Your fans trust you with their personal information — their names, email addresses, phone numbers, and locations. That trust is sacred, and Fanaura is built to honor it. This page explains how fan data is stored, how privacy regulations are met, and what protections are in place.Documentation Index
Fetch the complete documentation index at: https://help.fanaura.com/llms.txt
Use this file to discover all available pages before exploring further.
Data Storage
Where Your Data Lives
Fanaura stores all data in a secure PostgreSQL database, hosted in Frankfurt, Germany (EU — eu-central-1). EU data residency provides a strong privacy foundation, as EU data protection laws are among the strictest in the world.
- All data in transit is encrypted via TLS/SSL.
- Database backups are maintained for disaster recovery.
What Data Is Stored
| Data Type | Examples | Where Stored |
|---|---|---|
| Fan profiles | Name, email, phone, location, birthday | EU (Frankfurt) |
| Engagement history | Presaves, email opens, clicks, purchases, RSVPs | EU (Frankfurt) |
| Campaign data | Blast content, send history, delivery stats | EU (Frankfurt) |
| Flow data | Flow configurations, execution logs | EU (Frankfurt) |
| Integration credentials | API keys, OAuth tokens | EU (Frankfurt), encrypted |
| Artist profiles | Account details, settings, preferences | EU (Frankfurt) |
| Asset data | Music, tour, merch, extra metadata | EU (Frankfurt) |
GDPR Compliance
The General Data Protection Regulation (GDPR) is the EU’s comprehensive data protection law. Fanaura is designed with GDPR compliance at its core.- EU Data Residency
- Lawful Basis
- Right to Access
- Right to Deletion
- Consent Tracking
All personal data is stored within the EU (Frankfurt, Germany), satisfying GDPR’s data residency preferences and avoiding complex cross-border data transfer issues.
Data Minimization
Fanaura’s smart link data wrappers are configurable. You can collect only the data you actually need:
- Required: Email address (minimum for communication).
- Optional: First name, last name, phone number, birthday, location.
CCPA Compliance
The California Consumer Privacy Act (CCPA) gives California residents specific rights over their personal data. Fanaura supports CCPA requirements:- Right to Know: California fans can request a copy of all personal data collected about them.
- Right to Delete: California fans can request deletion of their personal data.
- Right to Opt-Out of Sale: Fanaura does not sell fan data to third parties. Your fan data belongs to you and is never shared, sold, or monetized by Fanaura.
- Non-Discrimination: Fans who exercise their privacy rights are not treated differently.
Fan Consent
Smart Link Data Wrappers
Every smart link in Fanaura includes a data wrapper — a privacy-compliant consent screen:Data Wrapper Appears
The data wrapper explains what data is being collected, why, and how it will be used.
The data wrapper ensures that every fan interaction begins with informed consent. No data is collected without the fan actively choosing to provide it.
Email and SMS Opt-In
- Email Opt-In
- SMS Opt-In
When fans provide their email through a smart link, they are opting in to receive marketing emails from you. The consent is logged and timestamped. You can include an explicit consent checkbox for additional clarity.
Opt-Out Mechanisms
- Email Unsubscribe
- SMS Opt-Out
Every marketing email sent through Fanaura includes a one-click unsubscribe link in the footer:
- Fans click the link and are immediately unsubscribed.
- Their email opt-in status is updated in real time.
- This complies with CAN-SPAM, GDPR, and CCPA requirements.
Row Level Security (RLS)
Fanaura uses Row Level Security at the database level to ensure data isolation between artists:
- Each artist can only access their own fans, assets, campaigns, and settings.
- Database queries are automatically filtered by the authenticated artist’s ID.
- Even if two artists share a fan, each artist only sees their own interaction data.
- RLS is enforced at the PostgreSQL level, meaning it cannot be bypassed by application code. It is the strongest form of data isolation available in a shared database architecture.
Encryption
- Data at Rest
- Data in Transit
Sensitive data stored in the database is encrypted:
- API keys: All third-party integration credentials are encrypted before storage.
- OAuth tokens: Spotify and Instagram access tokens are encrypted.
- Passwords: User passwords are hashed using industry-standard algorithms (never stored in plain text).
Session Management
Fanaura’s security model includes active session management:- Active session tracking: See which devices are logged into your account.
- Device identification: Each session shows the browser, operating system, and approximate location.
- Session revocation: Revoke individual sessions or all sessions at once.
- Session heartbeat: Sessions periodically refresh to stay active and provide accurate “last active” timestamps.
Data Export
On the Complete plan, you can export your complete fan database and engagement data: fan profiles with all fields, engagement history, campaign results, and delivery stats. Export in standard formats (CSV) for use in external tools. Data export gives you full portability — your data is yours, and you can take it with you.
Third-Party Data Handling
When Fanaura connects with third-party services, data flows in both directions:| Integration | Data Sent | Data Received | Data Stored |
|---|---|---|---|
| SMS Provider | SMS content, phone numbers | Inbound SMS, delivery status | Message logs, phone numbers |
| Email Provider | Email content, fan emails | Delivery status, opens, clicks | Email logs, engagement data |
| Shopify | None (read-only) | Products, orders | Product data, purchase history |
| DM content | DM messages, comments, mentions | Message logs, trigger data | |
| Spotify | Presave commands | Authorization tokens, metadata | Tokens, song metadata |
| Apple Music | Library additions | Authorization tokens | Tokens |
| Stripe | Subscription data | Payment status, invoices | Subscription state |
Fanaura only shares the minimum data necessary with each service for the integration to function.
Best Practices for Artists
Secure your account. Your Fanaura account is the gateway to your fan data. Use a strong password, monitor active sessions, and limit team access to only those who need it.