Privacy Policy

Found Sound is operated by Found Sound Ltd, a company registered in England and Wales (company number 17498722), whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Found Sound Ltd is the controller of the personal data described in this policy, except where it says we act for an artist. We provide a self-serve platform for independent musicians — Smart Links, a Fan Hub, Meta ad campaign tooling, and analytics.

Contact: support@foundsound.io

Account data: when you sign up, we collect your artist name, email address, and account details needed to run the service, including any accounts you choose to connect (Spotify, Meta).

Team data: if you invite someone to an artist's team, or join one, we keep their email address, role and who invited them (see "Artist teams" below).

Correspondence: if you email us directly or book a call, we retain those communications for the purpose of fulfilling our service.

We do not collect payment card data directly — payments are handled entirely by Stripe, whose own privacy policy applies to payment processing.

We use your account data to operate the service you've signed up for — running your Smart Links, Fan Hub, ad campaigns, and analytics, and billing your subscription.

Where you have consented, we will also send you marketing emails about Found Sound's services. You can unsubscribe at any time via the link in any email.

We do not sell your data to third parties.

We use the following third-party services to operate the business. Each acts as a data processor on our behalf:

Resend — email delivery, including confirmation and update emails sent to fans on artists' behalf (see "Fan sign-ups and artist emails" below). Privacy policy: resend.com/privacy

Stripe — payment processing for subscriptions, and payouts to creators in our referral program through Stripe Connect (see "Creator referrals" below). Privacy policy: stripe.com/privacy

Calendly — call booking. Privacy policy: calendly.com/privacy

Vercel — website hosting and deployment, and its AI Gateway, which passes requests from our AI features to Anthropic and deletes them once each request completes. Privacy policy: vercel.com/legal/privacy-policy

Anthropic — the Claude AI models behind the AI Coach and our other AI features (see "The AI Coach and other AI features" below). Anthropic processes what we send only to produce a response and does not use it to train its models. Privacy policy: anthropic.com/legal/privacy

Google — image generation for our invite-only brand content tools, using images and descriptions the brand provides. Privacy policy: policies.google.com/privacy

Google — "Continue with Google" sign-in, if you choose it. Google confirms who you are and gives us your name, email address and Google account ID; we never see your Google password. Google's sign-in button is loaded on our sign-in and sign-up pages. Privacy policy: policies.google.com/privacy

Cloudflare — bot protection (Turnstile) on our sign-in, sign-up and password reset pages. It checks technical signals from your browser to tell people from automated scripts, and doesn't use tracking cookies or advertising. Privacy policy: cloudflare.com/privacypolicy

Supabase — database and file storage, where account data, fan lists and link records are held. Privacy policy: supabase.com/privacy

Sentry (Functional Software, Inc.) — error monitoring, so we find out when something breaks. Reports are stored in Sentry's EU data region (Frankfurt) and contain the technical details of the error (what failed, where in our code, which page) plus, if you are signed in to Found Sound, your account's internal ID. They never include your name, email address, IP address or the content of your account, and we strip email addresses and link parameters before anything is sent. Nothing is sent from fans' browsers on public pages. Privacy policy: sentry.io/privacy

PostHog (PostHog Inc.) — usage analytics: which pages of our website and Studio are visited and which features are used, so we can see what's working (see "Usage analytics" below). Data is stored in PostHog's EU data region. Nothing is sent from fans' browsers or about fans. Privacy policy: posthog.com/privacy

Meta Platforms, Inc. — advertising campaign management for clients who choose to connect a Meta ad account (see "Meta advertising integration" below). Privacy policy: facebook.com/privacy/policy

An artist on Found Sound can have a team: people its admins invite to help run it, such as a manager, label or agency. One login can belong to several artists' teams, and each team member has a role. Admins can do everything, including managing the team. Editors can run campaigns, links, fan email and the Coach. Readers can see but not change anything, and can't download the fan list. Each artist has one account holder, the person who pays for it.

What a team member can see: everything in that artist's Studio, including its fan list (fans' email addresses and approximate locations), its link and ad statistics, the results of ad campaigns on its connected Meta ad account, its goals, releases and AI Coach suggestions awaiting approval. Team members never see other artists' data, and an artist's team can see each other's email addresses and roles.

Invites: when an admin invites someone, we store the invitee's email address, the role, who sent the invite and when, and we email them the invite through Resend. The code in the invite link is stored only as a one-way fingerprint, works once, and expires after 7 days. Accepting needs a signed-in Found Sound account with the same email address. We keep a record of when it was accepted. If you open an invite link before signing in, your browser keeps the invite code in a cookie for up to 24 hours, and if you then create an account, we keep the code with your new account too. That way you come straight back to the invite after signing up, even if you confirm your email on another device. Both are deleted once you accept or decline.

Team activity log: we record what team members do on an artist (for example sending invites, changing roles, launching, pausing or funding ads, approving AI Coach suggestions, emailing or importing fans, downloading the fan list, and connecting or disconnecting platforms), with who did it and when. The artist's admins can see this log. It holds the person's account, not a copy of their email address, and no fan data. We keep each entry for 12 months, then delete it. If someone deletes their account, their entries remain but no longer show who they were.

AI Coach conversations and their memories stay private to the person who had them. Other members of the same team can't read them. Authorised Found Sound staff can, as described in "The AI Coach and other AI features" below.

Top-up requests: a team member who isn't the account holder can ask them for a top-up pack. We record who asked, for which pack and when, and email the account holder the requester's email address and the pack.

An artist's account holder can delete the artist, which permanently deletes it and its data (including its fan list) for its whole team, and ends its subscription at the end of the billing period. Leaving a team or deleting your account removes your access to that artist. If you were the only admin of an artist, deleting your account deletes that artist and its data. If you were its account holder and other admins remain, the artist stays with them and the subscription you were paying for ends at the end of its billing period.

Why we use this data: to give the people an artist chooses access to it, which is part of the service the artist subscribes to (our contract with them), and our legitimate interest in letting artists work with a team securely.

If you choose to connect a Meta (Facebook/Instagram) advertising account to Found Sound, we use Meta's Facebook Login for Business to request access to your Meta Business Page, its linked Instagram account, your own Meta advertising account, and a Meta Pixel — for two purposes only: to build, launch, and optimise ad campaigns on your behalf, at your direction and within budgets you approve; and to show you statistics about your own Page and Instagram account in Studio.

What we read and keep: the IDs and names of the Page, Instagram account, ad account and pixel you choose to share; your campaigns and their results (spend, reach, clicks and Meta's breakdowns by country, age, gender and placement); your recent Instagram posts with their like, comment and view counts, so you can pick one as an ad; and a daily record of your Page's and Instagram account's follower counts (and, for Instagram, how many posts it has), so you can see how they change over time. Other Page and Instagram statistics are fetched when you view them and are not stored.

Your Meta ad account remains yours: Meta bills you directly for any ad spend, and Found Sound never holds, transfers, or has access to your advertising funds.

The access token Meta issues for this connection is encrypted at rest and scoped to the artist it was connected for. Only that artist's team can use it through the product: admins and editors can run campaigns with it, and only admins can connect or disconnect it. No other Found Sound client, and no Found Sound staff member, can access it through the product. We use it only for the two purposes above, and we do not use it, or any data obtained through it, to build advertising or interest profiles for anyone other than you, and we do not sell it or share it with third parties, except that the AI Coach sends some of it to Anthropic to answer your questions, as described in "The AI Coach and other AI features" below.

Data deletion: you can disconnect Meta from Found Sound at any time — from Ads → your connection, click Disconnect — which immediately and permanently deletes the stored access token and all associated Meta account details (Page, Instagram account, ad account, pixel) from our database, and stops any further reads. Your campaign records and the daily statistics already collected stay in your Studio so your history isn't lost; they are deleted when you delete your account, or sooner if you ask us. Disconnecting from within Meta's own Business Settings additionally revokes Found Sound's access on Meta's side. For any other request relating to this data, email support@foundsound.io and we will act on it within 30 days, per "Your rights under UK GDPR" above.

The AI Coach answers questions about your music, your numbers and your next release, and helps you plan it. To answer, it sends Anthropic's Claude model your question, your artist profile (name, genre, location, the tone you post in and your bio), the saved memories described below, and the data of yours it needs to look up: your Smart Link statistics, the results of ad campaigns on your Meta ad account, statistics from the platforms you've connected, your goals, your releases, your content plans (each post's date, format, hook, script, caption and notes) counts from your fan list (how many fans you have, which countries they signed up from, how they joined, and how your emails performed), your Fan Hub page's visits and taps (counted by day, country, device, where visitors came from and which blocks they tapped), and, when you ask from the new-campaign page, the campaign you're building (its budget, dates, targeting, interests and the ad text you've typed). It never sends your fans' names, email addresses or other contact details. We also use Claude to suggest ad audience interests from the artists and genres you type into an ad's "sounds like" field.

Content plans: when you or a team member presses "Write the words" on a content plan, we send Claude your artist profile (name, genre, location, the tone you post in and your bio) and the posts being written (their dates, goals, formats, hooks, filming notes and song), and it writes hooks, scripts, shot lists, captions and hashtags for them. It counts towards your Coach allowance. We keep what was sent and what came back, with a usage record, for the same 12 months as Coach conversations; it is never used for the Coach's memories and doesn't appear as a Coach conversation.

Requests go through Vercel's AI Gateway to Anthropic only. Anthropic uses them only to produce the answer and does not train its models on them. Ad data from your Meta account is sent only to answer you, on your behalf.

What we keep: each question, the data the Coach looked up and its answer, so you can continue a conversation and so we can track usage against your monthly allowance. Once a night, we also use Claude to condense your recent Coach conversations into short memories (plans, preferences and limits you've mentioned), so the Coach doesn't make you repeat yourself. You can see and delete each memory on the Coach page. We also keep any thumbs-up or thumbs-down rating and comment you leave on an answer, and any tasks you approve from a release plan.

The Coach proposes; you decide. It can't pause or change a campaign, spend money, save tasks to your release, add a content plan or create an email to your fans without your approval in Studio. An email it writes only becomes a draft when you approve it, and nothing is sent until you send it yourself. Its answers are suggestions, not decisions about you.

Authorised Found Sound staff can read Coach conversations, ratings and comments, and what was sent and written for your content plans, to fix problems and improve the AI's answers, for example when an answer is rated thumbs-down. We don't use your conversations or content plans to train any AI model.

You can delete a Coach conversation yourself on the Coach page. That deletes its questions and answers, the data the Coach looked up for it, your ratings and comments on it, and any memories taken from it. We keep a usage record of each answer (when it was given, which AI model answered and how much it used) so your monthly allowance stays accurate. Plans and tasks you approved from that conversation stay until you remove them. We keep the text of Coach conversations (questions, answers, the data looked up, and your ratings and comments on them) for 12 months, then delete it automatically; the usage record stays. Memories are kept until you delete them, or until you delete your account. Everything is deleted when you delete your account, and you can also email support@foundsound.io, per "Your rights under UK GDPR" below.

The lawful basis for running the Coach is our contract with you: it's part of the service you subscribe to. Staff review of conversations and ratings rests on our legitimate interest in keeping the Coach accurate and safe.

We measure how our website and Studio are used, so we can see where people find us, where sign-up gets stuck, and which features artists actually use. We do this without cookies or anything else stored on your device. Your browser tells our own server which page you opened; our server passes that on to PostHog, our analytics provider. PostHog's own code never runs in your browser.

If you're not signed in, we record the page, the site that linked you to it, any campaign tags in the link (utm_…), your browser, operating system, device type and screen width, and your approximate location (country, region and city), worked out by our host from your IP address. To count unique visitors, our server combines your IP address and browser details with a secret key and that day's date into a code. The code changes every day, so we can tell that a visit was one person on one day, but we can't recognise you on another day. Your IP address itself is never sent to PostHog.

If you're signed in, the same page information is recorded against your account's internal ID, along with actions you take in Studio, such as creating a link, asking the Coach a question, setting a goal, launching a campaign or starting, changing or cancelling your subscription. We record the action happened and a few fixed details (for example which goal metric, or the reason you picked when cancelling), never what you typed, your email address or name, your fans' details, or the figures from your Meta ad account. We also record which Studio features are switched on for your account and your plan status. When you first open onboarding after signing up, that day's anonymous visits from the same network and browser are linked to your new account, so we can see which pages led to sign-ups.

The lawful basis is our legitimate interest in understanding and improving Found Sound. We don't use this data for advertising, and we don't sell it or combine it with data from other companies. PostHog's records carry only your internal account ID, never your name or email address. You can ask us to delete them, or object to this analytics at any time, by emailing support@foundsound.io.

Found Sound is built and maintained by a small team using AI-assisted software tools. In the ordinary course of development, debugging, and troubleshooting, these tools may access data stored in our systems — including account details and data from connected platforms — where necessary to diagnose or fix an issue.

This access is limited to Found Sound's own authorised personnel using these tools, in the same way a team member might query our database directly to investigate a bug. It is not a feature offered to artists, and no AI tool has standing, automatic, or ongoing access to your account.

This section is for members of the public who tap a Found Sound smart link, usually from an advert or a post on Instagram or Facebook. You do not need a Found Sound account for it to apply to you, and it describes the only circumstances in which we hold data about you.

What the link does: it forwards you to the artist's music on Spotify or YouTube, opening the app directly where we can. That forwarding is the service, and it happens whether or not you agree to anything below.

If you are in the UK, the EEA or Switzerland, we store nothing at all on your device — no cookies of any kind. We record the visit on our own servers and share the following with Meta Platforms so the artist can measure their advertising: the click identifier Meta itself placed in the advert's web address, your IP address, your browser's user-agent string, and your approximate location (country, region, city and postal area) derived from your IP. Location details are hashed before being sent. We also record whether the music app opened successfully.

The lawful basis for that is our legitimate interest, and the artist's, in knowing whether an advert actually worked — assessed against your interests and documented in a legitimate interests assessment, available on request. We do not use it to build a profile of you, we do not track you across other websites, and we do not combine it with anything else about you. You can object at any time by emailing support@foundsound.io, and we will stop.

Everywhere else, we additionally store two advertising cookies (_fbc and _fbp, up to 90 days) so that a returning listener can be recognised, and those identifiers are shared with Meta alongside the above.

Meta acts as an independent controller for the data it receives, under its own privacy policy. We do not sell your data, and we do not use it to build profiles about you for anyone other than the artist whose link you tapped.

Some links ask for your email first. Where an artist has turned that on, you'll see a page with the track and an email field before you reach the music — and a skip link that takes you straight there without giving anything. If you do give your email, you're asked to tick two separate boxes: one to let that artist email you about new music, and one, entirely optional, to allow cookies so their advertising can be measured and improved. Ticking the second is the only circumstance in which we set cookies for listeners in the UK, EEA or Switzerland, and if you tick it we may also share a hashed version of your email address with Meta. The lawful basis for both is your consent, and you can withdraw it at any time by emailing support@foundsound.io.

Your email goes onto the fan list of the artist whose link you tapped, and they are responsible for what they send you. You'll be asked to confirm by email first. We do not sell it, and we do not share it with other artists on Found Sound. See "Fan sign-ups and artist emails" below for the detail.

How long: click records are kept for 25 months. IP addresses are held for at most 7 days, only to complete conversion measurement, and are then deleted automatically. Email addresses are kept until you or the artist asks us to remove them.

To ask what we hold about you or to have it deleted, email support@foundsound.io. Because these records are not tied to your name, please include the approximate date and the link you tapped so we can find them.

This section is for fans who give their email address to an artist through a Found Sound page — a Fan Hub (foundsound.io/h/…) or a smart link's sign-up screen — and for fans an artist has brought over from another service they used to email you from.

Who is responsible: the artist you signed up to is the controller of their fan list — they decide to collect it and what to send you. The people the artist adds to its team on Found Sound (for example its manager) can see the list and send to it on the artist's behalf. Found Sound runs the list and sends the emails for them, as their processor, and only on their behalf. We never add you to anyone else's list, never share your address with other artists on Found Sound, and never sell it.

What we hold: your email address; which boxes you ticked and the exact wording you agreed to; when you signed up, confirmed and (if you do) unsubscribed; how you signed up (Fan Hub or a specific smart link); and your approximate location (country, region and city), worked out from your IP address when you sign up. You don't type it in, and we don't keep the IP address itself. The artist can see this location, so they know roughly where their fans are and can choose to email fans in a particular place. For each email sent to you, we keep whether it was delivered, bounced or reported as spam. We do not track whether you open emails or which links you click in them.

If an artist imported you: an artist who used another service to email their fans (such as Laylo or Mailchimp) can move that list to Found Sound. They confirm that everyone on it opted in to hear from them and has heard from them in the last 12 months, and they remain responsible for that. For an imported fan we hold your email address, the date you originally opted in and your country if the artist's file included them, and a record of the import (when it happened and the statement the artist agreed to). We don't keep anything else from the artist's file. You aren't sent a confirmation email; you start receiving the artist's emails, each with an unsubscribe link. If you'd unsubscribed from that artist on Found Sound before, you aren't added back.

Confirmation: after you sign up we send one email asking you to confirm. Until you do, the artist cannot email you. If you didn't sign up, ignore it and nothing further happens.

Unsubscribing: every email has an unsubscribe link, and most email apps also show an unsubscribe button next to the sender. Either takes effect immediately. We keep your address marked as unsubscribed so you are not emailed again, unless you sign up again yourself. If the artist later deletes you from their list, we keep only a one-way scrambled copy of your address (a hash), not the address itself, so that an import can never add you back. The same applies if emails to you bounced or you reported one as spam. It is deleted with the artist's account.

The lawful basis is your consent — the consent you gave the artist when you signed up, whether on Found Sound or, for an imported list, on the service they used before. Emails are delivered through Resend, our email provider, which processes your address for that purpose only.

How long: your details are kept while the artist keeps their list with us. If you ask, or the artist deletes you or leaves Found Sound, they are deleted. To ask what we hold about you or have it deleted, email support@foundsound.io with the address you signed up with.

If you join our creator referral program, we store your handle, the name you choose to show on your invite page, your code, the date you accepted the program's terms and which version. We count visits to your invite page (foundsound.io/join/…) with the visitor's country and type of device only; we store no IP address and no browser details, and set no cookie. We keep a record of the commission you earn (which payment it came from, the amount, the currency and its status) and of each payout we send you.

Payouts go through Stripe Connect. Stripe collects the identity and bank details it needs to pay you, under its own privacy policy; we never see your bank details. We keep the ID of your Stripe account and whether payouts are switched on.

If you are an artist who signed up through a creator's link or code, we record that on your account (whose referral it was, whether by link or code, and when), so the creator can be paid commission on what you pay us. The creator is never told who you are: they see counts and amounts only. Found Sound staff can see each creator's totals and run checks for misuse, such as self-referral; those results are never shared with the creator.

Why: to run the program you joined (our contract with you), and for referred artists, our legitimate interest in paying the creators who bring us customers. Commission and payout records are financial records and are kept for 7 years, in line with UK financial record-keeping requirements; invite-page visit counts are kept while you're in the program.

Our marketing pages use minimal cookies — session cookies required for normal operation only. We do not use advertising or third-party tracking cookies there, and our usage analytics stores nothing on your device (see "Usage analytics" above). Creator invite links (foundsound.io/join/…) set no cookie either.

Smart links (foundsound.io/r/…) set two Meta advertising cookies (_fbc and _fbp) for listeners outside the UK, EEA and Switzerland. For listeners in those territories we set no cookies whatsoever, which is why you are not shown a cookie banner: there is nothing stored on your device to consent to. See the smart links section above for what we do record, and why.

If you proceed to book a call via Calendly or make a payment via Stripe, those services set their own cookies governed by their respective policies. Our sign-in and sign-up pages load Google's sign-in button, and Google may set its own cookies there under its policy.

As a UK resident (or EU resident under GDPR), you have the following rights:

Right of access — you can request a copy of the personal data we hold about you.

Right to rectification — you can ask us to correct inaccurate data.

Right to erasure — you can ask us to delete your data, subject to any legal obligations we have to retain it.

Right to restrict processing — you can ask us to limit how we use your data.

Right to data portability — you can ask for your data in a machine-readable format.

To exercise any of these rights, email support@foundsound.io. We will respond within 30 days.

Account data is retained for the duration of the service relationship and for 7 years after termination, in line with UK financial record-keeping requirements.

Smart link click records are retained for 25 months, matching the longest advertising attribution window we report on. IP addresses collected from smart link clicks are deleted automatically after 7 days.

Error reports held by Sentry are deleted automatically within 90 days.

Usage analytics held by PostHog are deleted automatically after 12 months.

We may update this privacy policy from time to time. The current version is always available at foundsound.io/privacy. Material changes will be communicated to active clients by email.

Last updated: October 2026.