Privacy Policy

1. What this policy covers

This site is a single page for the musician Lowkey718, out of Canarsie, Brooklyn. It is run by Lowkey718 ("we", "us"). This policy explains what happens to personal information on this website and its legal pages, and nothing else.

It does not cover Spotify, Apple Music, YouTube, SoundCloud, TIDAL, Amazon Music, iTunes, Instagram, TikTok, Threads, or any other service you reach from here. Those companies have their own privacy policies and we have no control over them.

There are no visitor accounts on this site. There is nothing to sign up for except an email list, and that is entirely optional. You can listen, click through to the music, and leave, without giving us anything.

If you have a question about any of this, write to lowkey718booking@gmail.com. A real person reads it.

2. What we collect

Two things, and only one of them involves you doing anything: an email address if you submit the form, and a click count on each link. Separately, the company that hosts the site keeps standard server logs. We do not create those logs and we do not control them, but they exist, so they are described below too.

Your email address, if you choose to give it

If you fill in the mailing list form, we store:

• the email address you typed;
• the IP address the form was submitted from;
• the date and time you submitted it.

The IP address and timestamp are kept for one reason: to show, if anyone ever asks, that a real person actually asked to join the list from that connection at that moment. It is a consent receipt. We do not use it to work out who you are, where you live, or what else you do online. If the form is ever hit by a script pushing fake addresses at it, those same stored IP addresses are what we would use to spot and block it.

A click count per link

Each link on the page has a counter next to it in the database. When someone clicks a link, that counter goes up by one. That is the whole mechanism.

The counter is one number for the link, not a record about you. It is not tied to your IP address, your device, a session, a cookie, or an identifier of any kind. There is no row in our database that says a particular visitor clicked a particular link. It tells the artist that a link got two hundred clicks. It cannot tell him who they were.

One honest caveat: our host's ordinary server logs record web requests along with IP addresses, the same way they do for every page load, so a click request appears there like any other request. Those logs belong to the host, on the host's schedule, and we do not use them to work out who clicked what. See below.

Server logs, which our host keeps and we do not

Like almost every website, this one sits on hosting we rent, and the hosting company keeps standard server logs which normally include visiting IP addresses. Those logs are created and deleted by the host on the host's schedule, not ours. We do not mine them, build profiles from them, or feed them into anything. See section 6.

3. What we do not collect, and never have

This part matters, so we will be blunt about it.

• No analytics product. There is no Google Analytics on this site. No Plausible, no Matomo, no Fathom, no heatmaps, no session recording. None.
• No advertising and no ad tracking. No Meta pixel, no TikTok pixel, no Google Ads tag, no ad network, no retargeting, no conversion tracking. We do not sell ad space and we do not show you ads.
• No cookies for visitors from us. This site sets no cookie at all on an ordinary visitor's browser. The embedded players are a separate matter, because they come from other companies — section 14 explains both.
• No fingerprinting. We do not collect your browser version, screen size, fonts, or hardware details to identify you across sites.
• No profiles. We do not build a picture of your interests, and we do not make automated decisions about you.
• No payments. There is no shop, no checkout, no subscription. We never see a card number.
• No sensitive information. We do not ask for your name, address, phone number, date of birth, health, religion, politics, ethnicity, sexuality, or precise location — so we do not have any of it.
• No buying of data. We do not obtain email addresses or any other personal information from data brokers, list vendors, or other websites.

4. What we use it for

• Your email address is used to send occasional messages from the artist — a new release, a video, a show. That is it. We do not send other people's marketing to you.
• The IP address and timestamp attached to your signup are kept as proof that the signup was real, and are what we would use to block the form if it were being abused by a script.
• The per-link click counts are used by the artist to see which links people actually use, so he knows where to point them next.

We do not use your email address for anything you did not ask for, and we do not pass it to other artists, labels, promoters, or anyone else's list.

5. Legal bases (for visitors in the EU, the EEA and the UK)

If data protection law of the EU/EEA or the UK applies to you, these are the grounds we rely on:

• Consent for the mailing list. You typed your address in and pressed the button. You can take that consent back at any time, using the unsubscribe link or by emailing us, and withdrawing it does not make what we did beforehand unlawful.
• Legitimate interests for keeping a record that a signup was genuine, for keeping the signup form from being abused, and for keeping the site running and secure. Our interest is running a small artist page without it being flooded with junk or fraudulent signups, and being able to show that the people on the list asked to be there; the effect on you is minimal, because the only extra data involved is the IP address your browser already sent us in order to load the page.
• Legal obligation where we have to keep or produce something because the law requires it.

We treat the aggregate click counts as not being personal data, because a plain total for a link cannot be connected back to any individual. That is our reading, not a ruling. If you think it is wrong, tell us and we will explain exactly how the counter works, and a regulator can take its own view.

6. Who else sees it

The list of companies that touch this data is short, and we would rather keep it that way.

• Hostinger, our web host. The site and its database run on their shared hosting, so in practice they hold whatever the site holds, and they keep the server logs described in section 2. They act as our service provider: they are there to run the hosting, and we have not authorised them to use this data for their own marketing. Their terms, not ours, are what actually bind them, and we can send you what those terms say.
• Mailchimp, but only if the operator has switched on the optional sync. When it is on, mailing list addresses are copied to Mailchimp so the newsletter can be sent, and Mailchimp's own campaign tools can record whether an email was opened and whether a link inside the email was clicked. That is tracking inside the email, at Mailchimp, not tracking on this website. When the sync is off, addresses stay only in this site's own database and Mailchimp gets nothing. If you want to know which is true right now, and whether that email tracking is on, ask us at lowkey718booking@gmail.com and we will tell you.
• Nobody else. No ad networks, no data brokers, no analytics companies, no "partners".

We do not sell personal information, and we never have. We do not rent it, trade it, or share it for anyone's advertising.

Two situations are worth naming honestly. First, if we were ever served with a valid legal demand — a court order or similar — we may have to hand something over, and so may our host. Second, if the artist's project were ever transferred to another entity, the mailing list could move with it; if that happened we would email the list first so people could leave before the transfer.

Embedded players

The page embeds players from Spotify, YouTube, Apple Music and SoundCloud. Those are windows onto their servers, sitting inside our page. When one loads, your browser connects directly to that company, which means it receives your IP address and information about your browser, and it may set its own cookies or similar storage in your browser.

That is their collection, under their privacy policies, not ours. We do not receive it, we cannot see it, and we cannot switch it off for you from our side. If you would rather they did not see you, block third-party content in your browser, or use an extension that stops embeds from loading, before visiting.

Outbound links

The buttons on the page take you to Spotify, Apple Music, TIDAL, Amazon Music, iTunes, YouTube, Instagram, TikTok and Threads. Once you land on one of those, you are on their site, under their rules. We do not attach anything about you to those links — no identifier, no email address, nothing from the form. Two ordinary browser behaviours are outside our control: the site you land on sees your IP address, as any site you visit does, and your browser may tell it that you arrived from this page. On our side, all that happens is that a counter goes up by one.

7. International transfers

This site runs on shared hosting. The server may physically sit in a different country from you, and the same is true of Mailchimp if the sync is enabled. In practice that often means the United States or another country outside your own.

If you are in the EU, the EEA or the UK, that means the personal data we hold about you — your email address, plus the IP address and timestamp from your signup — may be stored on machines outside the EEA or the UK, and the same goes for the server logs our host keeps. Countries differ in how they protect personal data and in the access their public authorities can demand, and some do not offer the same protections as your own.

Where a transfer like that happens, we are relying on whatever safeguards our providers publish for their customers — typically standard contractual clauses, and for US providers that have self-certified, the EU-US Data Privacy Framework. We should be straight with you about the limits of that. We are a very small independent operation renting shared hosting. We can read our providers' published terms, tell you what they say, and pass them on to you. We cannot audit a hosting company's infrastructure, we did not negotiate those terms, and we cannot guarantee how a foreign government would behave.

If you would prefer that your email address is not stored outside your country, the honest answer is to not join the mailing list. Everything else on this page — the music, the links, the embeds — works perfectly well without giving us anything, and you can always follow the artist on a platform of your choosing instead.

To ask which country the data currently sits in, or to see what our providers say about transfers, email lowkey718booking@gmail.com.

8. How long we keep things

• Mailing list records (email, IP, timestamp): kept until you unsubscribe or ask us to delete them, or until the list is shut down, at which point the records are deleted. There is no fixed expiry, because a mailing list you joined is meant to last until you decide otherwise.
• When you unsubscribe: the unsubscribe link performs a hard delete. The row is removed from this site's database, not flagged as inactive and kept. We do not keep a "suppression list" of people who left; if you later want back in, you simply sign up again.
• Copies at Mailchimp (if the sync is enabled): we delete the contact there as well. Mailchimp records its own unsubscribes and may keep residual copies in its backups, logs or compliance records for a period it sets, which is outside our control.
• Backups: if a database backup exists that was taken before your deletion, your record may sit inside that backup file until it is rotated out. We do not restore deleted subscribers from backups.
• Server logs: retained and deleted by our host on their schedule. We do not control the length and cannot delete them for you.
• Click counters: kept indefinitely. They are just numbers and contain nothing about any person.
• The operator's session cookie: ends when the operator's browser session ends.

9. Security

What we actually do:

• the site is served over HTTPS, so what you send is encrypted in transit;
• the private editor is password-protected, and only the operator can log in — there is no login for anyone else;
• unsubscribe links are cryptographically signed, so a working link cannot be produced by guessing, and nobody can walk through the list by changing a number in a URL;
• access to the database is limited to the operator and, unavoidably, to the host;
• we deliberately hold as little as possible, which is the most effective protection available to a site this size.

What we will not tell you: that this is unbreakable. No website can honestly promise that, and a small independent site is not going to be the exception. If we ever learn of a breach that puts people at risk, we will notify those affected and any regulator we are required to notify, as quickly as we reasonably can.

10. Your rights, and exactly how to use them

Depending on where you live, some or all of these rights apply to you as a matter of law. We try to honour all of them for everybody, wherever they are, because with a dataset this small there is no good reason not to.

• Get a copy (access). Email lowkey718booking@gmail.com from the address you signed up with and ask. We will send you back the record we hold: your email address, the IP address stored with it, and the signup timestamp. That is everything on our side that is linked to you. Our host's server logs are a separate thing — they are the host's records, they are not organised by person, and we cannot pull "your" entries out of them.
• Correct it. Email us the corrected address. Realistically the only correctable field is the email address itself; we will update it or, if you prefer, delete the old record and let you sign up fresh.
• Delete it. Click the unsubscribe link in any email we have sent you — that deletes the record outright, straight away, with no further step. Or email us and ask, and we will do it by hand.
• Withdraw consent. Same action as deletion: the unsubscribe link, or an email to us. There is no penalty and no "are you sure" maze.
• Take it with you (portability). Ask, and we will send your record as a simple machine-readable file such as CSV or JSON. It will be very short.
• Object, or ask us to restrict use. Tell us what you object to. In practice, if you object to us holding your address at all, we will delete it, which resolves the objection completely.
• Not be subject to automated decision-making. There is none here. Nothing on this site profiles you or decides anything about you automatically.

How we check it is really you. The only identifier we hold is an email address, so we verify by replying to that address. If you write from the address on the list, that is the check. If you write from a different address we may not be able to match you to a record at all, and we will say so rather than guess. We may ask one confirming question if something looks off. We will not demand ID documents — asking for a passport scan to prove ownership of an email address would collect far more sensitive data than we hold in the first place.

How long we take. We aim to answer within a few days, and in any case within one month. If a request is genuinely complicated we will tell you and may take longer, up to the limits the applicable law allows. There is no charge. If someone sends repeated, clearly abusive requests we may decline, and we will say why.

11. US state privacy rights

If you live in California, Colorado, Connecticut, Virginia, Utah, or another US state with a comprehensive privacy law, that law may give you rights over your personal information. An operation this small may well fall under the thresholds those laws set, so some of them may not legally apply to us at all. We honour the following anyway:

• Right to know / access the personal information we have collected about you, where it came from, why we collected it, and who we disclosed it to.
• Right to delete the personal information we hold about you.
• Right to correct inaccurate personal information.
• Right to a portable copy in a usable format.
• Right to opt out of the sale of personal information, of targeted or cross-context behavioural advertising, and of profiling that produces legal or similarly significant effects.
• Right to appeal if we refuse a request. Reply to our refusal and say you are appealing. We will look at it again and write back with our decision and our reasons. If we still say no, several state laws let you raise it with your state Attorney General, and you can do that whether or not your state's law formally requires an appeal step.

An explicit statement, because these laws ask for one:

• We do not sell personal information, for money or for anything else of value.
• We do not share personal information for cross-context behavioural advertising. There is no advertising of any kind on this site.
• We do not use personal information for profiling in furtherance of automated decisions.
• We do not collect or process sensitive personal information.
• We offer no financial incentives — no discounts, prizes, or preferential treatment in exchange for your personal information. Joining the mailing list gets you emails, and nothing is withheld from you if you do not join.

Because there is no sale, no sharing and no targeted advertising here, there is nothing for an opt-out to switch off. For the same reason, an opt-out preference signal such as Global Privacy Control, or a Do Not Track header, needs nothing from us: we are not doing the thing it asks us to stop. We do not detect or read those signals, because there is no setting for them to change.

To use any of these rights, email lowkey718booking@gmail.com from your address and say what you want. We verify as described in section 10.

12. California supplement (CCPA/CPRA)

This section adds the specific detail California asks for. We provide it whether or not we meet the thresholds that make the CCPA legally binding on a business of this size.

Categories of personal information collected in the last 12 months

• Identifiers: an email address, and an IP address recorded at signup. Source: directly from you, when you submit the form. Purpose: sending the newsletter, proving consent, preventing abuse. Disclosed to: our hosting provider, and Mailchimp if the sync is enabled — both as service providers.
• Internet or network activity: the server logs kept by our host, and the per-link counters, which are plain totals not linked to any person. Not used to profile anyone.
• Geolocation data: we do not collect location. An IP address can suggest an approximate region, but we do not derive location from it or store any location field.
• Sensitive personal information: none collected, so none used or disclosed, and there is nothing to limit.
• Not collected at all: real name, postal address, phone number, signature, government ID, financial or payment information, commercial or purchase history, biometric data, education or employment information, audio or video recordings of you, and inferences drawn to create a profile.

Your California rights

• Right to know — the categories and specific pieces of personal information collected, the sources, the business purposes, and the categories of third parties it went to. The summary above is that disclosure; ask us and we will give you the specific pieces we hold about you.
• Right to delete — we will delete your record from this site's database, and if the Mailchimp sync is enabled we will delete the contact at Mailchimp too. What we cannot do is make our host delete its server logs or its backups on demand; those run on the host's own schedule, as explained in section 8.
• Right to correct inaccurate information.
• Right to opt out of sale or sharing — there is none. No "Do Not Sell or Share My Personal Information" link is provided because there is nothing it could turn off, and we would rather say that plainly than post a button that does nothing.
• Right to limit use of sensitive personal information — not applicable; we collect none.
• Right to non-discrimination — we will not treat you worse for exercising any of these rights. There is no account to close, no price to raise, and no feature to withdraw. The entire site works the same whether or not you ever give us an email address.

Authorised agents

You can have someone submit a request for you. Send us written permission signed by you, or a power of attorney. We may also contact you directly at the email address on the list to confirm you asked for this, and we may ask the agent to confirm their own identity. If we cannot confirm the authorisation, we will decline and explain why.

Metrics

The annual request metrics that California requires apply to businesses handling personal information at a scale far beyond this one, so we do not publish them. If you want to know how many requests we have received, ask and we will tell you honestly.

13. Children

This site is a musician's page. It is not aimed at children, and there is nothing here designed to appeal to them specifically.

We do not knowingly collect personal information from anyone under 13. If you are under 13, please do not submit the mailing list form. The UK sets the age for consenting to this kind of processing at 13, and EU countries set it somewhere between 13 and 16; if you are in one of those places, please do not sign up unless you are old enough where you live, or a parent or guardian agrees.

If you are a parent or guardian and you believe a child has given us an email address, email lowkey718booking@gmail.com and we will delete the record. We will not ask you to prove anything first; deleting an address costs us nothing.

14. Cookies

Short version: as a visitor, this site gives you no cookies.

The only cookie this site sets is a PHP session cookie named lk718_admin, and it is only ever set for the operator when logged into the private editor. It keeps that login session alive and does nothing else. It is not set for visitors, it does not track anyone, and it is not sent to any third party.

The embedded players from Spotify, YouTube, Apple Music and SoundCloud are a different matter. Once one of those loads, that company can set its own cookies or similar storage in your browser, under its own policy, and we have no say in what it sets or how long it lasts. Be aware that the embeds load as part of the page, so this happens before you have had a chance to tell us anything. The way to prevent it from your side is to block third-party content in your browser, or use an extension that stops embeds loading, before visiting.

Because we set nothing on a visitor's browser ourselves, there is no cookie banner here to accept or reject.

15. Complaints

Start with us. Email lowkey718booking@gmail.com, tell us what went wrong, and we will try to fix it. Most problems with a site this small can be sorted out in one message.

You do not have to come to us first, though, and you keep your right to complain to a regulator:

• EU/EEA: you can lodge a complaint with the data protection supervisory authority in the country where you live, where you work, or where you think the problem happened.
• UK: you can complain to the Information Commissioner's Office.
• United States: you can contact your state Attorney General, and in California the California Privacy Protection Agency.

Depending on where you are, you may also have the right to take the matter to a court. Nothing in this policy takes that away.

16. Changes to this policy

If the site changes — say the Mailchimp sync gets switched on, or a new embed is added — we will update this page to match. The revision date published with this policy tells you when it last changed.

If a change is significant and affects people on the mailing list, we will say so in an email rather than quietly editing the page. We will not start using data we already hold for a genuinely new purpose without asking you first.

17. Contact

This site is operated by Lowkey718. For anything in this policy, including any request under sections 10, 11 or 12, write to lowkey718booking@gmail.com.

We are based in New York, USA, and that is the law we work to. This policy is a description of what we do, not a contract, and it does not ask you to give anything up: wherever you live, the data protection rights your own law gives you still apply to you in full.

Contact

Questions about this page, your data, or a takedown request:
Lowkey718
lowkey718booking@gmail.com