ReleaseNav

Legal

Privacy Policy

Last updated 15 October 2026

1. Who is responsible

ReleaseNav is the data controller for the personal data described here. We process data to run the Service you signed up for, and we do not sell personal data or use it for advertising.

2. What we collect

  • Account data: email address and a hashed password, handled by our authentication provider.
  • Artist profile: artist name, bio, genres, languages, highlights, social links, your performance rights organization (PRO) and distributor, currency, and (if you enable a public press kit) a public slug and press photos.
  • Release data: titles, dates, ISRC (the unique code identifying your recording), tags, lyrics, backstory, press-release fields, uploaded audio, cover art, and generated video.
  • Promotion data: pitches, submissions, credits and costs, ad campaigns, pre-save numbers, press mentions, radio plays, and content-performance statistics.
  • Connected accounts: the platform you connected, your channel handle, and OAuth tokens (see section 3).
  • Release guide conversations: the questions you ask the release guide and its answers. They are stored with your account so a conversation can continue, included in your data export, and deleted with your account.
  • Contact form messages: your name, email address, topic and message. When you are signed in, the message also includes your account ID and plan, so we can match it to your account.
  • Technical logs: integration events and error logs used to diagnose failures. These may include your user id.

The legal basis is performance of our contract with you (running the Service), our legitimate interest in keeping it secure and reliable, and your consent where you explicitly opt in, for example publishing a public press kit or enabling non-essential cookies.

3. How OAuth tokens are used

When you connect YouTube, Google returns an access token and a refresh token. We store them in our database so scheduled jobs can refresh your video statistics without you being present. The tokens are only readable by our server-side code, they are never sent to your browser and never shared with third parties. We request read-only scope (youtube.readonly), so ReleaseNav cannot upload, edit, or delete anything on your channel. Disconnecting the account in Connected accounts, or deleting your account, deletes the stored tokens and asks Google to revoke ReleaseNav's access. You can also revoke access at any time in your Google account security settings.

Connecting Instagram or Facebook (Meta), or your website in Google Search Console and Google Analytics 4, works the same way: we store read-only access tokens server-side so the app can refresh your numbers on a schedule. Those connections cannot post, edit, or delete anything either. Disconnecting a connection, or deleting your account, deletes its stored tokens and asks Meta or Google to revoke ReleaseNav's access where their systems allow it. You can also revoke access in your Meta or Google account settings at any time.

4. Third-party services we share data with

These providers process data on our behalf, only for the feature described. Some of them are located outside the EU/EEA; transfers rely on the providers' standard contractual clauses.

Supabase (via Lovable Cloud)

Database, authentication, and file storage for your account data.

Data shared: Email address, password hash, artist profile, releases, uploaded audio and images.

Anthropic (Claude)

Generating curator pitches and press-release drafts, and answering your questions in the release guide.

Data shared: Release metadata, backstory, lyrics excerpts and press-release fields you submit, and the questions you ask the release guide with the release details it needs to answer them.

Google Gemini (via Lovable AI)

Generating cover art from your prompts.

Data shared: The prompt text you write and release title/genre context.

fal.ai (Kling video, audio merge, text overlay)

Generating and post-processing promotional video.

Data shared: Selected cover art, prompt text, and a segment of your uploaded audio.

OpenAI (speech-to-text)

Transcribing dictated prompts when you use voice input.

Data shared: The audio you record in the prompt field.

Cyanite (paused - not currently processing data)

Automated genre, mood, and key analysis of a track. This integration is paused: no audio or metadata is sent to Cyanite today. We list it here for transparency and will update this policy before it is switched back on.

Data shared: None at present. If re-enabled: a temporary link to your uploaded audio file.

Firecrawl

Searching the web for press mentions of your releases.

Data shared: Release title and artist name used as the search query.

YouTube Data API (Google)

Reading your channel's videos and public statistics after you connect it.

Data shared: Your channel identity, video ids, view and like counts.

Sveriges Radio open API

Checking radio playlists for plays of your releases.

Data shared: Release and artist title used for matching. No personal data is sent.

Meta (Instagram and Facebook)

Reading insights from an Instagram Business or Creator account and a Facebook Page after you connect them.

Data shared: Your account or Page identity and its reach, views and engagement numbers.

Google Search Console and Google Analytics 4

Reading how your own website performs in Google after you connect it, so search and visitor numbers can be shown in the app.

Data shared: The site you selected, its search queries and pages, and aggregated visitor counts.

Spotify (public pages only)

Reading public playlist details you paste a link to, such as the playlist name and follower count.

Data shared: The playlist link you paste. No personal data and no Spotify login is involved.

Google Analytics 4 (our own website statistics)

Counting visits to releasenav.com and measuring which pages and features are used, so we can improve the product. Only loads if you accept non-essential cookies.

Data shared: Anonymous usage statistics: pages viewed, which feature was used, and your plan name (Free, Pro or Pro+). No name, email address, artist or release titles, generated text, or account identifier is sent.

Lovable Emails

Sending deadline reminders, press-mention alerts, account emails, and replies to messages you send from the contact form.

Data shared: Your email address and the content of the email.

Resend

Sending marketing emails you have opted in to.

Data shared: Your email address and the content of the email.

Paddle (our payment provider and merchant of record)

Checkout, billing, invoices, taxes and payment collection for Pro and Pro+. As merchant of record, Paddle sells the subscription to you and keeps its own records of your payments, which deleting your ReleaseNav account does not erase.

Data shared: Your email address, name and billing details you enter at checkout, your payment method, and the plan you buy.

Paddle's privacy notice

Content you send to AI providers through ReleaseNav is used to produce your output. It is not used by us to train models.

5. Cookies and tracking

ReleaseNav always uses essential storage: a session cookie or local-storage entry that keeps you signed in, and a record of your cookie choice. We do not run advertising trackers and we do not sell data.

If you accept non-essential cookies, we also load Google Analytics 4 on releasenav.com to understand how the site and the app are used. It never loads if you decline or have not answered the consent banner, and you can change your choice at any time.

What Google Analytics 4 measures for us: which pages you view, which pricing and checkout steps you reach, which features you use in the app (for example creating a release, generating cover art, or publishing a press kit), and your plan name (Free, Pro or Pro+).

What is never sent to Google Analytics 4: your name, your email address, your artist or release titles, lyrics, AI-generated text, uploaded files, or any account identifier. Google shortens IP addresses before storing them and may process the data outside the EU/EEA under its own terms.

Google Analytics 4 stores event-level data for 14 months so we can analyse usage trends over a longer period. You can still opt out at any time by declining non-essential cookies in the consent banner or withdrawing consent later. Nothing in the Service stops working if you do.

6. Retention

We keep your data for as long as your account exists. Deleting your account cancels any subscription and then removes your profile, releases, promotion records, uploaded files and connected account tokens immediately and irreversibly. We keep one record that the account was deleted, with its email address, account ID and the date, for 30 days to show that the request was carried out; a daily job then deletes it. Paddle, our payment provider, keeps its own records of your payments, such as invoices and transactions, as the law requires; deleting your ReleaseNav account does not erase them.

7. Your GDPR rights

  • Access and portability: download everything tied to your account as a spreadsheet file (CSV) or a data file (JSON) from Account settings.
  • Rectification: edit your profile, releases, and promotion records directly in the app.
  • Erasure: use "Delete my account" in Account settings, which removes all of the above, except the deletion record and the payment records described under Retention.
  • Restriction and objection: contact us to limit specific processing, such as email notifications, which you can also turn off in Account settings.
  • Withdraw consent: unpublish your press kit, disconnect YouTube, or decline non-essential cookies at any time.
  • Complain: you may lodge a complaint with your national data protection authority.

8. Contact

For privacy questions, or to exercise a right that is not available in the app, use our contact form. See also our Terms of Service.