Draft – pending legal review. Not in force until Victoriny AB has completed the stated factual checks and adopted a final version.

Privacy Policy

Version 2026-10-25 · Legal

1. Who is responsible

Victoriny AB, corporate identity number 559032-0502, Birger Jarlsgatan 58, 114 29 Stockholm, is the controller for account administration, our customer relationship, billing, security, legal compliance and our own contacts with prospective customers (section 4). Contact: music@zebastianvictorin.com.

We are processor for the content in your workspace that you control: fan contacts, consent records, curator contacts you add, your outreach and the replies to it. The Data Processing Agreement applies to that processing. Where you are yourself a processor (for example a manager working for an artist), we act as your sub-processor. The actual purposes and decisions determine the roles. We do not run a shared curator database: curator contacts in a workspace are added by the customer.

2. What we process

• Account data: email address, name if you give it, and your role in each workspace. Passwords are stored only as a hash by our authentication provider.
• Invitations: the invited email address and role, and who sent the invitation. Invitation links are stored only as a hash.
• Workspace content: artist profile, songs, files, images, videos, texts, contacts and consent records you add.
• Connected channels: the account identifier, the permissions you granted and the access token, which is stored encrypted.
• Replies: the sender, subject and text of replies sent to your workspace's Artistwing reply address.
• Billing data (paid plans): name or company name, address, VAT number if any, whether you buy as a consumer or a business, and payment status. Card details are handled by our payment provider and never reach us.
• Technical data: operational logs with times, IP addresses and error messages, kept to run and secure the service.

3. Why, and on what legal basis

• For an individual who contracts with us, the account and the service: Article 6(1)(b) GDPR.
• Administration of business customers' representatives and invitations, proportionate security, preventing misuse and defending legal claims: our legitimate interest in running a secure service, balanced against your rights, Article 6(1)(f).
• Bookkeeping and other records the law requires: Article 6(1)(c).
• Service messages, such as sign-in links, receipts and important changes, are part of the agreement. Victoriny newsletters are sent only with your consent, which you can withdraw at any time.

We do not use customers' fan data or content for our own marketing or to train AI models. We do not make solely automated decisions that have legal or similarly significant effects on you.

4. Prospective customers we contact

To introduce Artistwing, we keep a list of businesses and their published role addresses (for example a label's demo address), with the source page and the date we found it. The basis is our legitimate interest in business-to-business marketing. We email only legal entities at such addresses, never private individuals without their consent, and every first message says where we found the details. We delete an entry 12 months after it was added or last contacted if there is no reply. You can object at any time at music@zebastianvictorin.com; we then never contact you again and keep only the minimum needed to respect that.

5. Google, YouTube and Gmail

Artistwing uses YouTube API Services; the YouTube Terms of Service apply, and Google's Privacy Policy is at policies.google.com/privacy. We process your channel identifier, the videos you approve for upload and their metadata, and the API data you authorise, to provide the YouTube features you use. We use the gmail.send permission only to send messages you approve from your account. It does not let us read your Gmail inbox; replies to your Artistwing reply address are processed separately for your workspace.

Artistwing's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Such data is not sold, not used for advertising and not used to train AI models. People at Victoriny see it only with your permission for a specific purpose, where needed for security or the law, or as that policy otherwise allows.

You can disconnect in your workspace or revoke access at security.google.com/settings/security/permissions. We then stop using the access and revoke the token. When you disconnect in Artistwing, the YouTube data we received is deleted as soon as possible and within 7 days; after a revocation through Google's settings, within 30 days. You can also ask us to delete it at music@zebastianvictorin.com. Deleting data in Artistwing does not delete anything on YouTube; videos already published stay there until you remove them on YouTube.

6. How long we keep it

• Workspace data: during the contract and a retrieval period of at least 30 days after it ends. We then delete production copies within 30 days. Isolated backups expire within a further 90 days at most and are not used in ordinary operation. Shorter platform deadlines, such as those in section 5, apply first.
• Operational logs: normally no longer than 90 days, except specific security or legal records that need to be kept longer, with restricted access.
• Accounting records: until the end of the seventh year after the calendar year in which the financial year ended. VAT records for the EU one-stop shop are kept for ten years where required.
• Minimal records of consent, opt-outs and legal claims: only as long as needed for those purposes, reviewed every year and never used for marketing.

7. Who receives the data, and transfers outside the EU/EEA

Our supplier register names the company, function, data, processing locations and transfer safeguard for each provider. Processing may include access from outside the EU/EEA even where the main database is in Stockholm. We rely on an adequacy decision only where it covers the recipient and the processing, including an active EU–US Data Privacy Framework certification where relevant. Otherwise we use the European Commission's standard contractual clauses with the necessary assessment and supplementary measures before the transfer. You can ask us for information about, and a copy of, the safeguards.

AI features receive only the inputs needed for the task, and only the approved providers in the register receive them. Fan lists and access tokens are never sent to an AI model. Platforms you connect receive content and instructions under their own terms. Stripe acts as an independent controller for some payment, fraud and regulatory purposes. We do not sell personal data.

8. Storage in your browser

The Artistwing app keeps your sign-in session in your browser's local storage, which is needed for the sign-in you ask for. We use no advertising or analytics cookies and no tracking of email opens or clicks. If that changes, we will tell you and ask for any consent needed first.

9. Your rights

You may request access, correction, erasure and restriction, and where applicable receive your data in a machine-readable format. You may object to processing based on our legitimate interest, and to direct marketing at any time, in which case it stops. You may withdraw a consent at any time without affecting earlier processing. We normally answer within one month. You can complain to the Swedish Authority for Privacy Protection (imy.se) or another supervisory authority. Fields marked as required for an account or for billing are needed for the contract or by law; other fields are optional. For data in a customer's workspace, the customer handles requests and we help.

10. Changes

We update this policy when the processing changes, and tell you about material changes before they apply. The latest version is always on this page.