Privacy Policy

Sunsum Live is operated by Abibirem LLC, a Utah limited liability company (“Sunsum Live”, “we”, “us”). We are responsible for the personal information described in this policy; under European and UK data protection law we are its “controller”.

Postal address: 11681 S 700 E, Suite 150, Draper, UT 84020. Email: privacy@sunsumlive.com.

This policy covers the Sunsum Live website (sunsumlive.com), the pages listeners open by scanning a Sunsum Live QR code, and the Sunsum Live mobile app.

Sunsum Live has two kinds of users, and we collect different information from each:

• Artists create an account in the app to run live sets, take song requests and tips, and receive payouts.
• Listeners use the web pages at a show to request songs and send tips. Listeners do not create an account. A listener can follow an artist with an email address to hear about the artist’s new shows.

From artists

• Account details: your email address, username and password (stored only as a one-way hash), and when you confirmed you are 18 or older. If you sign in with Google or Apple, we receive the name and email address they share with us.
• Profile: your display or stage name, tagline, biography, photo, genres, the kinds of gig you play, instruments, social media links, the city, region or country you choose to show, and, if you choose to show them on your page, a booking phone number and booking link, and whether your page takes booking messages.
• Your content: setlists, songs, events (including venue names, addresses and map coordinates), QR codes and their logos, and images you upload.
• Where you go live: if you go live at your current location, your phone’s precise position and a street address made from it, which become the centre of the set’s request range. Your phone asks your permission first, and only reads your location when you choose this. If you enter an address instead, we keep that address and its map location.
• Payments and payouts: if you are paid through Stripe, Stripe collects and verifies your identity and bank details and tells us whether your account can receive payouts; we do not receive your full bank or identity documents. If you are paid through PayPal or Venmo, we keep the PayPal email address or Venmo mobile number you give us. We keep a record of every payment you receive, every payout, and their fees, refunds and disputes.
• Subscriptions: your plan, its status and renewal date, and which store or processor bills it (the App Store, Stripe or PayPal). We never receive your full card number.
• Device information: a push notification token for your device, its operating system, and the device’s name as your phone reports it.
• Messages you send us, such as support requests.

From listeners

• The name you enter, and any message, dedication or shout-out you add to a request or tip.
• Your song requests, tips and bumps, and their amounts.
• The one-tap notes you send the artist during a set, such as “A bit louder”: which note and when. The note is stored without your name or listener identifier, and the artist sees how many of each were sent, never who sent them. To hold each note to once every 10 minutes, we keep a one-way hash of your listener identifier with the note and your IP address for 7 days.
• A random listener identifier and the name you entered, saved in your browser’s local storage so the page recognises your requests when you return.
• Your precise location, only on sets where the artist has limited requests to the venue. Your browser asks your permission first. We check it when you open the set, store it with any request you send, and delete it after 30 days.
• Your IP address, which we use to limit requests, payments, booking messages, follows and notes to the artist from one network. We keep it for 7 days.
• When you pay, your card or PayPal details go directly to Stripe or PayPal. We receive a payment reference, the amount, the fees and whether it succeeded, refunded or was disputed; we do not receive your card number or your PayPal account details.

From listeners who follow an artist

• Your email address, the artist you follow, and when you asked to follow and confirmed. We email you a link to confirm first, and send nothing else until you do. Then we use your address only to email you, through Resend, when that artist posts a new show. The artist sees how many people follow them, never who.

From people who send an artist a booking message

• Your name, email address, the date of your event if you give one, and your message. We email them to the artist’s account email address through Resend, with your email address as the one to reply to, so the artist can answer you. We do not keep a copy.

From everyone

• Server logs: your IP address, browser or app details and the pages or features you use, which our hosting provider records for security and troubleshooting.
• Error reports: when something goes wrong, details of the error are sent to our error-monitoring provider, Sentry, without your IP address or account details. The app may also record a small share of sessions as replays with all text and images masked, so we can see how an error happened.
• If you search Discover for shows near you, your browser shares your location, rounded to about a kilometre, in the page address. We use it to answer the search. It is not saved with any of your information, but it appears in our server logs like any other page address.

We use personal information only for the purposes below. For users in the European Economic Area and the UK, each purpose is followed by the legal basis we rely on.

• To run the service: accounts, live sets, song requests, queues, tips and notifications (performance of our contract with you).
• To take payments, pay artists, handle refunds and disputes, and keep the records that tax, accounting and anti-money-laundering laws require (contract, and legal obligation).
• To check you are at the venue when an artist has limited requests to it (our and the artist’s legitimate interest in keeping requests to the people at the show).
• To prevent fraud and abuse: limiting free requests and payments per listener and per network, and securing accounts (legitimate interests).
• To send emails the service needs, such as verification, password resets, payout and security notices (contract, and legitimate interests).
• To email a listener who follows an artist when that artist posts a new show (consent, which you withdraw with the unsubscribe link in any of those emails).
• To find and fix errors (legitimate interests).
• To list an artist in Discover, only when the artist turns on “Show me in Discover” (consent, which you can withdraw on your Profile screen, under Your page).
• To comply with the law and respond to lawful requests (legal obligation).

We do not send marketing emails other than the new-show emails a listener asks for by following an artist, show advertising, or sell personal information. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

• An artist’s profile, public events and public setlists can be seen by anyone, unless the artist makes the profile private in Settings → Privacy settings.
• Where an artist goes live: the centre of the set’s request range and its address can be seen by anyone viewing the set while the set is live, so the page can check whether a listener is in range; the address also shows on the artist’s page then.
• A listener’s name, message, dedication and shout-out are shown only to the artist whose set it is.
• A booking phone number and booking link appear on an artist’s page only if the artist adds them. An artist’s email address is never shown: booking messages are forwarded to it, and the artist sees the sender’s email address so they can reply.
• The songs requested in a set, their tip amounts and their place in the queue can be seen by anyone viewing that set, without the listeners’ names.
• An artist sees how many listeners follow them, never their email addresses.

We share personal information only with the service providers that help us run Sunsum Live, each for the purpose listed, and only as much as that purpose needs:

• Stripe: card payments, payouts to artists’ bank accounts, and artists’ identity verification. Stripe uses identity and bank details under its own privacy policy. When a listener tips by card, the name and message they give go to Stripe with the payment, and Stripe keeps them with its record of that payment under its own retention.
• PayPal (including Venmo): PayPal payments, and payouts to the PayPal email address or Venmo mobile number an artist gives us.
• Apple and Google: App Store and Google Play purchases, Sign in with Apple and Google sign-in, and, through your phone’s own map service (Apple’s on iPhone, Google’s on Android), turning your location into a street address, or an address you enter into a map location, when you go live.
• RevenueCat: the status of subscriptions bought through the App Store.
• Cloudinary: storing and serving profile photos, QR logos and other images.
• Resend: sending our emails, including booking messages to artists and new-show emails to listeners who follow an artist.
• Expo: delivering push notifications to the app.
• Sentry: error reports and masked session replays, as described above.
• OpenStreetMap Foundation (Nominatim): looking up the map location of a venue address an artist enters, sent from the artist’s device.
• Spotify and YouTube: importing a playlist into a setlist, only when an artist chooses to. For Spotify, the artist signs in to Spotify and we use that access once to read the playlist; we do not store it.
• Railway: hosting our servers and database.

We may also disclose information when the law requires it, to protect the rights, safety or property of our users, the public or Sunsum Live, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to the information transferred.

• Artist accounts: while the account is open. When you delete your account, it is closed at once and can be restored for 30 days. After 30 days we remove your personal details: your email address, username, password, name, tagline, biography, photo, social links, booking phone and link, and location, your sign-in connections and push tokens, and the email addresses of the listeners who follow you. After 90 days we delete your notifications and usage records. Your setlists, songs and events are kept, no longer linked to your name, so the request history of the sets listeners took part in stays intact.
• Payment and payout records: for at least 7 years, as tax, accounting and anti-money-laundering laws require. They stay in our records after an account is deleted, without the personal details we remove.
• Records of account deletion requests: 7 years, then deleted.
• A listener’s precise location: 30 days from the request.
• Where an artist went live: until the set ends, when we clear the location and its address from the set. The address stays in your own set history, for your recap, which only you see, until we remove your personal details after you delete your account.
• IP addresses used to limit requests and payments: 7 days.
• Push notification tokens: removed when you sign out, or after 90 days without use.
• Listener names and messages: 12 months from the request or payment that carried them. After that we remove them, and the songs and amounts stay in the artist’s history without them. The artist’s notifications from then, which name listeners, are deleted. The copy that goes to Stripe with a card tip is kept by Stripe under its own retention (see “Who We Share Information With”). You can ask us to delete yours sooner.
• Booking messages: we do not keep them. Resend keeps the email it delivered under its own retention.
• One-tap notes to the artist: 30 days from when they were sent.
• A follower’s email address: until they unsubscribe, which deletes it at once. A follow nobody confirms is deleted 7 days after its last confirmation email.
• Error reports: for a limited period under Sentry’s retention settings.

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy, in a portable format;
• correct information that is wrong;
• delete your information, except what the law requires us to keep;
• stop or limit using it, or object to our using it on the basis of legitimate interests; and
• withdraw a consent you gave, such as being listed in Discover.

Artists can do most of this in the app: edit your profile, export your data (Settings → Export my data), make your profile private (Settings → Privacy settings), leave Discover (Profile → Your page → Show me in Discover), and delete your account (Settings → Delete account).

Listeners have no account, so email privacy@sunsumlive.com with the name you used, the artist, and the date of the show, so we can find your requests. We may ask for more information to confirm a request is yours. To stop following an artist, use the unsubscribe link in any email about their shows: that deletes your address for that artist.

We respond within one month, or sooner where the law requires. If we decline a request, we will tell you why, and you can ask us to reconsider by replying. We will not treat you differently for exercising these rights.

If you are in the European Economic Area or the UK, you can also complain to your local data protection authority.

California and other US states

In the last 12 months we have collected the categories of information described in “Information We Collect”: identifiers (such as name, email, IP address and device tokens), commercial information (payments, payouts and subscriptions), internet activity (usage and logs), geolocation (a listener’s precise location for venue checks, an artist’s precise location when going live at their current location, and the area an artist chooses to show), and photos. We collected them from you, your device and the providers listed above, for the purposes in “How We Use Information”, and disclosed them only to the providers listed in “Who We Share Information With”.

We do not sell or share personal information for cross-context behavioural advertising, and have not done so. We use sensitive personal information (account login details and precise geolocation) only to provide the service you ask for.

Do Not Track and Global Privacy Control

We do not track you across other websites, and we do not let others do so on ours. Because there is no such tracking to turn off, browser Do Not Track and Global Privacy Control signals do not change how Sunsum Live works.

Listener pages set no cookies. They save a random listener identifier, the name you entered, and which artists you asked to follow from that browser, in its local storage. When an artist signs in to the app, our server also sets one cookie that keeps the session signed in. We use no advertising or analytics cookies.

Sunsum Live is based in the United States, and we and our providers process personal information in the United States and other countries. When we transfer personal information from the European Economic Area or the UK, we rely on the European Commission’s Standard Contractual Clauses (and the UK’s addendum to them) or on a provider’s certification under the EU–US Data Privacy Framework.

We encrypt information in transit, store passwords only as one-way hashes, keep the app’s sign-in tokens in your device’s secure storage, and limit who can access personal information. Card details are entered directly into Stripe’s or PayPal’s forms and never reach our servers.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.

Sunsum Live is not for children under 13, and we do not knowingly collect their personal information. Artist accounts are for people 18 or older. If you believe a child under 13 has given us personal information, email privacy@sunsumlive.com and we will delete it.

When we change this policy, we post the new version here with a new effective date. If a change is material, we tell artists by email or in the app before it takes effect.

Questions or requests about your personal information: privacy@sunsumlive.com, or write to Abibirem LLC, 11681 S 700 E, Suite 150, Draper, UT 84020.