Data & Privacy

Your fans trust you with their personal information — their names, email addresses, phone numbers, and locations. That trust is sacred, and Fanaura is built to honor it. This page explains how fan data is stored, how privacy regulations are met, and what protections are in place.

​

Data Storage

​

Where Your Data Lives

Fanaura stores all data in a secure PostgreSQL database, hosted in Frankfurt, Germany (EU — eu-central-1). This means:

• Your fan database, campaign history, flow data, and account information are stored in the European Union.
• EU data residency provides a strong privacy foundation, as EU data protection laws are among the strictest in the world.
• All data in transit is encrypted via TLS/SSL.
• Database backups are maintained for disaster recovery.

​

What Data Is Stored

​

GDPR Compliance

The General Data Protection Regulation (GDPR) is the EU’s comprehensive data protection law. Fanaura is designed with GDPR compliance at its core:

​

EU Data Residency

All personal data is stored within the EU (Frankfurt, Germany), satisfying GDPR’s data residency preferences and avoiding complex cross-border data transfer issues.

​

Lawful Basis for Processing

Fanaura processes fan data based on explicit consent:

• Fans actively submit their information through smart link data wrappers.
• Consent is collected at the point of data entry, not assumed or buried in terms of service.
• Each data collection point clearly explains what data is being collected and why.

​

Right to Access

Fans have the right to know what data you hold about them. Fan profiles in Fanaura contain a complete record of all data associated with each fan, making it straightforward to fulfill access requests.

​

Right to Deletion

Fans have the right to request deletion of their personal data. Fanaura supports data deletion:

• Fan records can be deleted from your database.
• Associated engagement history, tokens, and activity logs are removed.
• Deletion is permanent and cannot be undone.

​

Consent Tracking

Every piece of data collected through Fanaura tracks:

• When consent was given (timestamp).
• How consent was given (which smart link, which form).
• What was consented to (email marketing, SMS marketing, data collection).

This audit trail is essential for demonstrating compliance if regulators ask.

​

Data Minimization

Fanaura’s smart link data wrappers are configurable. You can collect only the data you actually need:

• Required: Email address (minimum for communication).
• Optional: First name, last name, phone number, birthday, location.

You decide which fields are required and which are optional. Collecting less data is both a privacy best practice and a way to reduce friction for fans.

​

CCPA Compliance

The California Consumer Privacy Act (CCPA) gives California residents specific rights over their personal data. Fanaura supports CCPA requirements:

​

Right to Know

California fans can request a copy of all personal data collected about them. Fanaura’s fan profiles provide a comprehensive view of all stored data.

​

Right to Delete

California fans can request deletion of their personal data, which Fanaura supports through fan record deletion.

​

Right to Opt-Out of Sale

Fanaura does not sell fan data to third parties. Your fan data belongs to you and is never shared, sold, or monetized by Fanaura.

​

Non-Discrimination

Fans who exercise their privacy rights are not treated differently. Opting out of data collection does not result in degraded service or retaliation.

​

Fan Consent

​

Smart Link Data Wrappers

Every smart link in Fanaura includes a data wrapper — a privacy-compliant consent screen that fans see before accessing your content:

1. Fan visits your smart link.
2. The data wrapper appears, explaining:
   • What data is being collected (email, name, etc.)
   • Why it is being collected (to receive updates from the artist)
   • How it will be used (marketing emails, SMS, etc.)
3. Fan enters their information and submits.
4. Consent is recorded with a timestamp.
5. Fan proceeds to the content (presave, streaming links, merch, etc.).

The data wrapper ensures that every fan interaction begins with informed consent. No data is collected without the fan actively choosing to provide it.

​

Email Opt-In

When fans provide their email through a smart link:

• They are opting in to receive marketing emails from you.
• The consent is logged and timestamped.
• You can include an explicit consent checkbox for additional clarity.

​

SMS Opt-In

SMS consent requires a separate, explicit opt-in:

• Fans must actively check an SMS consent box (it is not pre-checked).
• The consent message explains that they will receive text messages.
• The sms_opt_in field in the fan record tracks this consent.

​

Opt-Out Mechanisms

​

Email Unsubscribe

Every marketing email sent through Fanaura includes a one-click unsubscribe link in the footer:

• Fans click the link and are immediately unsubscribed.
• Their email opt-in status is updated in real time.
• They will no longer receive marketing emails from you.
• This complies with CAN-SPAM, GDPR, and CCPA requirements.

​

SMS Opt-Out

Fans can opt out of SMS by texting STOP to your Telnyx number:

• Fanaura automatically processes STOP messages.
• The fan’s sms_opt_in field is set to false.
• They will no longer receive SMS from you.
• This complies with TCPA regulations.

​

No Manual Re-Opt-In

When a fan opts out, you cannot manually re-add them to your mailing or SMS list. They must re-subscribe themselves. This protects fans from unwanted re-enrollment and protects you from legal liability.

​

Row Level Security (RLS)

Fanaura uses Row Level Security at the database level to ensure data isolation between artists:

• Each artist can only access their own fans, assets, campaigns, and settings.
• Database queries are automatically filtered by the authenticated artist’s ID.
• Even if two artists share a fan (the same person presaved music from both artists), each artist only sees their own interaction data.
• This prevents any possibility of one artist accessing another artist’s fan data.

RLS is enforced at the PostgreSQL level, meaning it cannot be bypassed by application code. It is the strongest form of data isolation available in a shared database architecture.

​

Encryption

​

Data at Rest

Sensitive data stored in the database is encrypted:

• API keys: Telnyx, Shopify, and other integration credentials are encrypted before storage.
• OAuth tokens: Spotify and Instagram access tokens are encrypted.
• Passwords: User passwords are hashed using industry-standard algorithms (never stored in plain text).

​

Data in Transit

All communication between your browser and Fanaura’s servers is encrypted:

• HTTPS/TLS: Every request uses encrypted connections.
• API calls: All calls to third-party services (Telnyx, Shopify, Spotify, etc.) use encrypted connections.

​

Session Management

Fanaura’s security model includes active session management:

• Active session tracking: See which devices are logged into your account.
• Device identification: Each session shows the browser, operating system, and approximate location.
• Session revocation: Revoke individual sessions or all sessions at once.
• Session heartbeat: Sessions periodically refresh to stay active and provide accurate “last active” timestamps.

See Security Settings for full details.

​

Data Export

On the Complete plan, you can export your complete fan database and engagement data:

• Fan profiles with all fields.
• Engagement history (presaves, opens, clicks, purchases).
• Campaign results and delivery stats.
• Export in standard formats (CSV) for use in external tools.

Data export gives you full portability — your data is yours, and you can take it with you.

​

Third-Party Data Handling

When Fanaura connects with third-party services, data flows in both directions. Here is how each integration handles data: Fanaura only shares the minimum data necessary with each service for the integration to function.

​

Best Practices for Artists

​

Collect Only What You Need

Just because you can collect birthday, phone number, and location does not mean you always should. For a simple presave campaign, email might be enough. For a tour campaign, adding location makes sense. Match your data collection to your actual needs.

​

Be Transparent with Fans

Your smart link data wrapper explains what you collect. Go further — mention in your social posts why you are collecting data: “Sign up so I can send you exclusive content and tour updates.” Transparency builds trust.

​

Honor Opt-Outs Immediately

When a fan unsubscribes or texts STOP, respect it. Fanaura handles this automatically, but make sure your team knows not to manually re-add opted-out fans.

​

Review Your Fan Data Regularly

Check your fan database for outdated or inaccurate records. Clean data leads to better engagement rates and fewer bounced emails.

​

Secure Your Account

Your Fanaura account is the gateway to your fan data. Use a strong password, monitor active sessions, and limit team access to only those who need it.

​

What Happens Next

Fanaura’s privacy infrastructure works quietly in the background. You do not need to configure anything special — consent tracking, encryption, RLS, and opt-out processing are all built in. Focus on building genuine relationships with your fans, and know that their data is protected by design. If a fan ever requests their data or asks to be deleted, you can handle it directly from their fan profile in Fanaura. For questions about privacy compliance specific to your situation, consult with your legal team or use the Attorney role to give your counsel direct access to Activity Logs for review.