Privacy policy

1. Controller and contact

Jürgen Oman, Graben 33, 4020 Linz, Austria, is the controller for website administration, user accounts and his own business operations. Privacy enquiries: account@releasr.net.

Where a user manages press contacts, artist information or other people’s content in Release Wingman, that user generally determines the purposes and legal bases of that processing. Release Wingman processes such data on their behalf within the commissioned features. Individuals may contact the relevant sender or artist representative; we help route enquiries. This privacy policy does not replace any required data processing agreement.

2. Website operation and technical data

Requests for this website and its files involve processing an IP address, time, requested address, technical browser and connection details and, where available, the referring page. This is necessary for delivery, troubleshooting and security. Hosting and network providers may maintain technical logs for these purposes.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a secure, functioning service. Article 6(1)(b) GDPR also applies where agreed contractual features are provided.

3. Accounts, security and support

Account data may include your name, username, email address, password hash, verification status, language, preferences, plan and subscription dates. We also process enquiries, correspondence and necessary contract information. The legal bases are Article 6(1)(b) GDPR for contracts and pre-contractual enquiries, and Article 6(1)(c) for legal obligations.

To prevent abusive sign-ins and password reset requests, processing includes IP addresses or account identifiers and attempt counters. Security and administration events and system email delivery status may be logged. The basis is Article 6(1)(f) GDPR; our interest is preventing abuse and tracing security-related actions.

Required information is indicated in forms. Without necessary account or sending details, the relevant features cannot be provided. No solely automated decision with legal or similarly significant effects under Article 22 GDPR takes place.

4. Artist content, media contacts and promo sending

Depending on use, Release Wingman stores biographies, photos and photo credits, music, videos or video links, release dates, press copy, contact details, personal greetings, assignments, pitches and sending history. Media contact data normally comes from the relevant Release Wingman user rather than directly from the individual concerned.

To document users’ statements that submissions are welcome, we store the selected basis, confirmation date, user identifier, confirmation-text version and a hash of the relevant email address for each contact/artist assignment. For unsubscribes, we store the artist identifier, an email-address hash and the date. Random unsubscribe-link tokens are also stored only as hashes in the database. These hashes are pseudonymous, not anonymous data. The unsubscribe block remains in place when a contact is edited or deleted.

The user chooses the recipients, messages and purpose of contact. They must have a lawful basis and provide the information required by Articles 13 or 14 GDPR. A publicly listed address does not automatically constitute consent to promotional emails. Processing on the user’s behalf is governed by their instructions and the required separate agreement under Article 28 GDPR.

EPKs and media accessible through public sharing or download links can be accessed and forwarded by people who know those links. An EPK excluded from search engines is therefore not password-protected. Only publish material that you are entitled to share in this way.

5. EPK views and personalised links

A personalised EPK link uses a token assigned to a contact and release. When accessed, a counter is increased and the most recent access time is stored. The sender can associate these details with the assigned contact. Forwarded links and technical link checks may also generate a view, so a view does not prove that a particular person read the content.

This mechanism does not require an analytics cookie. It does not measure email opens; technically necessary access logs may still be generated by the services involved. The sender is responsible for a lawful basis and transparent information about this personal analysis. Address objections to the sender or account@releasr.net; a right to object may apply under Article 21 GDPR.

6. Email credentials and system emails

For automatic promo sending, you may save the details of your own SMTP account. The SMTP password is encrypted in the database using AES-256-GCM; the key is stored separately in the server configuration. The saved password is not returned to the settings form. The server must decrypt it to send email. It would therefore be inaccurate to claim that technically authorised administrators or infrastructure operators can never access it.

Sign-in passwords are hashed using salted scrypt. These safeguards do not provide an absolute security guarantee. Manual promo sending is available without saved SMTP credentials.

Account messages, including verification, welcome and password reset emails, are sent through Postmark. Recipient addresses, message content and delivery information are processed; reset and verification messages contain time-limited links. Open and link tracking are disabled in Release Wingman for these system emails. Depending on the purpose, the basis is Article 6(1)(b) or (f) GDPR. System emails are separate from promo emails sent through your own account or the enabled Release Wingman sending service.

If you save optional Spotify API credentials, the client ID and encrypted client secret are stored in your account. These details are separate from your email sending credentials.

7. Providers and international processing

Render Services, Inc. (USA) supplies hosting infrastructure. Technical access data and account and content data processed in the application may be involved. Cloudflare, Inc. (USA) supplies network/security services and R2 file storage, involving connection data and uploaded or retrieved files.

Where sending through Release Wingman is enabled and selected, we transmit the sender name, verified reply address, recipient address, message content, images and links to the configured sending service: PostShiba, a service of Backpack Internet Pty. Ltd. (Australia), or, where AWS sending is configured, Amazon Simple Email Service (SES) in Frankfurt (eu-central-1). The selected service supplies technical delivery, bounce, complaint and unsubscribe feedback. To prevent further unwanted messages, we store suppression records keyed by hashed email addresses. A sending ledger containing internal identifiers, timestamps and the sending provider’s message identifier supports status checks and duplicate prevention. This sending method requires no mailbox password.

Postmark, a service of ActiveCampaign, LLC (USA), processes system email recipients, message content and delivery information. Your selected SMTP provider processes your promo emails under the terms applicable to your email account. Recipients receive the content and links you send.

These providers may process data outside the EEA, particularly in the USA and Australia. They publish privacy and data processing terms, including standard contractual clauses for relevant international transfers. Provider information and documents are linked below. Ask account@releasr.net about the subprocessors and transfer safeguards applicable to specific processing. A European server location alone does not rule out international access.

Where required by law or to pursue legal claims, necessary data may be disclosed to competent authorities, courts and professional advisers subject to confidentiality. Where a paid plan is offered through Paddle, Paddle handles payments as Merchant of Record and issues the customer invoice. Opening checkout transmits technical connection data and the information needed for the order, payment and billing to Paddle. Release Wingman processes the link to your account, purchased plan, billing period, amounts and payment or subscription status; full card details are not stored in Release Wingman. The Paddle entity named at checkout also processes data as an independent controller, including for fraud prevention and legal obligations. Our processing is based on Article 6(1)(b) and (c) GDPR. International transfers may occur; see Paddle’s privacy policy (paddle.com/legal/privacy/).

Artist insights may involve server-side queries of public information from sources such as Wikipedia/Wikimedia, MusicBrainz, Google News, DuckDuckGo and radio/playlist archives. Artist names, search terms and technical server request data may be sent to these services. The purpose is to provide the requested artist and media information, based on Article 6(1)(b) GDPR or, for information about other individuals, our legitimate interest in providing this feature under Article 6(1)(f), unless their rights override that interest.

8. Cookies, local preferences and external media

Release Wingman uses session and CSRF cookies for sign-in and security. Sessions are configured for twelve hours. The “releasr-ui-language” cookie stores a selected language for up to one year. Preferences such as appearance, accent colour, tooltips and the active artist may be kept in local browser storage until changed or deleted.

The initial language may be selected using your browser language and a country code supplied by Cloudflare. An explicit language choice takes priority; precise location permission is not requested for this.

Where storage is necessary for an expressly requested feature, access is based on section 165(3) of the Austrian Telecommunications Act 2021; the stated GDPR bases also apply to personal data. You can delete cookies and local storage in your browser, which may remove sessions and preferences.

On the homepage, plans and checkout, the self-hosted Klaro cookie manager asks for your optional consent to Google Analytics 4 through Google Tag Manager. Without consent, these Google services are not loaded and no analytics requests are sent to them. Your choice is stored in the “releasr-consent-v2” cookie for up to 180 days. You can change or withdraw consent for future processing through “Cookie settings” in the footer. Withdrawal deletes analytics cookies set by our integration. Neither Klaro nor this analytics integration is loaded in EPKs; internal workspaces are also excluded from analytics. This choice does not control external media added by users to EPKs.

With consent, page views and related session data are evaluated to improve our service. Google processes pseudonymous cookie identifiers, sanitised page addresses, technical browser/device information and connection data. Our integration does not pass names, email addresses, account content or checkout identifiers to Analytics; URL query parameters and fragments are removed. Google technically receives your IP address for the connection and derives an approximate region; according to Google, GA4 does not log or store EU users’ IP addresses. Google Signals, advertising personalisation and automatic collection of forms and user-provided data are disabled. Meta Pixel is not integrated.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing by Google LLC in the United States and other Google subprocessors is possible. Google’s data processing terms and their transfer safeguards apply, including standard contractual clauses or an applicable adequacy decision. Processing is based on your consent under Article 6(1)(a) GDPR and section 165(3) of the Austrian Telecommunications Act 2021. The _ga analytics cookies are configured for up to 60 days without automatic renewal. Analytics user- and event-level retention is set to two months; aggregated standard reports may remain longer. See the linked Google privacy information and data processing terms below.

Users may add YouTube videos to EPKs. Depending on the display mode, YouTube preview images or embedded players are loaded. Google receives technical connection data; a player may involve additional storage and processing. External links, including Spotify or social networks, lead to services for which the respective providers are responsible. Information about external media does not replace prior consent where it is required.

9. Retention and deletion

Account data and content are processed to provide the account and commissioned features. On termination or a deletion request, affected data is deleted or anonymised unless needed for legal obligations or establishing, exercising or defending legal claims. Cancelling a plan does not automatically delete an account. Deletion requests are currently handled through account@releasr.net.

Retention of technical logs, security and sending records depends on troubleshooting or security needs, necessary evidence and the relevant provider settings. No blanket automatic deletion period is promised where it has not been implemented. Postmark states a default retention of 45 days for message content and activity data; different account settings and longer retention of necessary suppression lists may apply.

Where generated, accounting records must generally be retained for seven years; pending proceedings may require longer retention. Backups may remain until their scheduled overwrite and must be handled accordingly if restored.

10. Your rights

Subject to legal requirements, you have rights of access, rectification, erasure, restriction, portability and objection. You may withdraw consent at any time for the future without affecting earlier lawful processing. For processing based on Article 6(1)(f) GDPR you may object on grounds relating to your particular situation; you may object to direct marketing at any time.

Contact account@releasr.net. We may request proportionate identity verification to prevent unauthorised disclosure. Requests are generally answered within one month; any legally permitted extension will be communicated.

You may complain to the Austrian Data Protection Authority (dsb.gv.at) or another competent supervisory authority, particularly where you live or work.