The artist is the controller of its fan base. Connect processes that data on the artist's behalf, under a data-processing agreement, and uses none of it for its own purposes. Fans exercise their rights directly on the artist's page — view, export, correct, delete — with nobody in between.
The contact form on this site is the one place we hold personal data for ourselves: your name, email, artist and message. We use it to reply, and for nothing else. It never meets any artist's base.
Access requests: until the conversation ends, then 12 months. Audit logs: 24 months. Campaign events: 24 months, then aggregated. A deleted fan is anonymised; the fact that an event happened stays, without a name.
Data lives in São Paulo, Brazil (AWS sa-east-1, through Supabase). Backups daily, kept 30 days.
hello@bandmade.app. We answer within 15 days.
Updated 4 September 2026. Working draft.