Privacy Policy

1. Introduction

Welcome to Big Effect, an interactive analytics platform that provides artists, managers, and labels with data-driven insights into the music industry. Big Effect, including any current or future affiliates and subsidiaries (collectively, "Big Effect," "we," "us," or "our"), is committed to protecting the privacy and security of your personal information.

This Privacy Policy explains what information we collect, why we collect it, how we use it, and your rights with respect to it. It applies to our website at bigeffect.co (the "Site") and all related products, services, and communications (collectively, the "Services"). By using the Services, you acknowledge that you have read, understood, and accept this Privacy Policy and our Terms of Service.

References to "you" or "your" mean any individual who uses the Services or whose personal information we otherwise process. This Policy does not apply to third-party websites or services that you may access through links on the Site — we encourage you to review the privacy policies of those third parties before submitting personal information.

2. Information We Collect

We collect information from multiple sources, including directly from you, automatically through your use of the Services, and from third-party data partners you authorize.

Information You Provide Directly

When you register for, access, or interact with the Services, you may provide:

• Name, email address, professional role (artist, manager, label, distributor, etc.)
• Account credentials (username, password) and profile details
• Payment and billing information — processed securely by our third-party payment processor and not stored on our servers
• Music catalog data, artist profiles, release metadata, and other creative assets you choose to connect or upload
• Communications, support requests, survey responses, or feedback you submit to us

Information Collected Automatically

When you use the Services, we automatically collect certain technical and usage data:

• Log data: IP address, browser type and version, operating system, referring URLs, pages visited, and timestamps
• Device identifiers and hardware characteristics
• Interaction data: features used, searches performed, reports generated, and session duration
• Crash reports and performance metrics to monitor service reliability
• Cookies and similar tracking technologies (see Section 7 for details)

Information from Third-Party Sources

With your authorization, we may receive information from third-party platforms and data providers you connect to the Services, including:

• Streaming platforms (Spotify, Apple Music, etc.) — listener counts, stream data, playlist placements, and chart performance
• Social media platforms — follower counts, engagement metrics, and audience demographics
• Digital music distributors and PROs — release metadata, royalty data, and catalog information
• Music industry data partners — chart data, market intelligence, and trend analysis

We access only the data you explicitly authorize through each platform's secure OAuth or API connection. You may revoke these authorizations at any time through your account settings or directly with the third-party platform.

3. How We Use Your Information

We use the information we collect to:

• Deliver the Services: Operate, maintain, and improve the Big Effect platform, including generating analytics reports, market insights, and performance dashboards
• Account management: Authenticate your identity, manage your account, and enable team collaboration features
• Personalization: Tailor content, recommendations, and insights to your specific catalog, genre, and career stage
• Communications: Send service notifications, product updates, security alerts, and — with your consent — marketing communications
• Support: Respond to your requests, troubleshoot issues, and provide customer assistance
• Billing: Process subscriptions, validate payments, and prevent fraud
• Analytics & research: Understand how users interact with the platform to identify improvements, fix bugs, and develop new features
• Legal & compliance: Enforce our Terms of Service, comply with applicable laws, and respond to lawful requests from authorities
• Business operations: Support due diligence and operational continuity in the event of a merger, acquisition, or restructuring

We do not sell your personal information to third parties for their own advertising or marketing purposes.

4. Sharing Your Information

We may disclose your information to third parties only in the circumstances described below:

• Service providers: Vetted vendors and contractors who provide infrastructure, cloud hosting, payment processing, analytics, email delivery, and customer support — all bound by data processing agreements that prohibit secondary use of your data
• Business transfers: In connection with a merger, acquisition, financing, or sale of all or part of our business, your information may be transferred as part of the transaction. We will notify you via email or a prominent notice on the Site before any such transfer takes effect
• Legal requirements: When required to comply with applicable laws, regulations, court orders, or valid legal process, or when necessary to protect the rights, property, or safety of Big Effect, our users, or the public
• With your consent: For any purpose you explicitly authorize beyond those described in this Policy

We require all third parties who receive your personal data to maintain appropriate technical and organizational security measures and to use your data only for the specific purposes we authorize.

5. Data Retention & Security

We retain personal information for as long as necessary to provide the Services, fulfill the purposes described in this Policy, and comply with legal, regulatory, or contractual obligations. When data is no longer required, we securely delete or irreversibly anonymize it.

We implement industry-standard technical and organizational safeguards to protect your data, including:

• Encryption of data in transit (TLS) and at rest (AES-256)
• Role-based access controls with principle of least privilege
• Regular security assessments and penetration testing
• Audit logging and anomaly detection
• Secure infrastructure hosted on SOC 2-compliant cloud providers

No method of transmission over the internet is entirely secure. While we work hard to protect your data, we cannot guarantee absolute security. If you become aware of any security concern related to your account, please contact us immediately at support@bigeffect.co.

If you delete your account, we will remove your personal information within 30 days unless retention is required by law (e.g., for tax records or fraud prevention). Anonymized, aggregated data derived from your usage may be retained indefinitely.

6. Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that inaccurate or incomplete data be updated
• Deletion: Request that your personal data be erased ("right to be forgotten")
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Request that we limit certain processing activities while a dispute is resolved
• Objection: Object to processing based on legitimate interests, including direct marketing
• Opt-out: Unsubscribe from marketing emails at any time using the link in any email or by contacting us

To exercise any of these rights, email us at support@bigeffect.co. We will respond within 30 days or within the timeframe required by applicable law.

California residents (CCPA/CPRA): You have the right to know what personal information is collected, disclosed, or sold; the right to opt out of the sale or sharing of personal information; and the right to non-discrimination for exercising your privacy rights.

EU/EEA and UK residents (GDPR/UK GDPR): You have the right to lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or the relevant national DPA in the EU) if you believe we have not handled your data in accordance with applicable law.

7. Cookies & Tracking

We use cookies and similar technologies — including pixels, local storage, and session tokens — to recognize returning users, enable platform features, and analyze how the Services are used.

Types of Cookies We Use

• Essential: Required for core functionality such as authentication, session management, and CSRF protection. These cannot be disabled without breaking the Services.
• Performance: Aggregated, anonymized data about how users navigate the platform, used to identify bugs and improvement opportunities.
• Functional: Store your preferences such as theme (light/dark), sidebar layout, and language to personalize your experience.
• Analytics: We use PostHog and Google Analytics to understand platform usage patterns. You can opt out of Google Analytics via the browser add-on. PostHog analytics can be disabled via your cookie preferences.
• Advertising: We use the Meta Pixel to measure the effectiveness of our advertising campaigns. This may result in targeted advertisements being shown to you on Meta platforms.

You can manage and delete cookies through your browser settings. Disabling non-essential cookies may affect certain platform features. For more information on cookies, visit allaboutcookies.org.

8. Third-Party Services

Big Effect integrates with third-party platforms and services. When you connect an external account, you grant us access to the data you authorize via that platform's API or OAuth flow. We do not access more data than you explicitly approve, and you can revoke access at any time.

Our Site may contain links to third-party websites. We are not responsible for the content or privacy practices of those sites and recommend reviewing their policies before providing any personal information.

We use third-party services including but not limited to: Supabase (database and auth), Vercel (hosting), Stripe (billing), PostHog (analytics), Google Analytics (analytics), and Meta (advertising). Each of these providers has their own privacy policy governing their data practices.

9. Children's Privacy

The Services are not directed to individuals under the age of 13, or under 16 in jurisdictions where a higher age threshold applies. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child under the applicable age threshold, please contact us immediately at support@bigeffect.co and we will promptly delete that information.

10. International Data Transfers

Big Effect is operated from the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States and potentially other countries where our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction.

For transfers of personal data from the EU/EEA or United Kingdom to the United States, we rely on appropriate transfer mechanisms including Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms as applicable.

11. Policy Changes

We may update this Privacy Policy from time to time to reflect changes in our data practices, the Services, or applicable law. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Post the revised Policy on this page with reasonable notice before it takes effect
• For significant changes, send an email notification to the address associated with your account

Your continued use of the Services after any changes to this Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you should discontinue use of the Services and close your account.

12. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or our data practices, please reach out:

Big Effect
Email: support@bigeffect.co
Website: bigeffect.co/contact

We aim to respond to all privacy-related inquiries within 5 business days and to resolve any data subject requests within the timeframe required by applicable law.