Privacy Policy
Last updated: October 2026
1. Introduction
Gatefolded LLC, based in Washington State, USA ("Gatefolded", "we", "us", or "our"), respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect your information when you use our music sharing platform, whether you are an artist with an account, a fan or listener visiting an artist's pages (see Section 2.5), or someone sending music through an artist's intake form (see Section 2.6).
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Email address
- Account preferences and settings
You sign in with a link we email you, or with Google. We do not store an account password. If you use Google, we receive your email address from Google to sign you in.
2.2 Content You Upload
We store the content you upload to the Service, including:
- Audio files (music tracks)
- Album artwork and images
- Album and track metadata (titles, descriptions, lyrics, credits)
- Links to streaming platforms and social media
2.3 Usage Data
We automatically collect certain information when you use the Service:
- IP address
- Browser type and version
- Device information
- Pages visited and features used
- Date and time of access
2.4 Payment Information
Payment processing is handled by third-party providers (Stripe). We do not store your full credit card number. We may receive and store transaction identifiers and billing information for record-keeping purposes.
2.5 Fans and Listeners
You do not need an account to visit an artist's pages. Depending on what you do there, we store the following on the artist's behalf, and the artist can see it:
- Signing up for updates. The email address and/or phone number you enter in an artist's signup form, and the page you signed up on. The artist can view and export this list. Gatefolded does not email or text you; any messages come from the artist.
- Invite-only releases. The email addresses an artist adds to a release's invite list; the email address you enter to get an access code; and the code itself, which expires after 10 minutes.
- Unlocking a protected release. When you unlock a release protected by a password or an invite list, we record the time, your email address (invite-list releases only) and your browser type. Your IP address is not part of that record.
- Requesting access or leaving feedback. The email address, optional name and message you send, which go to the artist.
- Listening statistics. Page views, plays and downloads on an artist's pages, recorded against a scrambled identifier made from your IP address and browser with a secret key, not your IP address or name.
- Limiting repeated attempts. When you enter a password, ask for or enter an access code, request access, leave feedback, sign up for updates or report content, we briefly keep your IP address with a count of your attempts, to slow down password guessing and spam. Your browser may also send us security warnings about a page, which are limited the same way. The artist cannot see your IP address, and it is deleted within about a day.
Apart from that IP address, this information is kept while the release or artist page it belongs to exists. It is deleted when the artist deletes that release, that artist page, or their account. To be removed from an artist's signup list or records sooner, contact the artist, or email us at hello@gatefolded.com and we will remove it.
2.6 Sending Music Through an Intake Form
An artist can publish an intake form to receive music from other artists. You do not need an account to send one. When you submit, we store the following on behalf of the artist who runs the form:
- Your details. Your full legal name, artist or stage name and email address, and, if you give them, your mailing address, PRO affiliation, IPI number and publisher, plus your answers to any questions the artist adds.
- Your music. The audio files you upload, with their titles and filenames.
- Your IP address, used only to limit repeated uploads and submissions. It is deleted within about a day.
The artist who runs the form, and the reviewers they add, can see your submission, play and download your audio, and export your details. When you submit, they are emailed your artist name and how many tracks you sent. Gatefolded staff can see submissions to support artists and to investigate abuse. Gatefolded does not email you.
Your details are kept until the artist deletes your submission or the form; Section 11 says how long the audio files are kept after that. To have a submission removed sooner, contact the artist, or email us at hello@gatefolded.com and we will remove it.
3. How We Use Your Information
We use your information to:
- Provide and maintain the Service
- Process your subscription and payments
- Send you important service updates and notifications
- If you have an account, send you emails about getting started and about the Service, each with a link to unsubscribe from them
- Respond to your inquiries and support requests
- Improve and optimize the Service
- Detect and prevent fraud or abuse
- Comply with legal obligations
4. Data Storage and Security
Your data is stored on secure servers provided by our infrastructure partners. We implement appropriate technical and organizational measures to protect your data, including:
- Encryption of data in transit (HTTPS/TLS)
- Encryption of sensitive data at rest
- Regular security assessments
- Access controls and authentication
While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.
5. Third-Party Services
We use the following third-party services to operate Gatefolded:
- Supabase - Database, authentication, and file storage
- Vercel - Website hosting and deployment
- Stripe - Payment processing for subscriptions
- Resend - Sending email, such as sign-in links, access codes and notifications. Resend keeps a copy of each email we send, including its content, for 30 days, then deletes it, along with the record of who it went to and when it was delivered. Resend's backups can hold a copy for up to 7 days after that. Sign-in links and access codes stop working long before then.
- Sentry - Error and performance monitoring, so we can find and fix problems. When an error occurs, Sentry receives a report: the error, the page or request involved, recent activity in the app (such as pages visited, network requests and console messages), and timing. Sentry also receives the messages our app writes to its logs, and timing for 10% of server requests. Before anything is sent, we remove email addresses, sign-in links and codes, passwords, access tokens and API keys, and private file links; cookies and the contents of requests are not sent. Sentry is set not to store IP addresses. Reports from completing a sign-in, or from unlocking or requesting access to a private link, are dropped before they are sent. We do not use session replay or screen recording. Sentry stores this data in the United States; our plan's standard retention is 30 days.
- Google - Sign-in, if you choose to sign in with Google
- Spotify API - To fetch album metadata and artwork when you add streaming links
- Apple Music API - To fetch album metadata and artwork when you add streaming links
- YouTube and Vimeo - Video players on artist pages that include videos. A player loads only when you press play; see Section 5.2
- Google (Ads and Analytics) and Meta - Advertising and measurement for Gatefolded's own marketing. These load only after you accept cookies, and never on an album share page; see Section 7
These providers process data under their agreements with us and, where applicable, their own privacy policies. We recommend reviewing their policies for more information.
5.1 Tip Processing
When you add tip links (Venmo, PayPal, Cash App) to your pages, we display these links to your visitors. Gatefolded does not process tip payments directly. Transactions occur entirely between your visitors and your chosen payment service. We do not receive, store, or have access to any payment information from tips sent to you.
5.2 Videos on Artist Pages
An artist can add YouTube or Vimeo videos to their artist page. Until you press play on one, your browser makes no request to YouTube or Vimeo: the thumbnail you see is served from Gatefolded, and we fetch thumbnails and video titles from YouTube and Vimeo on our servers, not from your browser.
When you press play, that video's player loads from YouTube or Vimeo, and from then on the provider's own privacy policy applies to what it collects. YouTube videos play from youtube-nocookie.com, YouTube's privacy-enhanced mode, and Vimeo videos play with Vimeo's do-not-track setting (dnt=1) turned on.
6. Data Sharing
We do not sell your personal information. We may share your data only in the following cases:
- With service providers who help us operate the Service (as described above)
- With Google and Meta, through our advertising and measurement tags, and with an artist's own advertising tags on their pages, only if you choose “Accept” on the cookie banner (Section 7)
- With YouTube or Vimeo, when you press play on a video on an artist page (Section 5.2)
- When required by law or to respond to legal process
- To protect our rights, privacy, safety, or property
- In connection with a merger, acquisition, or sale of assets (with notice to you)
8. Your Rights
Depending on your location, you may have the following rights:
- Access - Request a copy of your personal data
- Correction - Request correction of inaccurate data
- Deletion - Request deletion of your data
- Portability - Request your data in a portable format
- Objection - Object to certain processing of your data
If you have an account, you can do much of this yourself in Settings: export your data, or delete your account. For anything else, including a request about information an artist collected from you (Section 2.5), contact us at hello@gatefolded.com.
9. European Economic Area, UK and Switzerland
If the GDPR, the UK GDPR or Swiss data protection law applies to your information, you have the rights in Section 8, and the following applies.
9.1 Why We May Use Your Information
Each use of your information relies on one legal basis:
- Our contract with you — running your account, signing you in, storing and sharing what you upload, and sending the emails the Service needs to work (sign-in links, access codes, notices about your account).
- Our contract with you, and the law — billing your subscription through Stripe, and keeping the payment records the law requires.
- Our legitimate interests — finding and fixing errors and slow pages with Sentry (Section 5); keeping the Service secure and preventing fraud and abuse, such as limiting repeated requests and acting on reports; and, if you have an account, emailing you about getting started and about the Service. We have weighed these interests against yours and written the assessment down; you can ask us for a copy.
- Your consent — Vercel Analytics, our advertising and measurement tags, and an artist's own tags, given or refused on the cookie banner and changed as described in Section 7.
- Legal obligations — answering lawful requests from authorities.
Where we rely on legitimate interests, you can object, and we will stop unless we have a compelling reason to continue. Every email about getting started or about the Service has an unsubscribe link, and once you use it we send you no more of them. Information about fans and listeners (Section 2.5), and about people who send music through an intake form (Section 2.6), is stored on the artist's behalf; the artist decides why it is collected.
9.2 Transfers Outside Europe
Gatefolded is based in the United States, and so is most of what it runs on. Using the Service from the EEA, the UK or Switzerland means your information is transferred there. These are the providers that handle it for us, where they keep it, and the safeguards for the transfer:
- Supabase (Supabase Pte. Ltd., Singapore) — our database, sign-in and files are hosted in the United States (US East). Safeguard: the European Commission's Standard Contractual Clauses, with the UK Addendum and the Swiss adjustments. Agreement
- Vercel (Vercel Inc., United States) — serves the website; our server functions run in the United States (US East). Safeguards: the Standard Contractual Clauses (for the UK, the International Data Transfer Agreement), and Vercel Inc. is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Framework. Agreement
- Stripe (Stripe, LLC, United States) — payments. Safeguards: the Data Privacy Framework, then the Standard Contractual Clauses or the UK International Data Transfer Addendum. Agreement
- Resend (Plus Five Five, Inc., United States) — sends our email, from the United States (US East). Safeguards: the EU-U.S. Data Privacy Framework and its UK Extension, and the Standard Contractual Clauses, with the UK Addendum and the Swiss adjustments. Agreement
- Sentry (Functional Software, Inc., United States) — error and performance monitoring; stored in the United States. Safeguards: the Data Privacy Framework, with its UK Extension and the Swiss-U.S. Framework, then, if it does not apply, the Standard Contractual Clauses, with the UK Addendum and the Swiss adjustments. Agreement
Google, Meta and an artist's chosen ad platforms receive information only through tags you have accepted (Section 7), and Google when you choose to sign in with it. They handle it under their own terms and privacy policies, not as our providers. For a copy of the safeguards that apply to your information, email us at hello@gatefolded.com.
10. California Residents
If you are a California resident, you have the right to know what personal information we collect, to request its deletion or correction, and to opt out of its sale or sharing. We do not sell personal information.
Our advertising and measurement tags (Section 7) send information about your visit, and about signing up or subscribing, to Google and Meta. California law may treat this as “sharing” for cross-context behavioral advertising. Those tags load only if you choose “Accept” on the cookie banner; declining, or not answering, keeps them off. To make a request, email us at hello@gatefolded.com.
11. Data Retention
We retain your data for as long as your account is active or as needed to provide the Service.
- If you delete your account in Settings, it is deleted straight away.
- If your free trial ends without a subscription, or a paid subscription ends and is not renewed, we delete the account and its files 30 days later.
- Information about fans and listeners is kept as described in Section 2.5.
- Submissions sent to an artist through an intake form are kept until the artist deletes them or the form. Their audio files are removed by a nightly cleanup once 7 days have passed, and a private copy of each is kept for a further 30 days in case a deletion was a mistake, then erased the same way.
Deleted files may remain in private backups for a limited time before they are permanently erased. Payment records are kept by our payment provider, Stripe, as the law requires.
12. Children's Privacy
The Service is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such data, we will delete it promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service or by email. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.
14. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us at hello@gatefolded.com.