Privacy policy

Data controller

Theo Dumont EI, 148 rue du Général De Gaulle, 69530 Brignais, France.

Data requests go to hello@joinstarshine.com. No data protection officer is appointed: that is only mandatory in specific cases, none of which applies here today.

Data we collect

This list matches what the database actually holds: it is drawn from the schema, not from a template.

• Account: email address, hashed password, creation date
• Profile: username, display name, biography, picture, language
• Declared location: country and city, chosen by you and not inferred from your IP address
• Date of birth, collected to check the minimum age and to gate purchases
• Music preferences: genres, and for solo artists, instruments played
• For artists: page address, name, biography, profile and cover images
• Progress through the sign-up flow

For those who buy, order history and billing details are added. Card details are handled directly by our payment provider and never pass through our servers.

Finally, anonymised browsing data is collected for audience measurement, only from visitors who have accepted it.

We collect no advertising data, no precise location data, and no sensitive data within the meaning of the GDPR.

Purposes and legal bases

• Running the service and managing your account: performance of the contract
• Checking the minimum age: legal obligation and legitimate interest
• Displaying published artist pages: performance of the contract
• Keeping the service secure and preventing abuse: legitimate interest
• Sending account emails such as address verification: performance of the contract
• Processing purchases and meeting accounting obligations: performance of the contract and legal obligation
• Measuring site audience to improve it: consent, revocable at any time

No data is used for marketing without your consent, and none is sold.

What is public

A published artist page is public and indexable by search engines: its name, address, biography, images and city are visible to everyone.

Your date of birth and email address are never shown publicly.

Processors

• Supabase: database, authentication and file storage
• Stripe: payment processing. Stripe receives the data needed for the transaction and acts as an independent controller for fraud prevention. Your card details never pass through or rest on our servers.
• The audience measurement tool, for visitors who accepted it only
• The email service used for account messages
• Vercel Inc.: site hosting, in the United States

Some of these processors handle data in the United States. Those transfers rely on the mechanisms provided by the GDPR: standard contractual clauses, or certification under the EU-US Data Privacy Framework depending on the provider.

À compléterTo be completed: exact name of the email service and of the measurement tool, the Supabase project region, readable in its dashboard, and, for each US provider, the transfer mechanism actually relied upon.

Retention

Account data is kept while the account exists, then deleted once it is closed. Accounting records tied to a purchase are kept for the period the law requires.

À compléterTo be specified: any grace period between a deletion request and final erasure, and what happens to the public content of an artist whose account is closed.

Your rights

You have rights of access, rectification, erasure, restriction, objection and portability. Requests go to the contact address above and are answered within one month.

You may also lodge a complaint with the CNIL, the French data protection authority.

Security

Passwords are never stored in clear text. Traffic to the site is encrypted. Access to production data is limited to those who need it.