilla, depending on your browser, for the technical delivery of push notifications (end-to-end encrypted content).
• Third-party login providers (OAuth), only if you choose this login method: Google, Discord, Twitch, MusicBrainz, Genius, Last.fm, Discogs.

To display artist information and portraits, awarefan queries public sources (MusicBrainz, Wikipedia, Wikidata) without sending them any personal data about you.

Transfers outside the European Union

If you log in via certain third-party providers, some data (identifier, email) is transmitted to companies located outside the EU:

• United States: Google, Discord, Twitch, Discogs, Genius, MusicBrainz. These transfers rely on the safeguards provided by these providers (standard contractual clauses and/or Data Privacy Framework).
• United Kingdom: Last.fm (a country benefiting from an adequacy decision by the European Commission).

These transfers only occur if you explicitly choose to log in via one of these providers.

Your rights

Under the GDPR, you have the rights of access, rectification, erasure, portability, restriction and objection. In practical terms, within the app:

• Access and portability: export your data from your account.
• Rectification: edit your email and your preferences.
• Erasure: delete your account from your account.

You can also exercise these rights by writing to privacy@awarefan.com. We respond within one month. Finally, you have the right to lodge a complaint with the CNIL (www.cnil.fr).

Security

Login codes and tokens are stored in hashed form, third-party provider tokens are encrypted at rest, and communications are encrypted in transit (HTTPS and TLS).

Changes

This policy may change; the date of the last update appears at the top of the page.