Privacy Policy

1. Data Controller

The Artist Base ("we", "our", or "us") is the data controller responsible for your personal data. You can reach us at:

• Company: The Artist Base
• Email: sacha@masterthemix.com

2. Introduction

We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR / AVG) and other applicable privacy legislation. This Privacy Policy explains how we collect, use, and safeguard your personal information when you use our platform at theartistbase.app, theartistbase.com, and our mobile applications for iOS and Android (collectively, the "Platform").

3. Minimum Age

You must be at least 16 years old to use our platform. If you are under 16, you may only use our services with the consent and supervision of a parent or legal guardian. We do not knowingly collect personal data from children under 16 without parental consent.

4. Information We Collect

We collect the following types of information:

• Account Information: Your name, email address, and profile photo when you sign up or log in with Google.
• Profile Data: Information you voluntarily add to your profile, such as your display name, bio, and avatar.
• Content: Posts, messages, audio files, video files, and other content you create or share on the platform.
• Usage Data: Information about how you interact with our platform, including pages visited and features used.
• Device Information: When you use our mobile app, we may collect device type, operating system version, and unique device identifiers for the purpose of delivering push notifications and ensuring app stability.
• Push Notification Tokens: If you enable push notifications, we collect a device token (Firebase Cloud Messaging token) to deliver notifications about lessons, messages, and platform updates. You can disable push notifications at any time through your device settings or in-app preferences.
• Google Calendar Data: If you choose to connect your Google Calendar, we access your calendar availability (free/busy information) and create, update, or delete calendar events on your behalf. See Section 8 for full details.
• AI Conversations: If you use our AI assistant, we process the messages and any images you share within the conversation to provide you with relevant responses. See Section 9 for full details.
• Payment Information: If you make purchases or subscribe to services, payment data is collected and processed by our payment provider (Stripe). We do not store your full credit card details on our servers.

5. Legal Basis for Processing

We process your personal data based on the following legal grounds under the GDPR:

• Contract Performance: Processing necessary to provide our platform services, including account management, lesson scheduling, and content delivery.
• Consent: For optional features such as Google Calendar integration and AI assistant usage, which require your explicit opt-in.
• Legitimate Interest: For platform security, fraud prevention, support operations, and improving our services.

6. How We Use Your Information

• To provide and maintain our platform across web and mobile
• To authenticate your identity and manage your account
• To enable communication between users (chat, community features)
• To send you push notifications about lessons, messages, and platform activity (if you opt in)
• To improve our platform and develop new features
• To sync your lesson schedule with your Google Calendar (if you opt in)
• To check teacher availability via Google Calendar when scheduling lessons
• To provide AI-powered learning assistance (if you opt in)
• To process payments and manage subscriptions via our payment provider
• To provide customer support and ensure platform quality through authorized administrative account access (see Section 15)

7. Data Storage, Security & Retention

Your data is stored securely using industry-standard security measures, including encryption in transit and at rest. OAuth tokens used for third-party integrations are encrypted before being stored and are permanently deleted when no longer needed.

Data Retention

• Account Data: Retained for as long as your account is active. When you delete your account, your personal data is permanently removed within 30 days.
• Content: Posts, text messages, and uploaded media (such as community posts and profile content) are retained until you delete them or delete your account.
• Chat Media: Photos and videos shared through in-app chat messages (including direct messages, group chats, and community chats) are automatically deleted from our servers after 12 months from the date of upload. Text messages and message metadata are not affected by this policy and remain available. This automatic deletion is part of our data minimisation practice in accordance with GDPR Article 5(1)(e).
• AI Conversations: Conversation history is retained to provide continuity. You can delete your conversation history at any time.
• OAuth Tokens: Stored only while the integration is active. Deleted immediately upon disconnect or token expiration.
• Push Notification Tokens: FCM tokens are stored while you have push notifications enabled. They are deleted when you disable notifications or uninstall the app.
• Usage Data: Aggregated analytics data may be retained for up to 12 months for product improvement purposes.

8. Google Calendar Integration & Google API Services

Our platform offers an optional Google Calendar integration to help teachers and students manage their lesson schedules. This feature requires your explicit consent and can be disconnected at any time.

8.1 Data We Access

When you connect your Google Calendar, we request access to:

• Calendar Events (read/write): We create lesson events on your calendar, update them when schedules change, and delete them when lessons are cancelled.
• Calendar Availability (read-only): For teachers, we read your calendar's free/busy information to prevent double-bookings when students schedule lessons.
• Google Meet: We generate Google Meet video conference links that are attached to lesson calendar events.

8.2 How We Use Google Calendar Data

Google Calendar data is used exclusively for the following purposes:

• Creating, updating, and deleting lesson events on your primary Google Calendar
• Checking teacher availability (free/busy times) to show only open time slots when booking lessons
• Generating Google Meet links for online lessons

8.3 Data Sharing, Transfer & Disclosure

We do not share, transfer, sell, or disclose your Google user data to any third parties. Specifically:

• Your Google Calendar data is not shared with any third-party companies, advertisers, data brokers, or external services.
• Your Google Calendar data is not transferred to any external parties or systems outside of our platform.
• Your Google Calendar data is not disclosed to any other users of our platform. Other users only see whether a time slot is available or unavailable — they never see your calendar event details.
• Your Google Calendar data is not used for advertising, analytics, or any purpose other than providing the lesson scheduling features described in this policy.

8.4 Data Retention & Revocation

• OAuth tokens are stored only as long as your calendar is connected. When you disconnect your Google Calendar through your account settings, all stored tokens are permanently deleted.
• If your tokens expire and cannot be refreshed, they are automatically deleted from our systems.
• You can revoke our access at any time through your Google Account permissions page.

8.5 Google API Services User Data Policy

The Artist Base's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. AI Assistant (Juno)

Our platform includes an optional AI-powered learning assistant called Juno. Using Juno is entirely voluntary.

9.1 Data We Process

• Messages: The text messages you send to Juno are processed to generate relevant responses.
• Images: If you share screenshots or images with Juno, these are processed to provide visual feedback and analysis.
• Lesson Context: When using Juno during a lesson, relevant lesson information may be included to provide contextual assistance.

9.2 How AI Data Is Handled

• AI conversations are processed using Google's Gemini AI service, which operates under Google's data processing agreements and privacy commitments.
• Your conversations are not used to train AI models.
• Your AI conversation data is not shared with or sold to third parties.
• Images shared with Juno are processed temporarily and are not permanently stored by the AI service.

10. International Data Transfers

Our platform uses service providers that may process data outside the European Economic Area (EEA). We ensure that any such transfers are protected by appropriate safeguards:

• Our primary service providers participate in the EU-U.S. Data Privacy Framework, ensuring an adequate level of data protection as recognized by the European Commission.
• Where applicable, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to safeguard your data.

11. Third-Party Services

We use the following categories of third-party services to operate our platform:

• Authentication & Database: For user account management and data storage.
• Content Delivery & Storage: For serving media files and protecting our platform.
• Payment Processing: For handling subscriptions and payments. Your payment provider receives only the data necessary to process transactions.
• AI Services: For powering the Juno learning assistant (see Section 9).

None of these services have access to your Google Calendar data. Each service processes only the minimum data required for its specific function.

12. Your Rights

Under the GDPR, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate personal data.
• Right to Erasure: Request deletion of your personal data.
• Right to Restrict Processing: Request that we limit how we use your data.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent at any time for features based on consent (e.g., Google Calendar integration, AI assistant).

To exercise any of these rights, contact us at sacha@masterthemix.com. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

13. Mobile Application

Our Platform is available as a mobile application for iOS and Android. In addition to the data practices described above, the following applies when using our mobile apps:

• Push Notifications: We use Firebase Cloud Messaging (FCM) to send push notifications. You can manage your notification preferences in the app settings or through your device's system settings.
• Camera & Media Access: Our app may request access to your device's camera and photo library to allow you to upload profile pictures, community posts, and other content. This access is only used when you actively choose to upload media.
• Haptic Feedback: Our app uses haptic feedback (vibration) to enhance your user experience. No data is collected through this feature.
• Local Storage: The app may store non-sensitive data locally on your device for performance and offline functionality.
• App Store Data: When you download our app, the respective app store (Apple App Store or Google Play Store) may collect data according to their own privacy policies.

14. Cookies

We use the following types of cookies:

• Essential Cookies: Required for authentication and session management. These are strictly necessary for the platform to function and do not require consent.
• Analytics Cookies: We use Google Analytics 4 (GA4) to understand how our platform is used and to improve our services. These cookies (such as _ga and _ga_*) are only placed after you give your consent via our cookie banner.

14.1 Your Cookie Choices

When you first visit our platform, you will see a cookie banner asking for your consent. You can accept or decline analytics cookies at any time. If you decline, we still collect basic, anonymized usage data without cookies (via Google's consent mode), which does not identify you personally.

You can also clear your cookie preferences by clearing your browser's local storage, after which the cookie banner will appear again.

15. Administrative Account Access

To ensure platform quality, provide customer support, and diagnose technical issues, authorized administrators may access your account view. This means an administrator can see the platform as you see it, including your profile, enrolled courses, lesson schedules, and other account information.

15.1 Purpose

• Diagnosing and resolving technical issues reported by users
• Verifying that platform features function correctly for your account
• Providing customer support when you contact us with a problem
• Ensuring the quality and integrity of our educational content delivery

15.2 Safeguards

• Restricted Access: Only authorized administrators can use this feature. Regular staff and teachers cannot access other user accounts.
• Audit Trail: Every instance of administrative account access is logged, including the administrator's identity, timestamp, and duration.
• Rate Limited: The number of account accesses per administrator is limited to prevent misuse.
• No Credential Access: Administrators do not see or access your password, payment details, or third-party OAuth tokens (Google, Spotify, Instagram).

15.3 Legal Basis

This processing is based on our legitimate interest (GDPR Article 6(1)(f)) in maintaining platform quality and providing effective customer support. This is a standard practice used by professional software platforms worldwide.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify users through the platform or via push notification. Your continued use of our platform after changes are made constitutes your acceptance of the updated policy.

17. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us at sacha@masterthemix.com.