Privacy policy

1. Who we are

Labelmate is published from Belgium by Tom Nsengiyumva (sole proprietor), company number BE 1022.549.155, Zwartleertouwersstraat 40, 8000 Brugge, Belgium ("we"). For the data described in sections 5 and 6, we are the controller within the meaning of the General Data Protection Regulation (GDPR); for the relay (section 3), we act on behalf of the label. We give the GDPR's protections to everyone, wherever they live: section 12 adds what the laws of other countries provide.

For any question about your data: contact@getlabelmate.com. We are not required to appoint a Data Protection Officer (Article 37 GDPR) and have not appointed one; that address reaches the publisher directly.

2. What stays on the label's computers

The emails Labelmate reads, the contracts, invoices and reports it files, the statements it prepares, the artists and the amounts: all of it is stored in an encrypted database, on the label's computers. We have no access to it.

For this data, the label is the controller; we act only on its behalf, within the limits of the data processing agreement. If you are an artist or a contact of a label and want to exercise your rights, contact the label: we will help it answer you.

The label's mailbox credentials, such as an app password, are kept in the computer's secure keychain. They are never sent to us.

3. What goes through our servers

To keep a label's computers in sync, Labelmate sends sealed copies to our relay: they are encrypted on the computer before they leave, with keys that never leave the label's computers. We cannot read them.

To run the relay, we see:

• the technical identifiers of the label's workspace and of each of its computers, and their public keys;
• the size and date of the sealed copies;
• the IP address of requests.

The relay is hosted by Supabase, on servers in the European Union (Ireland). Sealed copies are kept while the label uses Labelmate, and deleted no later than one month after it asks us to close its workspace.

For the relay, we act on behalf of the label, as the data processing agreement sets out.

4. Reading by the AI, if the label turns it on

When the label turns on document reading by the AI, the app sends the text of a document (a contract, an invoice) to Claude, Anthropic's AI model, so that it proposes the values to use. IBANs, card numbers and social security numbers are masked before sending. Neither the file nor the mailbox is sent; the text itself may contain names and amounts.

The app calls Anthropic directly, with Labelmate's access key: the text does not go through our servers. Anthropic processes this text as our sub-processor, to answer us; its commercial terms rule out using this data to train its models. The AI can be turned off at any time in the app's settings.

5. The site and early-access applications

This site sets no cookies and does not measure your visit. Only one thing comes from another site: the logo's font, served by Adobe Fonts. Your browser then sends your IP address to Adobe, which uses it to deliver the font without storing it, and Adobe sets no cookies. The app loads the same font from Adobe when it opens, on the same terms: nothing it holds goes with it. Our host, Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, United States), records in its logs the technical data needed to serve and protect the site: IP address, browser, page requested.

If you apply for early access, we receive what you write in the form: the label's name, your name, your email, the number of artists, your computers, your distributor and your message. We use it only to reply and to open your access. Each application is stored in our database, hosted by Cloudflare in the European Union, and a copy is emailed to our own inboxes (Gmail and Google Workspace) by our email-sending service, Resend, in the United States. We keep it for at most three years after our last exchange, unless your label becomes a customer.

6. When you write to us

We keep our correspondence while we handle your request, then as long as it is useful for our relationship with your label.

7. Legal bases

• Pre-contractual steps and contract (Art. 6(1)(b)): answering an early-access application, providing Labelmate to the label, running the relay.
• Legitimate interests (Art. 6(1)(f)): the security of the site and the relay, preventing abuse, following up our exchanges. You can object at any time.
• Legal obligation (Art. 6(1)(c)): accounting, and requests from authorities.

We make no automated decisions about you, we do not sell or share your data, and we do not use it for targeted advertising.

8. Who receives data

• Supabase, Inc.: hosting the relay, in the European Union (Ireland).
• Anthropic, PBC: reading documents with the AI, if the label turns it on, in the United States.
• Adobe Inc.: serving the logo's font, on the site and in the app (Adobe Fonts).
• Cloudflare, Inc.: serving this site from its worldwide network, and storing early-access applications, in the European Union.
• Google: our email (Gmail and Google Workspace), for the emails you send us and the copies of early-access applications.
• Resend, Inc.: sending our inboxes a copy of each early-access application, in the United States.
• Authorities, where the law requires it.

9. Transfers outside the European Economic Area

Anthropic processes texts in the United States, and some providers may process limited technical data outside the EEA. We then rely on a mechanism the GDPR recognises: an adequacy decision, including the EU-US Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses. Write to us to know which one applies to a given provider.

10. Security

Encryption on the computers, sealed copies, requests signed by each computer: the Security page describes what we do, and what we don't have yet. If a data breach puts you at risk, we notify the competent authority and, where the law requires it, the people concerned.

11. Your rights

You can ask us for access to your data, its correction, erasure or portability, or to restrict how we process it, and you can object to processing based on our legitimate interests. Write to contact@getlabelmate.com: we answer within one month, and may ask you to confirm your identity.

You can also complain to the Belgian Data Protection Authority (rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be) or to the authority of the country where you live: in France, the CNIL (www.cnil.fr).

12. Wherever you live

We give the GDPR's protections to everyone, whatever their country: the rights in section 11 are yours wherever you live. Some laws add to them:

• United Kingdom: the UK GDPR gives you the same rights; you can complain to the Information Commissioner's Office (ico.org.uk).
• Switzerland: the Federal Act on Data Protection gives you similar rights; you can complain to the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
• United States: we do not sell or share your personal information, and we do not use it for targeted advertising, as those terms are used in the California Consumer Privacy Act (CCPA) and similar laws in other states. Whatever state you live in, you can ask us to access, correct or delete your data by writing to contact@getlabelmate.com, and you will not be treated differently for asking.
• Canada: you can ask us for access to your personal information and to correct it; you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
• Anywhere else: write to us; we handle every request the same way.

13. Changes

We post any change here and update the date at the top of the page. For a material change, we tell labels in the app or by email.