Privacy Policy
Last updated :
This policy explains what personal data Artist Magma processes, why, who it is shared with, how long it is kept, and how to exercise your rights. It applies to the Artist Magma application, its public pages and the services they rely on.
1.In short
- Artist Magma is professional software for artist agency management, sold by subscription. It is not a social network and not an advertising business.
- We do not sell your personal data, we do not rent or trade it, and we do not use it for targeted advertising or to train artificial intelligence models.
- No advertising cookies, no third-party analytics trackers. Only cookies strictly necessary to run the service are set.
- Signing in with Google gives us access only to your Google account identifier, email address, name and profile picture. We request no access to Gmail, Drive, Calendar, Contacts or Photos.
- Application data is hosted in the European Union (Amsterdam, the Netherlands).
- You can delete your account at any time from the application; your name stays attached to the operations you performed, and write to admin@vesuveagency.com to exercise your rights.
This summary is provided for readability and has no contractual value: only the full text below binds the publisher.
2.Who is responsible for your data
The controller for the data described in this policy is Blackbird Services SARL, publisher of Artist Magma.
For any question about your personal data, or to exercise your rights, write to admin@vesuveagency.com. This address is the single point of contact for all data protection requests.
Publisher
- Company name
- Blackbird Services
- Legal form
- SARL
- Share capital
- €1,000
- Registered office
- 9 rue des Colonnes, 75002 Paris, France
- Trade register
- Paris 938 406 402
- SIRET
- 938 406 402 00017
- EU VAT number
- FR 52 938 406 402
- Contact
- admin@vesuveagency.com
- Phone
- +33 6 23 26 26 76
- Publication director
- Vincent Chemouny
Hosting
- Hosting provider
- Railway Corporation
- Registered office
- 2261 Market Street #4667, San Francisco, CA 94114, USA
- Website
- railway.com
- Application data location
- Amsterdam
3.Two distinct roles: controller and processor
Artist Magma is a professional service used by agencies. Depending on the data at stake, our role under the GDPR differs.
- Controller — for data tied to your user account and to the commercial relationship: account creation, authentication, access rights, subscription billing, service security and support. This policy is what applies.
- Processor — for the data an agency enters or imports into its workspace: artists, contacts, clients, show dates, deals, contracts, travel, invoices, royalties. The agency is the controller: it defines the purposes, informs the data subjects and sets the retention periods. We act only on its documented instructions, under Article 28 GDPR.
If you are an artist, contact, client, traveller or supplier appearing in an agency's workspace and wish to exercise your rights, contact that agency first. If you write to us directly, we will forward your request and point you to the right contact, but we cannot answer on the agency's behalf.
4.Data we process
We do not store your IP address or user agent in the application database. Technical logs kept by our hosting and security providers may contain them, for a short period and solely for security, abuse detection and diagnostics.
Some features — visas, travel, artist files — lead an agency to upload identity documents or administrative papers. That content is the agency's responsibility: it must have a legal basis and inform the individuals concerned.
- Account data — technical identifier, email address, first name, last name, profile picture, interface language, creation and update dates. It comes from you, from your identity provider when you use Google sign-in, or from the agency that invited you.
- Membership and permission data — the agencies your account belongs to, your role, the modules you may access and the artists you may see. It drives access partitioning.
- Authentication and session data — session identifiers, authentication status, sign-in events and invitations, processed by our authentication provider.
- Content entered by the agency — artists, contacts, clients, venues, dates, deals, contracts, documents, travel, invoices, payments, bank details, royalties. We process it as a processor.
- Subscription billing data — customer identifier at our payment provider, subscribed plan, subscription status, invoice history. Card details are entered directly with that provider and never pass through our servers.
- Audit trail — author, date, action, object type and technical identifier of sensitive operations performed in an agency workspace. It serves security and traceability.
- Technical operating data — application logs, request identifiers, aggregated performance measurements. Email addresses, phone numbers and bank details are masked in them; cookies, keys, tokens and signed URLs are stripped.
5.Google sign-in and use of Google user data
Artist Magma offers Google as a sign-in method. It is implemented through our authentication provider: Google authenticates you, then passes us a limited set of data.
The only scopes requested on the Google consent screen are openid, email and profile. Accordingly, we receive:
- your Google account identifier, used solely to link the sign-in to your Artist Magma account;
- your email address and its verification status, used as your sign-in identifier and for service-related communications;
- your first and last name, where present in your Google account, used to display your identity within your agency;
- the URL of your profile picture, used to display your avatar;
- your account language, used to pick the initial display language.
| What we do | What we never do |
|---|---|
| Create and secure your account, and authenticate you | Sell, rent or transfer the data received from Google |
| Display your identity and avatar in the application | Use it for advertising or profiling |
| Send you the messages the service requires | Pass it on to data brokers |
| Keep this data for as long as your account exists | Use it to train artificial intelligence models |
We request no access to Gmail, Google Drive, Google Calendar, Google Contacts, Google Photos, or any other Google API holding your data. We neither read, write nor store anything in your Google account.
Artist Magma's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You may revoke the access granted to Artist Magma at any time from your Google account connections page. Revoking prevents further sign-ins by that method but does not erase data already linked to your Artist Magma account: to do that, delete your account.
6.Purposes and legal bases
| Purpose | Data involved | Legal basis |
|---|---|---|
| Create and manage your account, authenticate you, enforce your access rights | Account, authentication, membership and permissions | Performance of the contract (Article 6(1)(b) GDPR) |
| Provide the application's features to your agency | Content entered by the agency | Performance of the contract with the agency, on its documented instructions (Article 28) |
| Bill the subscription and keep accounting records | Subscription billing data, accounting records | Performance of the contract and legal obligation (Articles 6(1)(b) and 6(1)(c)) |
| Keep the service secure, prevent fraud and abuse, trace sensitive operations | Audit trail, technical logs | Legitimate interest and security obligation (Articles 6(1)(f) and 32) |
| Handle support requests | Account data and the content of the request | Performance of the contract and legitimate interest |
| Measure and improve service performance | Aggregated performance measurements | Legitimate interest (Article 6(1)(f)) |
| Meet legal obligations and respond to lawful requests from authorities | As required by the request | Legal obligation (Article 6(1)(c)) |
Where we rely on legitimate interest, we have balanced that interest against your rights. You may object on grounds relating to your particular situation (see "Your rights").
8.Recipients and processors
Your data is accessible only to authorised staff of the publisher who need it, and to the following providers, each for the stated purpose.
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Clerk, Inc. | Authentication, account, session and invitation management | United States | Processor, standard contractual clauses |
| Railway Corporation | Hosting of the application, database and files | Data stored in the European Union (Amsterdam); company established in the United States | Processor, standard contractual clauses |
| Stripe Payments Europe, Ltd. | Subscription payment and billing | Ireland, group partly established in the United States | Processor, standard contractual clauses |
| Yousign SAS | Electronic signature of contracts | France | Processor |
| Invoice Ninja | Issuing the agency's invoices and credit notes | Depending on the configured instance, by default the service hosted in the United States | Processor, standard contractual clauses |
| Cloudflare, Inc. | Anti-bot protection of the sign-up form, through our authentication provider | United States | Sub-processor, standard contractual clauses |
| Google Ireland Limited and Google LLC | Google sign-in; address search and normalisation | Ireland and the United States | Independent controller for your Google account; processor for address search |
| Spotify AB | Optional connection, at the agency's initiative, of a Spotify account for royalty tracking | Sweden and the United States | Independent controller, connection triggered by the agency |
| aviationstack, SNCF Connect | Flight and train schedules | Outside our scope of responsibility | No identifying data is sent: only a flight or train number and a date |
Your data may also be disclosed to our professional advisers bound by professional secrecy (lawyer, accountant) and to administrative or judicial authorities where a legal obligation requires it. We inform client agencies before adding or replacing a processor.
9.Transfers outside the European Union
Application data — database and files — is stored in the European Union, in the Amsterdam region (the Netherlands).
Some of the providers listed above are established outside the European Union, mainly in the United States. Those transfers are governed by the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), supplemented where applicable by the provider's certification under the EU-U.S. Data Privacy Framework, and by additional technical measures: encryption in transit, encryption at rest for the most sensitive data, and minimisation of the data transmitted.
A copy of the applicable safeguards may be requested at admin@vesuveagency.com.
10.Retention periods
| Data | Period |
|---|---|
| User account | For the duration of the relationship, then deleted at your request or when the account is closed |
| Professional contact details | 3 years after the last interaction, then anonymised |
| Client portal access token | 90 days of activity, then purged 365 days after expiry or revocation |
| Content upload token | 180 days at most, then purged 365 days after expiry or revocation |
| File upload intent | 30 days |
| Travel information | Duration of the trip plus 12 months, then anonymised unless attached to an accounting record |
| Accounting and supporting records (contracts, invoices, signature evidence) | 10 years under Article L123-22 of the French Commercial Code, in a restricted-access archive |
| Audit trail | For the investigation window, then pseudonymised and purged |
| Technical delivery events | 90 days |
| Credentials and secrets for third-party services | Until rotation or revocation, then purged without retention |
These periods are maximums enforced by an automated purge job. A legal obligation, ongoing litigation or a lawful request may justify longer retention, strictly limited to that purpose.
11.Security
We implement the following technical and organisational measures:
- encryption of communications in transit;
- AES-256-GCM application-level encryption of bank details and of third-party service secrets, with a cryptographic context specific to each agency;
- strict data partitioning per agency, verified by automated tests run on every code change;
- access control by role, by module and by artist, enforced server-side rather than in the browser;
- masking of personal and financial data in logs, error messages and metrics;
- random external access tokens, stored as digests, with a limited lifetime and revocable;
- traceability of sensitive operations in an audit trail;
- an inventory of sensitive entry points and security review built into the development process.
No measure makes a system impenetrable. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we notify the CNIL within 72 hours and inform the individuals concerned where the risk is high, in accordance with Articles 33 and 34 GDPR.
12.Your rights
Under the conditions set out in the GDPR, you have the following rights:
- right of access — to confirm whether we process data about you and obtain a copy;
- right to rectification — to have inaccurate or incomplete data corrected;
- right to erasure — to obtain deletion of your data, subject to our legal retention obligations;
- right to restriction of processing, pending verification;
- right to portability — to receive the data you provided to us in a structured, commonly used, machine-readable format;
- right to object — to object to processing based on our legitimate interest, on grounds relating to your particular situation;
- right to withdraw consent at any time where processing relies on it, without affecting the lawfulness of processing already carried out;
- right to give directions on what happens to your data after your death, under Article 85 of the French Data Protection Act.
To exercise these rights, write to admin@vesuveagency.com stating what you are asking for. We reply within one month of receipt, extendable by two months for a complex request — we will tell you if that happens. Proof of identity is requested only where there is reasonable doubt about the requester's identity. You may also lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or online at cnil.fr.
13.Deleting your account and data
You can delete your account at any time from the application, on your account page. Deletion destroys your identity at our authentication service — you can no longer sign in — and puts your email address out of use: it no longer appears in the application and can no longer be used to re-invite you. Only a fresh invitation, on a new identity, would restore your access.
Content you created inside an agency workspace belongs to that agency: it is not deleted along with your account. Your first and last name stay attached to it — as the author of a comment, a task or a document, and in the audit trail — because that is what lets the agency know who did what. That is the sole purpose of this retention. To request erasure of your name, write to us at admin@vesuveagency.com: we answer under the terms set out in the “Your rights” section.
Deleting an agency workspace follows a controlled procedure: prior inventory, access lockout, token revocation, restricted archiving of records subject to legal retention, dual approval, then irreversible purge of data and files, including their previous versions.
14.Minors
Artist Magma is a professional tool intended for agencies and their staff. We do not knowingly create accounts for anyone under 16. If you believe an account was created for a minor, write to admin@vesuveagency.com and we will delete it.
An agency may enter data about underage artists. As the controller, it is for the agency to obtain the necessary authorisations.
15.Automated decision-making and profiling
We make no decision producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing. We carry out no profiling for advertising, scoring or prospecting purposes.
16.Changes to this policy
This policy may change, in particular to reflect a new feature, a change of provider or a regulatory development. The last update date appears at the top of the page.
Where the change is substantial, we inform client agencies and account holders through an in-app message or by email before it takes effect.
17.Contact us
For any question about this policy or about how your data is processed: admin@vesuveagency.com.
By post, at the registered office address given in the "Who is responsible for your data" section.