Privacy Policy

Last updated: 2 August 2026
Effective date: 11 July 2026

1. Who we are

Backline is a business-to-business (B2B) analytics platform for the music industry. It aggregates data from third-party sources on behalf of music managers and labels ("Clients") and surfaces insights, suggestions, and AI-assisted analytics for the artists and projects they manage.

This policy is issued by Backline Limited ("Backline", "we", "us", "our"), a company registered in England and Wales (company number 16268720) with registered office at 5-11 Millbay Road, Plymouth, PL1 3LF.

We are a UK-based business serving Clients worldwide. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and our lead supervisory authority is the UK Information Commissioner's Office (ICO). Where a Client or data subject is located elsewhere, additional local data-protection laws may also apply to that Client's data.

For questions about this policy or how we handle personal data, contact us at ds@backlineagency.co.uk.

2. Our role: controller vs. processor

Data-protection law distinguishes between a controller (who decides why and how personal data is processed) and a processor (who processes it on a controller's behalf). Backline acts in both roles depending on the data:

• As a controller: for the personal data of the people who hold Backline accounts (managers, label staff, and our own administrators). We decide how account, authentication, and platform-usage data are handled.
• As a processor: for the analytics and audience data we ingest from third-party platforms on a Client's behalf (for example streaming, social, advertising, and website analytics tied to a Client's artists). The Client is the controller of that data; we process it under our agreement with them and only on their instructions.

Where we act as a processor, the Client's own privacy notice governs the underlying data subjects (e.g. their fans and audiences), and this policy describes the safeguards we apply as their processor.

3. Information we collect

3.1 Account and identity data (controller)

When an administrator invites a user, and as that user uses the platform, we process:

• Name and email address
• Authentication credentials and session tokens (managed by our authentication provider, Supabase Auth)
• Profile settings and preferences
• The Clients (artists/projects) a user is authorised to access
• Notes, suggestions, comments, @mentions, reactions, and notifications the user creates in the platform

Backline is invite-only. There is no public self-service sign-up; accounts are created only when an administrator invites a user by email.

3.2 Client and project data (processor)

For each managed Client we hold configuration and reference data, including artist/project records, linked platform identifiers, and the credentials or access grants needed to retrieve that Client's analytics.

3.3 Analytics data ingested from third parties (processor)

On a Client's behalf we retrieve and store analytics from the integrations the Client has connected:

• Streaming, catalogue and audience data (via Songstats): track and catalogue statistics, playlist and chart placements, radio airplay, and audience geography such as listener counts by city and country. This is aggregated audience data, not data about identifiable individual listeners.
• Social data (via Meta / Facebook & Instagram): Page and account follower counts, post engagement, and recent post metrics for accounts the Client has connected.
• TikTok account and post data (via TikTok Login Kit / Display API, where a Client connects their own account): the connected account's own follower, like, and video counts, its profile identity, and metrics for the account's own posts (views, likes, comments, shares). This is the connected account holder's own profile and content statistics, granted through TikTok's authorisation screen, not data about identifiable TikTok users, and distinct from the aggregated audience figures we receive via Songstats above.
• Advertising data (via Meta Ads and Google Ads): campaign-level performance metrics for ad accounts to which the Client has granted Backline read-only access.
• Search performance data (via Google Search Console): aggregated Google Search statistics for the Client's own website (search queries, clicks, impressions, click-through rate, average position, and top pages) for a property the Client's authorised user connects. See Section 6a for how we handle Google user data. This is aggregated search-performance data, not data about identifiable searchers.
• Website/product analytics (via Amplitude, and via Google Analytics where a Client connects it): event and usage metrics from the Client's own Amplitude project, and aggregated traffic, engagement, and audience statistics for the Client's own website from a Google Analytics 4 property the Client's authorised user connects. See Section 6a for how we handle Google user data. This is aggregated site analytics, not data about identifiable visitors.
• Newsletter / CRM performance (via Mailchimp and, where available, Laylo): aggregate campaign metrics (sends, opens, clicks, open/click rates) and total subscriber counts. We store aggregate figures and counts only, never an individual subscriber record, email address, or other fan personal data.
• Live ticketing / box-office data (via Dice, where a Client connects their Dice account): aggregate ticket-sales figures for the Client's own shows: tickets sold, gross revenue, ticket allocation/capacity, and event details such as venue, date, and on-sale status. We store aggregate sales totals only, never a ticket buyer's name, email, date of birth, contact or payment details, location, or any other fan personal data, even though Dice's partner API would expose those fields.
• Press and media coverage (via public news feeds): publicly published articles that mention a Client's artist by name (headline, source publication, publish date, link, and short snippet). This is public editorial content, not personal data about fans.
• Commerce data (via Shopify, where connected): order and store metrics.

3.4 Landing-page and fan-interaction data

Backline hosts "landing pages": public pages that route fans to streaming platforms. When a fan clicks through a landing page, we record non-identifying interaction data only:

• Destination platform selected
• Country (derived from network-edge headers)
• Device type and operating system (derived from the browser's User-Agent)
• Timestamp

We do not store fan personal data or personally identifiable information (PII) in landing-page records. We do not store fan IP addresses, names, or email addresses in these records. (If a Client later enables optional email capture for their own CRM, any such emails are passed directly to the Client's chosen CRM and are not stored by Backline. This feature is off unless a Client explicitly enables it.)

Where a Client has connected their own analytics project (Amplitude), a landing page also runs that Client's analytics instrumentation in the fan's browser and streams on-page activity (page views, clicks, session and referral/campaign attribution, and a session recording of on-page interactions) directly into the Client's own Amplitude project. Backline acts as a processor for this data on the Client's instructions; the Client is the controller. The landing pages contain no fields that ask a fan for their name, email, or other personal details, and the recording masks any text a fan types.

For visitors in the EU, EEA, and the UK, this browser-side analytics and recording (together with any Client-configured Meta Pixel or Google Tag) is off by default and runs only after the visitor accepts it via the cookie-consent notice shown on the page; a visitor can decline, in which case none of it runs. The basic, cookieless, non-identifying click record described above (destination, country, device, timestamp) operates as essential measurement regardless of that choice.

3.5 AI chat content

Backline offers an AI assistant ("Ask Backline AI"). When a user interacts with it, we process the messages exchanged and the Client analytics context needed to answer, and we store the conversation history so users can return to it. AI responses are generated using the Anthropic Claude API.

3.6 Technical and usage data

Like most web platforms, we automatically process technical data required to operate and secure the service: for example log data, approximate location derived from network headers, and strictly necessary cookies/session storage used to keep users signed in.

Cookies. Inside the signed-in application we use only strictly necessary cookies and local/session storage, to keep you authenticated, remember your selected project, and store your theme preference. We do not use advertising or cross-site tracking cookies in the application. Non-essential analytics and any Client-configured marketing tags run only on public landing pages, and for EU/EEA/UK visitors only after consent, as described in Section 3.4. Where enabled, browser push notifications rely on a subscription you can revoke in your browser at any time.

3.7 Live shows and ticket-sales data

Managers may record a Client's live shows (venue, date, city, capacity, status) and upload box-office ticket-sales spreadsheets to track pacing and sell-through. These uploads are validated against a fixed template, and a file is rejected outright if it contains a column that looks like buyer personal data (for example a name, email, phone number, address, or date of birth), Backline never stores fan or ticket-buyer personal data, on the same principle described for landing pages in Section 3.4.

3.8 AI project context, uploaded documents, and generated reports

Client teams and Backline admins can add free-text context (notes, briefs, facts) about a Client and upload supporting documents, so that Ask Backline AI's answers are more relevant to that Client's business. We also generate, and let Users save, AI-generated reports built from a Client's own data. This content is:

• Stored in a private, access-controlled database and file storage location, never publicly accessible.
• Restricted to the Client's authorised Users and to Backline staff providing support or curating the assistant's knowledge base.
• Included, together with any relevant uploaded-document text, in the prompts sent to the Anthropic Claude API described in Section 7, subject to the same no-training, limited-retention treatment as the rest of our AI processing.

Where a Client enables it, documents and context can also be submitted by forwarding an email (with or without attachments) to a per-project intake address; only messages from a Client's own team members or from sender domains an administrator has approved are accepted, and attachments are handled the same way as a manual upload. Inbound email is processed through our email provider (Mailgun) and is off unless a Client explicitly enables and configures it.

Managers can review, edit, and delete their project's context items and uploaded documents at any time. A Backline admin may separately choose to lift a piece of project context into Backline's own overall knowledge base, which informs the assistant for all Clients; items can be flagged as excluded from that process, and we additionally screen candidates for anything that looks specific to a Client (a name, contact email/phone, or figure) before it is promoted.

3.9 Account-security activity

Because the platform requires two-factor authentication on every account, we log account-security events (sign-ins, password changes, and 2FA enrolment or reset) together with the approximate IP address and browser/device (user-agent) associated with the event. These logs are visible only to Backline admins and are used solely for account security, fraud prevention, and audit purposes.

4. Integration credentials and access grants

To retrieve a Client's analytics we hold, per Client, the credentials or access grants for the platforms they connect:

• API keys / secret keys (e.g. Amplitude, Songstats, Shopify, Mailchimp/Laylo, Dice), stored server-side.
• OAuth tokens (e.g. Meta/Facebook, Google Search Console, Google Analytics, and TikTok), stored server-side. For Google Search Console and Google Analytics, the Client's own authorised user grants access to their own Google account through Google's OAuth consent screen (either during setup, from project settings, or via a single-use link an administrator sends them), and Backline requests only read-only access (see Section 6a). For TikTok, the Client's own authorised user connects their own TikTok account through TikTok's authorisation screen, and Backline requests only read scopes for the account's own profile, statistics, and video list.
• Read-only access grants for advertising accounts (Meta Business Manager partner access, Google Ads account links). For advertising, Backline never collects Client logins or passwords; access is granted by the Client to Backline's own business accounts.

Credential secrets and OAuth tokens are handled server-side only and are never returned to the browser; where the platform displays credential status, secret values are masked. We never expose or log raw API keys, secret keys, or tokens.

5. How we use information and our legal bases

We use the information above to:

Where we act as a processor for Client analytics data, the Client is responsible for establishing the legal basis for that underlying processing.

6. Third-party services and sub-processors

We rely on the following categories of service providers, who process personal data on our behalf or as independent controllers for their own services. Data is shared with them only to the extent needed to deliver the platform.

We do not sell personal data. We do not use Client analytics data, Google user data, or fan-interaction data to build advertising profiles.

6a. Google user data (Google Search Console & Google Analytics) and Limited Use

Where a Client connects a Google integration, an authorised user grants Backline read-only access to their Google account through Google's OAuth consent screen. Backline requests only the minimum read-only scope each integration needs:

• Google Search Console: the https://www.googleapis.com/auth/webmasters.readonly scope, which lets us read: (a) the list of verified Search Console properties on the connecting account, so the user can pick the site to connect; and (b) Search Analytics for the selected property (aggregated search queries, clicks, impressions, click-through rate, average position, and top pages) for that website.
• Google Analytics: the https://www.googleapis.com/auth/analytics.readonly scope, which lets us read: (a) the list of Google Analytics 4 properties on the connecting account, so the user can pick the property to connect; and (b) aggregated website analytics for the selected property (traffic, engagement, and audience metrics) for the Client's own website. This is aggregated site analytics; we do not read or store data identifying individual visitors.

How we use this data. Google Search Console and Google Analytics data is used only to display the connecting Client's own website performance metrics back to that Client inside the platform, and, at the Client's request, to power AI-assisted insights about that performance. It is accessible only to the Client's authorised Users and to Backline staff providing support or acting on the Client's instructions.

Limited Use. Backline's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We do not use Google user data for serving advertisements, and we do not sell it.
• We do not use Google user data to train, fine-tune, or otherwise develop generalised or foundation AI/ML models. Where such data is included in a prompt to our AI provider to answer a Client's question (Section 7), it is processed under commercial terms that prohibit its use to train the provider's models.
• We do not transfer Google user data to others except as necessary to provide or improve the user-facing feature, to comply with applicable law, or as part of a merger/acquisition, and only with appropriate safeguards.
• We do not allow humans to read Google user data unless (i) the user gives consent to view specific data, (ii) it is necessary for security purposes (such as investigating abuse), (iii) it is necessary to comply with applicable law, or (iv) the data is aggregated and used for internal operations in line with applicable privacy and other laws.

A Client can disconnect Google Search Console or Google Analytics at any time from the platform; on disconnection we stop syncing and delete or de-identify the associated tokens and stored data for that integration in line with Section 9. Revoking Backline's access directly from the Google Account permissions page has the same effect.

7. AI processing

AI-assisted features send the relevant conversation, the Client analytics context required to answer, and any project context or uploaded-document text a Client team or Backline admin has added (Section 3.8) to the Anthropic Claude API. This is processed under Anthropic's commercial API terms as our subprocessor: it is not used to train Anthropic's models, and is retained only for as long as needed to provide the service. Where the context required to answer includes Google user data (Section 6a), that data is likewise never used to train the provider's models, consistent with the Google API Services User Data Policy Limited Use requirements. AI-generated content, including saved reports, is sanitised before display and should be treated as analytical assistance, not professional advice.

8. International transfers

As a UK business with Clients and providers around the world, personal data we process is transferred internationally, both from the UK to our service providers and, for globally-distributed Clients, into the UK. Where we transfer personal data outside the UK to a country not covered by UK "adequacy" regulations, we rely on an appropriate safeguard, in practice the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures needed to protect the data. Our primary data hosting region is EU.

You can request information about the safeguards applying to a specific transfer by contacting us at the address in Section 14.

9. Data retention

• Account data is retained for as long as the account is active and for a reasonable period afterward to meet legal, security, and audit needs, then deleted or anonymised.
• Client analytics data (including streaming, social, advertising, website, newsletter, press-coverage, Google Search Console search-performance, and Google Analytics data) is retained for the duration of our agreement with the Client and deleted or returned on termination in accordance with that agreement. Google Search Console and Google Analytics data and tokens are additionally deleted or de-identified when a Client disconnects the relevant integration.
• Landing-page interaction records contain no personal data and are retained in aggregate for analytics.
• Single-use tokens (e.g. connect links and page-picker sessions) expire automatically and are deleted after use or expiry.
• AI chat history is retained until deleted by the user or the associated Client relationship ends.
• Project context items, uploaded documents, and AI-generated saved reports are retained until deleted by an authorised User or Backline admin, or until the associated Client relationship ends.
• Live shows and ticket-sales uploads are retained for the duration of our agreement with the Client, the same as other Client analytics data.
• Account-security activity logs are retained for as long as needed for security and audit purposes, in line with our other audit trails.

10. Security

We apply technical and organisational measures appropriate to the risk, including:

• Row-Level Security and role-based access controls so users only see Clients they are authorised for.
• Server-side-only handling of credentials and secrets, with masking in any UI and no secret logging.
• Encrypted transport (HTTPS) and encryption at rest through our infrastructure providers.
• Invite-only account provisioning with email confirmation and authentication rate limiting.
• Least-privilege service access and single-use, expiring tokens for sensitive public flows.

No system is perfectly secure, but we work to protect personal data and to notify affected parties and regulators of qualifying breaches as required by law.

11. Your rights

Under the UK GDPR you have the following rights. Clients and data subjects located outside the UK may also have equivalent or additional rights under their own local laws (for example the EU GDPR, or US state laws such as the CCPA/CPRA), which we will honour where applicable:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data ("right to erasure")
• Restrict or object to certain processing
• Data portability
• Withdraw consent where processing relies on consent
• Lodge a complaint with a supervisory authority (in the UK, the Information Commissioner's Office)

To exercise these rights, contact ds@backlineagency.co.uk. If your data is processed by Backline as a processor on behalf of a Client, we will refer your request to the relevant Client (the controller) or act on their instructions.

12. Children

Backline is a B2B tool intended for professional use and is not directed to children. We do not knowingly collect personal data from children. Aggregated audience statistics we process on Clients' behalf do not identify individual audience members.

13. Changes to this policy

We may update this policy from time to time. Material changes will be communicated to account holders, and the "Last updated" date above will change. Continued use of the platform after an update constitutes acceptance of the revised policy.

14. Contact

Backline Limited
5-11 Millbay Road, Plymouth, PL1 3LF
Email: ds@backlineagency.co.uk