Privacy Policy

1. Introduction & Scope

This Privacy Policy explains what personal data we collect, how we use it, when we share it, and your rights when you use the Producer Brain website and desktop application ("Service").

Producer Brain is a CRM and workflow tool designed for music producers to organize contacts, manage sample send-outs, and track opportunities.

Personal data refers to any information that identifies you or can reasonably be linked to you.

2. Definitions

Controller

The person or organization that determines how personal data is processed.

Processor

A third party that processes personal data on behalf of the Controller.

Personal Data

Information relating to an identified or identifiable person.

Processing

Any operation performed on personal data including collection, storage, use, sharing, or deletion.

3. Data Controller

4. Data We Collect

Account Data

• Name and email address
• Authentication identifiers
• Workspace identifiers
• Selected plan or campaign intent
• Terms and Privacy Policy versions, acceptance timestamp, and anti-abuse verification reference

Contact & CRM Data

Data you choose to store in the CRM, such as:

• Contact names
• Email addresses
• Roles (producer, A&R, manager, etc.)
• Notes and tags

File Metadata

Producer Brain may store metadata about files such as:

• File name, file size, file path
• Associated contact or project

Actual files may remain in your connected cloud storage (for example Dropbox).

Email Sendout Data

When you use email sendouts we may store metadata including:

• Message IDs, send timestamps, delivery status, open events
• Recipient status, unsubscribe tokens, unsubscribe events, bounce or complaint status, and suppression records used to exclude recipients from future sendouts

Unsubscribe and suppression records may be retained as operational safety records so Producer Brain can honor opt-out, do-not-contact, bounced, and complaint signals across future sendouts.

Google Gmail Connection Data

When you connect Gmail, Producer Brain requests the Gmail Send permission https://www.googleapis.com/auth/gmail.send plus the basic Google identity scopes openid and email. The Gmail permission is used only to send messages you initiate from the app. The identity scopes are used only to identify and display the connected sender.

• Producer Brain does not read, search, monitor, modify, or delete your Gmail inbox, drafts, labels, or existing messages.
• Producer Brain may store your connected Gmail address, OAuth scope, connection status, and encrypted refresh token so Gmail can stay connected and background sendouts can work. The desktop app never persists Google tokens in plaintext; if operating-system secure storage is unavailable, tokens remain in memory only for that app session.
• For background sendouts you explicitly start, the refresh token, email content, recipients, selected sample attachments, and sendout metadata are transmitted over HTTPS to Producer Brain's protected sendout service. The token is encrypted at rest and this data is processed only to create and send those emails.
• You can disconnect Gmail in the app. Disconnecting removes the stored Gmail token used by Producer Brain and requires reconnecting before further Gmail sendouts.

Technical Data

• Device type, operating system, app version
• Log data for debugging
• IP address
• Cloudflare Turnstile challenge outcome and related security signals used to prevent automated account abuse

5. How We Collect Data

We collect data when you:

• Create an account
• Use the Producer Brain desktop application
• Import contacts
• Connect external services (Dropbox, Gmail)
• Send emails through the Service
• Interact with the website

6. Cookies & Website Tracking

The Producer Brain website may use cookies for:

• Essential website functionality
• Account security and bot prevention
• Analytics
• Performance monitoring

You can disable cookies in your browser settings.

7. Legal Basis for Processing (GDPR)

We process personal data based on:

• Contract Fulfillment (Art. 6(1)(b) GDPR): To operate the Service and provide CRM features.
• Consent (Art. 6(1)(a) GDPR): When users connect integrations or enable features.
• Legal Obligations (Art. 6(1)(c) GDPR): To comply with legal requirements.
• Legitimate Interests (Art. 6(1)(f) GDPR): For security, analytics, and fraud prevention.

8. Third-Party Services

Producer Brain may use trusted third-party services such as:

These providers process data under contractual agreements.

9. Google Workspace API Limited Use

Producer Brain uses Google Workspace APIs only to provide user-facing Gmail sendout functionality inside the app.

The use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

We do not sell Google user data, use it for advertising, transfer it to data brokers, or use it to train general artificial intelligence or machine learning models.

10. International Data Transfers

Some providers may process data outside the European Economic Area (EEA). Where applicable we rely on safeguards such as Standard Contractual Clauses.

11. Security

We implement reasonable safeguards including:

• HTTPS encryption
• Access controls and secure authentication
• Encrypted storage for Gmail refresh tokens used by connected Gmail features
• Infrastructure monitoring

12. Data Retention

We retain personal data only as long as necessary to provide the Service or comply with legal obligations. Gmail connection tokens are retained only while Gmail remains connected. Users may disconnect Gmail, request account and data deletion from the app or by emailing privacy@producerbrain.app, or request export of associated data through support.

How to Manage or Delete Your Data

1. To remove Gmail access, open Producer Brain, go to Settings > Integrations, and select Disconnect Gmail.
2. To request permanent account and data deletion, open Settings > Account and select Request Account Deletion.
3. Your email app opens with a request addressed to privacy@producerbrain.app. Send that email so we can verify account ownership and complete the request.

13. Your Rights (GDPR)

You may request to:

• Access your data
• Correct inaccurate data
• Delete your data
• Restrict or object to processing
• Withdraw consent

To exercise these rights, contact: privacy@producerbrain.app

14. Contact

15. Children's Data

The Service is not intended for individuals under 16.

16. Policy Changes

We may update this Privacy Policy periodically. Updates will be published on our website.

17. Complaints

You may lodge complaints with your local data protection authority.

Referral invitations

If you open a referral link, a secure first-party cookie remembers the first valid invitation for 30 days. At signup, we bind the offer to your account so email confirmation can continue on another device. We retain the invitation, billing evidence and earned months to operate the offer and prevent duplicate rewards. A keyed email digest prevents repeated new-customer claims; a keyed payment-method fingerprint supports misuse review. Your inviter sees aggregate progress, never your email address or payment details. Financial evidence follows our billing retention obligations after account deletion.