Privacy policy
Updated Oct 31, 2026
This page explains which personal data WAFT collects, what for, how long it keeps it and how to exercise your rights. It covers the WAFT website, its app and the public pages of the labels it hosts: profiles, download gates, premiere requests.
Who is responsible
WAFT is run by the association WHAT A FAIRY TALE MUSIC (French loi 1901 non-profit), SIREN 994 270 700, registered at 3 rue François 1er, bâtiment C, 92170 Vanves, France.
For any question about your data or to exercise your rights: whatafairytale.rec@gmail.com, or by post to the registered address.
Labels and WAFT
WAFT hosts several labels and collectives, each with its own profile. When you leave your email on a label's gate or send it a premiere request, that label decides how your data is used: it is the controller, and WAFT processes the data on its behalf, following its instructions and this page. The label's name is shown on every gate and every form.
WAFT is the controller for everything else: app accounts, platform security and error monitoring. You can contact either the label or WAFT about the same request: we pass it on and help the label answer it.
When you view a page
No third-party analytics, no advertising, no tracking pixel.
Number of views of a gate, per day
- What for
- Show the label how many people see its gate
- Legal basis
- No personal data: one counter per gate and per day
- Kept for
- 90 days
IP address, or a fingerprint of your email, used as the key of a counter
- What for
- Limit repeated submissions and abuse of the forms
- Legal basis
- Legitimate interest: protecting the service
- Kept for
- Deleted when the counting period ends, 7 days at most
Error report: page, browser, technical message, without IP address or email
- What for
- Fix outages
- Legal basis
- Legitimate interest: running the service
- Kept for
- 90 days at most, at Sentry
A release's page shows SoundCloud's player when the release has a public set there: it loads from SoundCloud's servers, and SoundCloud may read or set its own cookies there, under its privacy policy. Links to Bandcamp, Spotify or the other platforms only take you there when you click.
On a label's download gate
A gate gives you a track in exchange for actions the label picks: repost, like, follow or comment on SoundCloud, Instagram follow, email. The gate shows each action, required or optional, before you click.
Your SoundCloud ID (a number)
- What for
- Perform once the SoundCloud actions you ticked, check they are done, and show the label who unlocked its gate: your profile (username, picture) is read live from SoundCloud, never copied
- Legal basis
- Your consent, given by clicking Download via SoundCloud
- Kept for
- 90 days, with the unlock record
Unlock record: date, actions done, download date, fingerprint of your IP address (truncated then hashed), browser
- What for
- Give you the file, limit abuse, count downloads for the label
- Legal basis
- The label's legitimate interest
- Kept for
- 90 days
Your email, the text you accepted when giving it, the date, the fingerprint of your IP address and your browser
- What for
- Let the label keep you posted, as the text you ticked on the gate says
- Legal basis
- Your consent
- Kept for
- Until you remove your email or the label deletes it
SoundCloud asks you to authorize the WAFT app. That access only lasts for your visit: WAFT does not keep it, nor your name, photo or followings. Your comment is posted under your name on SoundCloud; WAFT does not keep it. You can remove the app at any time in your SoundCloud settings. To have your ID deleted before 90 days, write to us: it is done within 7 days.
The label can export its gates' emails to its own tools, a newsletter for instance; it is then solely responsible for them.
To remove your email from one gate or all of them: remove my email. A confirmation link is sent to that address, and nothing is deleted until you click it.
The Instagram follow opens on Instagram: WAFT only notes, in a cookie, that you opened the link, and receives nothing from Instagram.
The page's player is SoundCloud's, loaded from its servers: SoundCloud may read or set its own cookies there, under its privacy policy.
When you send a premiere request
A label's form sends it your track and what it needs to answer you. You confirm the request through a link sent to your email; that link opens a passwordless account to follow your request.
Email, label or artist name, contact name, message, track details, links (press, socials, reference tracks), bio, rights declarations
- What for
- Review your request, answer you, schedule and publish the premiere
- Legal basis
- Pre-contractual steps taken at your request
- Kept for
- Depends on the outcome, see below
Artwork and audio file
- What for
- Listening by the label, publication on SoundCloud if the premiere is accepted
- Legal basis
- Pre-contractual steps taken at your request
- Kept for
- Depends on the outcome, see below
Truncated IP address and browser at submission
- What for
- Spot spam
- Legal basis
- Legitimate interest: protecting the label
- Kept for
- Removed with your identity
Email or truncated IP address, if the label reports your request as spam
- What for
- Refuse later requests
- Legal basis
- Legitimate interest: protecting the label
- Kept for
- Until the label unblocks it
Not confirmed within 48 h: the request is cancelled and its files deleted; your identity is removed 30 days later.
Rejected or cancelled: files and identity removed 12 months after the decision, along with the account opened for the request if it serves nothing else.
Accepted: the request stays in the label's premiere history, and the track is published on SoundCloud.
Removing your identity means deleting your name, the label's name, your message, links, bio, IP address and browser, and replacing your email with a fingerprint that cannot be turned back into it: it only serves to recognise a repeated request.
If you have an account on the app
Email, name, language, last sign-in date; with Google, your Google account ID and the tokens returned at sign-in
- What for
- Sign you in and manage your access to profiles
- Legal basis
- Performance of the service
- Kept for
- As long as your account exists; deleted on request
If you are on a label's team: the date and method of each sign-in followed by a visit to the label's space (email link or Google), the browser and system used, the date of your last activity in that space. Neither IP address nor pages viewed
- What for
- Account security; showing the label's owners who uses its space
- Legal basis
- Legitimate interest of WAFT and the label
- Kept for
- Sign-ins: 90 days; last activity: as long as you are a member of the label
Log of actions taken in a label's workspace: who changed what, and when
- What for
- Label history, security
- Legal basis
- The label's legitimate interest
- Kept for
- As long as the profile exists; actions of a connected AI assistant (WebMCP): 1 year
Email of the person invited to join a label
- What for
- Send the invitation
- Legal basis
- The label's legitimate interest
- Kept for
- 7 days
Name, email, link and message of an application to open a profile
- What for
- Review the application and answer it
- Legal basis
- Pre-contractual steps taken at your request
- Kept for
- Unanswered: 90 days; handled: kept with the decision
A label's artists and sales
A label can keep in the app its artists' records (stage name, legal name, email, revenue shares), their contracts, their payouts and its sales. The label is the controller, and WAFT processes the data on its behalf. Imported sales keep neither the name, the email nor the address of buyers.
For this data, contact the label first; you can also write to us.
Who receives your data
The label concerned and its team members, according to their role. No data is sold or rented. Our providers only use it to provide their service to us:
- PulseHeberg: the app's server, in France
- MongoDB Atlas: database
- Cloudflare R2: files and encrypted backups
- Resend: email delivery
- Sentry: error monitoring, hosted in Germany
- Google: sign-in with Google, if you choose it
SoundCloud receives the actions you authorize on a gate and processes them under its own responsibility.
MongoDB, Cloudflare, Resend and Google are US companies: the transfer of your data to the United States is covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.
Security
Encrypted connections (HTTPS), passwordless sign-in (email link or Google), role-based access within each label, IP addresses truncated before they are stored.
Database backups are encrypted: daily ones are kept 30 days, weekly ones a year. Deleted data may remain in them until they expire; they are only used to restore the service after an incident.
Your rights
You can ask to access your data, correct it, delete it, receive it in a portable format or restrict its processing, object to processing based on legitimate interest, withdraw your consent at any time, and set instructions for your data after your death.
Write to whatafairytale.rec@gmail.com: we answer within one month. If you believe your rights are not respected, you can lodge a complaint with the CNIL.
No automated decision or profiling relies on your data.
Updates
This page changes when the app changes. The date at the top shows its latest version.