Privacy policy

1. Who we are

Labelmate is published from Belgium by Tom Nsengiyumva (sole proprietor), enterprise number 1022.549.155 (VAT BE 1022.549.155), Zwartleertouwersstraat 40, 8000 Brugge, Belgium ("we"). For the data described in sections 5 and 6, the license token (section 4) and the counts and logs kept to protect the relay from abuse (section 3), we are the controller within the meaning of the General Data Protection Regulation (GDPR); for onboarding and the Statements Managed service (section 2), the rest of the relay (section 3) and reading by the AI (section 4), we act on behalf of the label. We give the GDPR's protections to everyone, wherever they live: section 12 adds what the laws of other countries provide.

For any question about your data: contact@getlabelmate.com. We are not required to appoint a Data Protection Officer (Article 37 GDPR) and have not appointed one; that address reaches the publisher directly.

Labelmate and this site are for professionals and are not directed at people under sixteen. We do not knowingly collect their data, and we delete it if we learn we hold any.

2. What stays on the label's computers

The emails Labelmate reads, the contracts, invoices and reports it files, the statements it prepares, the artists and the amounts: all of it is stored in an encrypted database, on the label's computers. The text of scanned documents is read on the computer itself. We have no access to it, except what the label chooses to entrust to us for onboarding or Statements Managed (next paragraph).

During onboarding, and for the Statements Managed service if the label orders it, our team works on what the label chooses to send us or show us: its distributors' reports, its contracts, its past statements and the spreadsheet that produced them, its artists' balances. What it emails us arrives in our email (Google Workspace, section 8). We keep these files only for the time of onboarding or of the Statements Managed order, then delete them. We then act on behalf of the label, as the data processing agreement (section 2) sets out.

For this data, the label is the controller; we act only on its behalf, within the limits of the data processing agreement. If you are an artist or a contact of a label and want to exercise your rights, contact the label: we will help it answer you.

The app reads the label's mailbox directly from its email provider, read-only and over an encrypted connection, while the app is running, even with its window closed; nothing goes through our servers. For Gmail and other providers, the label gives a password (for Gmail, an app password). For Outlook and Microsoft 365, it signs in on Microsoft's own page, in its browser: Labelmate never sees the password, and Microsoft gives the app a token that lets it read the mailbox and send the statements the label chooses to send. Microsoft sees this sign-in like any sign-in to its services, and keeps the permission given to Labelmate, which the label can withdraw in its Microsoft account.

These passwords and tokens are kept on the computer, in an encrypted vault whose key is in the system's secure keychain. They are never synced, never put in a backup, and never sent to us.

When the label sends a statement from the app, on its click, the statement leaves from its own mailbox, through its provider's server, and a copy comes back to the label; it does not go through our servers. The link to an artist's page (section 3) is sent by the label itself, from its own mailbox.

Notifications (a key date, a report that arrived, someone waiting for an answer) are prepared by the computer itself and shown by its system: nothing comes from our servers. Backups are encrypted files, kept on the computer, that open only with the label's recovery kit (twenty-four words), which we do not have.

The app does not measure its use and sends no error reports. From version 0.1.2, if it stops on an error, it notes only the time, its version, the system and the place in its code, in a file that stays on the computer; and it checks for updates: a minute after it opens, then every six hours, it asks downloads.getlabelmate.com, served by Cloudflare, whether a new version exists. That request carries nothing of the label, not its workspace, the computer or its license token: Cloudflare sees only what any download shows, the computer's IP address and the name of the update component (section 5). A new version is downloaded, its signature checked, and it is installed only when a person clicks. Automatic checks can be turned off in the app's settings. Earlier versions do not check for updates: on those, a new version is installed by hand. Apart from the label's mail servers and Microsoft's sign-in page, the app contacts only our relay (section 3), Claude if the AI is on (section 4), Adobe Fonts for the titles' font, downloads.getlabelmate.com for updates from version 0.1.2 (section 5), and this site when you send us feedback (section 6).

3. What goes through our servers

Our relay does three things: it keeps in sync the computers of a label that has several, hands out the AI key (section 4) and hosts artist pages. For a label that uses none of the three, it keeps nothing.

To keep a label's computers in sync, Labelmate sends our relay sealed copies of what changes in its database and of the files it holds (contracts, reports, statements as PDFs, and, for each document Labelmate makes a suggestion from, the whole email it came in, attachments included): they are encrypted on the computer before they leave, with keys that never leave the label's computers. We cannot read them. For a new computer to join the label, the two computers exchange two messages through the relay, authenticated with the secret of the twelve words: the new computer's public keys, then the label's key, sealed for it. The relay deletes each one as soon as it is read, and hands none out after thirty minutes.

The artist portal goes through the same relay. When the label publishes an artist's page from the app (the label's name, the artist's statements as PDFs and where their advance stands), the page is sealed on the label's computer under a key that travels only in the link sent to the artist, after the # sign, a part of the link a browser never sends to a server: neither this site nor the relay can read it. Anyone holding the link can open the page; the label can update it or take it down at any time. A question typed on the page is sealed in the browser and read only by the label's app; the relay keeps it until the label's app has fetched and kept it, then deletes it.

To run the relay, we see:

• the technical identifiers of the label's workspace and of each of its computers, their public keys, the role of each (owner, admin, staff or read-only) and the computers removed; never a person's name, which the label keeps sealed in its workspace;
• the size and date of the sealed copies, and which computer sent each one;
• for each artist's page, its identifier, its size and date, and the number and dates of the questions waiting;
• the IP address of requests, including those of the browser that opens an artist's page or asks a question on it; to limit abuse, the relay counts the requests of each IP address and each computer in Cloudflare's counters, which last only a minute.

The relay is hosted by Cloudflare. What it stores (sealed copies, identifiers, public keys, artist pages and questions) is kept in the European Union; its requests are handled on Cloudflare's worldwide network, in the data center nearest the computer or browser sending them, and its logs, which hold IP addresses, may be processed outside the European Economic Area (section 9). Sealed copies, identifiers and public keys are kept while the label uses Labelmate, and deleted no later than one month after it asks us to close its workspace. An artist's page is deleted when the label takes it down, and at the latest with the sealed copies of its workspace; a question, as soon as the label's app has fetched and kept it.

When a computer creates a label's workspace on the relay, it sends the label's license token if it has one; the relay then keeps the token's fingerprint with the workspace (section 4). A workspace created without a token keeps, for its first day only, a digest of the network the request came from (the first three numbers of an IPv4 address, the first three groups of an IPv6 address), never the address itself, to limit mass creation; this digest is erased after a day. For the same reason, the relay counts per hour, under that same network digest, workspaces created, invitation messages left and questions asked from an artist's page; each count is erased once its hour is over. A workspace created without a token that, seven days later, still has only the computer that created it, nothing stored and no computer that received the AI key is deleted, with everything the relay keeps for it.

For the relay, we act on behalf of the label, as the data processing agreement sets out, except for the counts and logs kept to protect the relay from abuse, which are ours (section 7).

4. Reading by the AI, if the label turns it on

When the label turns on reading by the AI for a mailbox (when connecting it, or in the settings), the app sends Claude, Anthropic's AI model, two kinds of text from that mailbox: the text of the documents it keeps from it (a contract, an invoice, a report), to say what they are and propose the values to use; and the text of the emails it keeps from it (the subject and what the sender wrote), to see whether someone is waiting for something from the label. Newsletters, automatic notifications and music submissions are never sent to the AI. Before sending, IBANs, card numbers and social security numbers (France, the United States, Canada, the United Kingdom) are masked. Neither the files themselves nor the mailbox is sent; the text itself may contain names, contact details and amounts.

The app calls Anthropic directly, with Labelmate's access key: the text does not go through our servers. Anthropic processes this text as our sub-processor, to answer us; its commercial terms rule out using this data to train its models. Anthropic deletes these texts and its answers within 30 days of receiving or producing them, unless it must keep them longer to enforce its usage policy (up to two years for a text it flags) or because the law requires it. The answers are kept on the computer, so a text already read is not sent again. Reading is capped each month, and the AI can be turned off at any time in the app's settings, mailbox by mailbox: nothing that arrived only through a mailbox whose AI is off is sent to Claude, even when the AI is on for another mailbox.

Our relay hands that key only to the computers of a label holding a license token that is valid, or expired no more than fourteen days ago. To receive it, the computer first registers with the relay, if it never has, with the identifiers and public keys of section 3, which are kept there as that section says; then, in a request signed with those identifiers, it sends the relay that token, as the label pasted it into the settings, and nothing else: the token states the label's name as it appears on its invoice, its plan, the number of artists the plan covers and its dates. The relay checks its signature and its date, and that it has not been revoked. It does not keep the token: it keeps its fingerprint (a SHA-256 digest), with the identifiers of the workspace and the computer that presented it, to limit how many computers receive the key under one token; each of these rows is deleted ninety days after that computer's last request. When we revoke a token (if it leaked, for example), its fingerprint goes into a list of revoked tokens, with nothing else, and the relay no longer hands out the key under that token. The key is kept in the computer's encrypted vault (section 2).

The relay also keeps this fingerprint with the label's workspace, from when the workspace is created with a token or one of its computers receives the key, for as long as the workspace exists: it lets us find the workspace when the label asks us to close it, and it is deleted with it.

5. The site, applications for access and billing

This site sets no cookies and does not measure your visit. On its pages, only one thing comes from another site: the font of the titles and the logo, served by Adobe Fonts. Your browser then sends your IP address to Adobe, which uses it to deliver the font without storing it, and Adobe sets no cookies. The app loads the same font from Adobe when it opens, on the same terms: nothing it holds goes with it. The application form, when you open it, also loads Cloudflare Turnstile (section 5). Our host, Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, United States), records in its logs the technical data needed to serve and protect the site: IP address, browser, page requested. An artist's page, which this site displays, appears there by its address, without its key, which the browser does not send; like the rest of the site, it sets no cookies, and it does not load Adobe's font.

The site picks the home page's language from your browser's, and the currency of prices from the country Cloudflare infers from your IP address; it keeps neither. The getlabelmate.com/download link sends a Mac to the app's installer, served by Cloudflare from downloads.getlabelmate.com and stored in the European Union; its logs record the same technical data. From version 0.1.2, the app also asks there whether a new version exists and downloads its updates from there (section 2): those requests appear in the same logs, with the computer's IP address.

If you apply for access, we receive what you write in the form: your email, the label's name, your role, the number of artists, your computers, your first name, the label's website, your distributor, your message, your phone number if you give it, and the setup call you book, with your time zone; if you tell us, what you do statements with today, who prepares them, the month the next ones are due, and what brings you. We use it only to reply, to hold that call and to open your access. Each application is stored in our database, hosted by Cloudflare in the European Union, and a copy is emailed to our own inboxes (Gmail and Google Workspace) by Cloudflare, our host, which may process it outside the European Economic Area; if you book a call, Cloudflare also sends you, on our behalf, a confirmation with the invite. We keep your application for at most three years after our last exchange; if your label becomes a customer, for at most three years after its last license ends. Every day, our database deletes the applications that have reached that point. The copies emailed to our inboxes are deleted within the same period.

Nothing obliges you to apply. For us to handle an application, your email, the label's name, your first name, your role, the number of artists and your computers are needed: without them, the form is not sent. Everything else, the call included, is optional: leaving it empty does not stop us from handling your application.

Before we store an application or book a call, we check that the email address is yours: Cloudflare sends it, on our behalf, a six-digit code, with our own words and nothing you typed; the code is in the body of the email, never in its subject. We keep that address with a fingerprint of the code (a salted SHA-256 digest, never the code itself). The code accepts only five tries and is worthless after ten minutes; it is erased as soon as it is used or replaced by another, otherwise within a quarter hour after those ten minutes. A correct code gives a proof, also kept as a fingerprint, valid for one hour and erased when the application is stored, otherwise within a quarter hour after that hour. Your application keeps the date your address was verified. Cloudflare also keeps a record of the email that carried the code (the address and the subject, not the code), which can be consulted for 31 days (section 8).

So that a robot cannot ask for codes one after another, this step is protected by Cloudflare Turnstile, the anti-bot service of Cloudflare, our host. When the form opens, your browser loads Turnstile from challenges.cloudflare.com, which looks at technical signals to tell a person from a robot: according to Cloudflare, your IP address, your browser's TLS fingerprint and User-Agent header, our form's key and the site the request comes from. It gives your browser a token, valid for five minutes and once only, which we have Cloudflare check, with your IP address, before sending the code; we keep neither the token nor the answer. Cloudflare processes these signals on our behalf, and also on its own account, as a controller, to improve its bot detection; it states that their purpose is not to identify, profile or target anyone, only to detect and block bots (its Turnstile privacy addendum, cloudflare.com/turnstile-privacy-policy). This site still sets no cookies: Turnstile runs in a frame served by challenges.cloudflare.com, and we do not use its option that would set a cookie on getlabelmate.com. Cloudflare's cookie policy counts the cookies of its anti-bot checks as strictly necessary.

To protect the site from abuse (mass sending, booking every call, exhausting our emails), we count requests for a code, codes typed, applications, bookings, looks at the call times and feedback sent from the app, by IP address and, for some, by network (the first three numbers of an IPv4 address, the first three groups of an IPv6 address), by email address or, for bookings, by the email address's domain (except public email providers). Over one minute, Cloudflare keeps these counts, and our database keeps them by network too; our database keeps only a digest of the IP address, the network, the email address or its domain, salted with a random value changed every day, never the address itself, and erases each count twenty-four hours after it was made and each day's value at most two days after it was created, in both cases within the next quarter hour.

If your label becomes a customer, we keep what we need to serve and invoice it: the label's name, its billing details, the plan chosen and the dates of its license. Invoices are issued and collected by Stripe, our payment provider, which receives those details and the payment method; we keep invoices for as long as accounting law requires.

After the setup call, and at each renewal, we email the label its license token, at the address of its application for access: Cloudflare sends it on our behalf, like the emails above, with a copy to our inboxes. We keep in this site's database, hosted by Cloudflare in the European Union, a record of each token sent: the address, the label's name, the plan, the billing period, the dates and a fingerprint of the token (a SHA-256 digest), never the token itself; the copy sent to our inboxes carries only the first eight characters of that fingerprint, to tell which token a label holds, unless the email to the label could not go out: it then carries the token itself, so we can pass it on. We keep this record while the label is a customer, then like the invoices, ten years from the end of the year its license ended.

6. When you write to us, and feedback sent from the app

We keep our correspondence while we handle your request, then as long as it is useful for our relationship with your label.

The app asks one question after each statement period you issue: how would you feel if you could no longer use Labelmate? Your answer stays on your computer unless you click to send it to us. It then goes with the period, the words you typed, your label's name as you entered it, and the app's version and language; nothing else, and nothing of the label's data. It is stored in this site's database, hosted by Cloudflare in the European Union, and a copy is emailed to our own inboxes (Gmail and Google Workspace) by Cloudflare, like the copies of applications (section 5). Like any request, it appears in our host's logs with your IP address. We use it to improve Labelmate, and keep it for at most three years: every day, our database deletes the feedback that has reached that point. The copies emailed to our inboxes are deleted within the same period.

7. Legal bases

• Pre-contractual steps and contract (Art. 6(1)(b)): providing Labelmate to the customer label and invoicing it, running the relay, checking its license token; and, when you apply for yourself (as a sole trader), answering your application, holding the call and sending you your token.
• Legitimate interests (Art. 6(1)(f)): answering an application made for the label that employs you, holding the call and sending the label's license token; checking that an application's address is yours (the code by email); protecting the form and our email quota from robots (Cloudflare Turnstile, section 5); the security of the site and the relay and preventing abuse (our host's logs, the counts by IP address, the list of revoked tokens, the limit of computers per token); checking for app updates, from version 0.1.2 (section 2), to keep it secure and working; choosing the pages' language and currency; serving the titles' font from Adobe Fonts; following up our exchanges; improving Labelmate from the feedback sent from the app. We have weighed each of these interests against your rights. You can object at any time (section 11), and turn off update checks in the app's settings (section 2).
• Legal obligation (Art. 6(1)(c)): accounting and keeping invoices and the record of licenses, and requests from authorities.

We make no automated decisions about you, we do not sell or share your data, and we do not use it for targeted advertising.

8. Who receives data

• Cloudflare, Inc.: hosting the relay, artist pages and sealed questions included, what it stores kept in the European Union, its requests handled on Cloudflare's worldwide network.
• Anthropic, PBC: reading the documents and emails kept, with the AI, if the label turns it on, in the United States.
• Adobe Inc.: serving the font of the titles and the logo, on the site and in the app (Adobe Fonts).
• Cloudflare, Inc.: serving this site, the app's installer and its updates (section 2) from its worldwide network; keeping, for a minute, the counts of requests by IP address; checking, with Cloudflare Turnstile, that a request for a code comes from a person (section 5), on our behalf, and improving its bot detection on its own account; storing applications for access, verification codes, the feedback sent from the app and the record of the license tokens sent, in the European Union; and sending the emails described in sections 5 and 6 (the verification code, the copies to our inboxes, the confirmation of a booked call, a customer label's license token), keeping a record of each one sent (sender, recipient, subject, result) that can be consulted for 31 days, and scanning them automatically for malware, phishing and spam.
• Google: our email (Gmail and Google Workspace), for the emails you send us and the copies of applications for access, of the feedback sent from the app and of the license tokens sent.
• Stripe: issuing and collecting customer labels' invoices.
• Authorities, where the law requires it.

9. Transfers outside the European Economic Area

Anthropic processes texts in the United States, Google may process the emails in our inboxes outside the EEA, Cloudflare handles the site's and the relay's requests on its worldwide network and may process their logs outside the EEA, as it may the emails it sends for us (sections 5 and 6), and other providers in section 8 may process data outside the EEA. We then rely on a mechanism the GDPR recognizes: an adequacy decision, including the EU-US Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses. Write to us for a copy of the clauses that apply.

Provider by provider, as its own terms say: for Anthropic, the Standard Contractual Clauses (modules two and three), with the UK and Swiss addenda, in its data processing addendum; for Cloudflare, the EU-US Data Privacy Framework, under which it is certified, and otherwise the Standard Contractual Clauses (modules two and three), adapted for the United Kingdom and Switzerland; for Google, which hosts our email, its data processing addendum, which covers Google Workspace: another recognized transfer solution (such as a data protection framework) where Google has adopted one, otherwise the Standard Contractual Clauses; for Stripe, the Data Privacy Framework, and otherwise the Standard Contractual Clauses (modules one and two) or the UK addendum; for Adobe, the EU-US Data Privacy Framework, its UK extension and the Swiss-US framework, which it states it complies with.

10. Security

Encryption on the computers, sealed copies and pages, requests signed by each computer: the Security page describes what we do, and what we don't have yet. If a data breach puts you at risk, we notify the competent authority and, where the law requires it, the people concerned.

11. Your rights

You can ask us for access to your data, its correction, erasure or portability, or to restrict how we process it, and you can object to processing based on our legitimate interests. Write to contact@getlabelmate.com: we answer within one month, and may ask you to confirm your identity.

You can also complain to the Belgian Data Protection Authority (rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be) or to the authority of the country where you live: in France, the CNIL (www.cnil.fr).

12. Wherever you live

We give the GDPR's protections to everyone, whatever their country: the rights in section 11 are yours wherever you live. Some laws add to them:

• United Kingdom: the UK GDPR gives you the same rights; you can complain to the Information Commissioner's Office (ico.org.uk).
• Switzerland: the Federal Act on Data Protection gives you similar rights; you can complain to the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
• United States: we do not sell or share your personal information, and we do not use it for targeted advertising, as those terms are used in the California Consumer Privacy Act (CCPA) and similar laws in other states. Whatever state you live in, you can ask us to access, correct or delete your data by writing to contact@getlabelmate.com, and you will not be treated differently for asking.
• Canada: you can ask us for access to your personal information and to correct it; you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
• Anywhere else: write to us; we handle every request the same way.

13. Changes

We post any change here and update the date at the top of the page. For a material change, we tell labels in the app or by email.