EPKs Online Privacy Policy
Beta draft, not in effect. EPKs Online is in a private beta test and isn't open to the public. Only invited testers can use it. This draft may change before launch, and the blanks in [brackets] will be filled in then. Effective date: [date]
EPKs Online (epks-online.com) is run by Mass Insanity Productions, LLC ("we", "us"). This explains what we collect and what you can do about it. We don't sell personal information, and we don't use advertising or tracking cookies.
What we collect
- Invite requests: band name, your email address and the link you send us.
- Your account: name, email address and the bands you manage. Your password is stored only as a one-way hash we can't read. If you turn on two-step sign-in (required for admins), we store the key your authenticator app uses, encrypted, and your recovery codes only as one-way hashes.
- Your press kit: what you enter and upload, including music, photos, documents, show dates and contact details, and any stage plot you build.
- Promo videos, if you make one: the song section, photos, logo and words you pick, the videos we make from them, and when they were made. We make them on our own server: your songs and photos aren't sent to any other company to do it. To draw a song's waveform, we keep a small summary of how loud it is over time. We email whoever asked when a video is ready.
- Official account checks, if you choose one: the page link or email address you give us, and the result. We send that address one or more confirmation emails, only when you ask us to.
- Records: sign-ins, failed attempts, approvals, removals, copyright notices and similar events, with their time and IP address.
- Visit counts for bands: we count visits to live press kits, song plays and downloads, per day, so each band can see its totals. We don't use cookies for this and don't keep who visited. So one person isn't counted twice in a day, we keep a scrambled code made from the visitor's IP address and browser, with a key that changes every day, and delete it within two days. Bands never see anything about individual visitors.
- Server logs: like most websites, our server records each request (IP address, time, page, browser) to keep the site running and secure.
- Cookies: only what's needed to keep you signed in and protect forms.
What's public
Your press kit is meant to be seen. Anything on a published press kit, including contact details you enter, can be viewed, copied and downloaded by anyone. An approved band may also appear in our public gallery. Only put on it what you want public. Tell your bandmates and anyone else whose details or picture you include.
A promo video stays private to your band until you choose to show it on your press kit. Once it's there, or once you post it somewhere else, it's as public as the rest of that page or site, and other sites follow their own privacy policies.
Hidden data such as GPS location is removed from photos we process, but don't rely on that for other file types, such as PDFs.
Why we use it
To review invite requests and press kits, run the Service, keep it secure, prevent abuse, handle complaints, send account and service emails, tell you about changes including paid plans, and meet legal duties.
Who can see it
- Visitors: anything you publish.
- Your bandmates: people you give access to your band, including its promo videos and stage plot.
- Us: we can see everything in the Service to review, run and support it.
- Embedded services: a YouTube or Vimeo video on a press kit is served by that company under its own terms, and may set its own cookies. Nothing loads from them until a visitor presses play.
- Site monitoring: our own Server Sanity service (part of Patch Sanity, at patchsanity.com, also run by Mass Insanity Productions, LLC) checks from outside that this site is up and secure. It reads our public pages the way any visitor would and gets no personal information. The "Server Sanity Monitoring" badge at the bottom of our pages links to patchsanity.com. Nothing loads from there until you click it, and that site's own privacy policy applies once you're there.
- Others: only if the law requires it, to answer a valid legal notice (a copyright counter-notice includes the details the law requires), to protect people or the Service, or if the Service or company is sold.
How long we keep it
Account and press kit data stays while your account exists. Of a band's promo videos we keep the newest few and the one shown on its press kit, and delete the rest automatically; the working files used to make a video are deleted once it's made. After you delete something it's removed from the live site, and copies in backups or logs age out over time. We may keep records of agreements, takedowns and abuse as long as needed to show what happened. An invite request that doesn't become an account is deleted after about 12 months.
Your choices
You can edit or delete your press kit content and delete your account yourself. You can download a copy of your information yourself from your Account page ("Download my data"): your account details, what you agreed to, our record of your sign-ins and changes, and each band's details, files, stage plot and promo videos. Bandmates appear in it by name only. To have something corrected or deleted that you can't change yourself, contact support@epks-online.com.
We send show reminders, at most once a month, when a live band you're in has no upcoming shows. Every reminder has a link to stop them, and your Account page has a switch. Some records may be kept as described above.
Children
The Service isn't for anyone under 18, and we don't knowingly collect information from children under 13. If we learn we have, we'll delete it.
Security
Connections are encrypted (HTTPS), passwords are hashed and sign-in attempts are limited. No system is perfectly secure. We'll tell affected people about a breach as the law requires.
Changes
If this policy changes, the date above changes, and we'll point out important changes by email or on the site.
Contact
Mass Insanity Productions, LLC, [mailing address], support@epks-online.com