Privacy Policy

1. Who is responsible

The data controller is Vitor Moreira, an individual based in Brazil who runs EPK Social. Contact: vitor@epk.social.

2. Data we collect

We only collect what the service needs to work:

• Account: name, email address and profile picture received from Google when you sign in with Google, or the email you enter when you sign in with a magic link.
• EPK content: artist name, bio, photos, music and social links, gigs, tech rider and any other information you publish.
• Booking requests: name, email, WhatsApp, date, venue, event type, budget and message sent by promoters through your EPK form.
• CRM: contacts you add yourself (name, email, phone, company).
• Usage: page views and link clicks on your EPK, recorded with a hashed IP address (we do not store the plain IP).
• Billing: your plan and subscription status. Card details are processed directly by Stripe and never touch our servers.

3. Google user data

For EPK Social sign-in we only request the openid, email and profile scopes. We use this data solely to create and identify your account and to send you service emails. EPK Social does not access Gmail, Drive, contacts or any other data in your Google account.

We do not sell Google user data, do not use it for advertising and do not share it with third parties except as needed to operate the service (for example, our database provider) or when required by law.

EPK Social's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3.1. rclone music (personal tool)

rclone music is a private tool operated by Vitor Moreira for personal use. It is a configuration of the open-source rclone tool, running on the operator's own Windows computer, that stores and syncs the operator's music library (audio files) in the operator's own Google Drive. It is not offered to the public; the only Google account ever authorized is the operator's.

Scope used: https://www.googleapis.com/auth/drive.file. It grants access only to the files this tool created in the operator's Google Drive, and nothing else in the account. This access is used solely to upload, list, update and download those music files.

Data moves directly between Google Drive and the operator's computer. No EPK Social server (or any third-party server other than Google's) receives or stores it. The access token is kept only in the local rclone configuration on that computer. The data is not sold, shared or used for advertising.

rclone music's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use data

• Create your account, authenticate you and keep you signed in.
• Publish your EPK and deliver booking requests to you.
• Show traffic statistics for your EPK.
• Process subscriptions and send transactional emails (sign-in, billing, account notices).
• Protect the service against abuse, bots and fraud.
• Protect unreleased content: audio files shared through the platform may carry a copy identifier, and we log opens and downloads (IP in irreversible form and browser type) so the content owner can find the source of unauthorized sharing.

5. Who we share data with

We use providers that process data on our behalf, only to operate the service:

• Vercel: hosting and bot protection.
• Neon: PostgreSQL database.
• Cloudflare R2: storage for uploaded images and files.
• Resend: email delivery.
• Stripe: payments and subscriptions.
• Upstash: rate limiting (anti-abuse).
• Meta (Pixel): campaign measurement, only when enabled on the site.
• PostHog (US servers): site usage analytics and error logging. Without your consent it runs in memory only and stores nothing in your browser; on artists' public EPKs it never stores anything. When you are signed in, analytics are linked to your account ID, never your name or email.

6. Cookies

We use first-party cookies for:

• Sign-in session (Auth.js).
• epk_lang: chosen language.
• epk_signup_draft: draft name and link from sign-up (1 hour).
• epk_vid: anonymous visitor identifier for statistics (1 year).
• epk_attr: visit source for campaign measurement (60 days).
• epk_ref: referral code for the affiliate program (60 days).
• epk_agency_invite: invitation to join an agency.
• epk_consent: your choice about analytics cookies (1 year).
• ph_*: PostHog identifier for usage analytics, only after you accept (1 year).

7. How long we keep data

We keep data while your account is active. If you ask us to delete your account, we delete your data within 30 days, except what we must keep by law (for example, billing records).

Access logs for unreleased content are deleted after 180 days, and files uploaded for source checks after 30 days.

8. Your rights

You can request confirmation of processing, access, correction, portability, anonymization or deletion of your data, and withdraw consent. Send your request to vitor@epk.social; we reply within 15 days.

9. Children

EPK Social is not intended for anyone under 18.

10. Changes

We may update this policy. The last-updated date is shown at the top of this page; material changes will be announced by email.

11. Contact

Privacy questions or requests: vitor@epk.social.