Privacy Policy

Last updated: 5 June 2026 · Crowdwave (crowdwave.fm)

This Privacy Policy explains how Crowdwave ("we", "us", or "our") collects, uses, and protects information when you use our platform at crowdwave.fm. We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Crowdwave is the data controller for personal data collected through our platform. You can contact us at hello@crowdwave.fm.

2. Information We Collect

Account data: Name, email address, and password hash when you create an account.

Billing data: Payment is processed by Stripe. We store only your Stripe Customer ID — we never see or store your full card details.

Usage data: Pages visited, features used, and actions taken within the platform, used to improve the service.

Fan data (on your behalf): When fans interact with your drops or gates, we collect their email addresses and platform connection data on your behalf. You are the data controller for this data — see Section 7.

3. How We Use Your Information

To provide and operate the Crowdwave platform
To process subscription payments via Stripe
To send transactional emails (password reset, billing receipts, weekly digests)
To provide customer support
To improve and develop new features
To comply with legal obligations

We do not sell your personal data to third parties.

4. Legal Basis for Processing

We process your data under the following legal bases:

Contract: Processing necessary to provide the service you signed up for
Legitimate interests: Improving the platform and preventing fraud
Legal obligation: Complying with applicable law
Consent: For any optional marketing communications

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we are required to retain it for legal or financial compliance purposes (e.g. billing records for 7 years under UK law).

6. Third-Party Services

We use the following third-party processors:

Stripe — payment processing (stripe.com/privacy)
Supabase — database hosting (supabase.com/privacy)
Vercel — application hosting (vercel.com/legal/privacy-policy)
Resend — transactional email delivery (resend.com/privacy)
Sentry — error monitoring (sentry.io/privacy)

7. Fan Data — Your Responsibilities

When fans interact with your Crowdwave pages (drops, gates, bio links), we collect their data on your behalf. In this context you are the data controller and we are the data processor. You are responsible for:

Having a lawful basis to collect fan data (typically consent)
Providing fans with a privacy notice explaining how their data will be used
Responding to any fan requests to access or delete their data
Complying with UK GDPR and any other applicable data protection law

8. Cookies

We use strictly necessary cookies to maintain your login session. We do not use third-party advertising or tracking cookies. No cookie consent banner is required for strictly necessary cookies under UK PECR.

9. Your Rights

Under UK GDPR you have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your data ("right to be forgotten")
Object to or restrict certain processing
Data portability — receive your data in a machine-readable format
Lodge a complaint with the ICO (ico.org.uk) if you believe we have mishandled your data

To exercise any of these rights, contact us at hello@crowdwave.fm. We will respond within 30 days.

10. Data Security

We use industry-standard security measures including encrypted connections (HTTPS/TLS), hashed passwords, and access controls. No system is completely secure — if you believe your account has been compromised, contact us immediately.

11. International Transfers

Some of our third-party processors may transfer data outside the UK. Where this occurs, we ensure appropriate safeguards are in place (such as UK adequacy decisions or standard contractual clauses).

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you by email of any material changes. The date at the top of this page reflects the most recent update.

13. Contact

For any privacy-related queries or to exercise your rights, contact us at hello@crowdwave.fm.