R.O.S.Y.
Legal

Privacy Policy

Last updated: July 23, 2026

This Privacy Policy describes how R.O.S.Y. (“R.O.S.Y.”, “we”, “us”) collects, uses, and shares information when you use myrosy.app and related services (the “Service”). R.O.S.Y. is a multi-tenant SaaS platform used by independent recording artists to run their commerce, ticketing, fan CRM, social media, and affiliate programs. This document is written for review by legal counsel prior to public launch.

1. Introduction

R.O.S.Y. provides tools for two primary audiences: Artists, who use the platform to operate their businesses, and Fans, who interact with Artists through public artist pages, ticket purchases, merchandise orders, and email campaigns. This policy applies to both.

For most Fan-facing interactions, the Artist is the controller of the Fan’s personal information and R.O.S.Y. acts as a processor on the Artist’s behalf. For Artist accounts and platform-level operations, R.O.S.Y. acts as the controller.

2. Information We Collect

2.1 Information Artists Provide

  • Account information: name, email address, password (stored as a salted hash by our authentication provider), display name, artist profile slug, biography, avatar, and links.
  • Business information provided during onboarding to Stripe Connect, including legal name, address, date of birth, tax identifiers, and bank account details. This information is submitted directly to Stripe and is not stored on our servers in raw form.
  • Content uploaded to the platform, including product listings, images, tour information, merchandise designs, social media posts, and campaign copy.
  • Fulfillment provider credentials (Printful, Printify, ElasticStage) that Artists paste into the dashboard. These credentials are encrypted at rest using AES-256-GCM before being written to the database.
  • OAuth authorizations for social platforms (Meta, Google/YouTube, TikTok).

2.2 Information Fans Provide

  • Account information when a Fan signs up: email address and password (hashed).
  • Ticket purchase information: name, email, quantity, and city.
  • Merchandise order information: shipping address, contact email and phone number where required by the Artist’s fulfillment provider.
  • City votes and demand signals used by Artists to plan tours.
  • Email addresses collected through opt-in forms or added to a mailing list by the Artist.

2.3 Payment Information

Payments are processed by Stripe. R.O.S.Y. does not store full payment card numbers, CVV values, or bank account numbers on its own systems. We receive a limited transaction identifier, the amount, currency, last four digits of the payment method, and Stripe customer identifiers necessary to reconcile orders.

2.4 CRM Data

As Fans purchase tickets or merchandise, vote on cities, or otherwise interact with an Artist’s page, R.O.S.Y. creates a fan profile record for the Artist. This may include the Fan’s email, first and last order dates, lifetime spend, order count, cities of interest, and tags applied by the Artist.

2.5 Cookies, Analytics, and Device Information

We use strictly necessary cookies to keep users signed in and to protect against cross-site request forgery. We also collect basic device information such as user agent, IP address (for security and rate limiting), and pages visited. See our Cookie Policy for details.

2.6 Social Media Connections and OAuth Authorizations

When an Artist connects a Meta, Google/YouTube, or TikTok account, we receive OAuth tokens and a limited set of account metadata (page name, Instagram business account identifier, YouTube channel identifier, follower counts). Tokens are encrypted at rest. We access these accounts only to perform the actions the Artist has requested, such as publishing scheduled posts or reading insights on the Artist’s own content.

2.7 AI Features

R.O.S.Y. offers AI-assisted features (for example, caption generation and campaign suggestions). Prompts and supporting context may be sent to third-party AI providers via the Lovable AI Gateway. We do not send raw payment information, hashed passwords, or Stripe secrets to AI providers. AI providers are contractually prohibited from using inputs to train their models where the underlying provider offers that guarantee.

3. How Information Is Used

  • Provide the Service: operate accounts, process orders and tickets, deliver merchandise, run campaigns, and publish scheduled posts.
  • Communications: send transactional messages (order confirmations, ticket receipts, password resets, security alerts) and, where the Artist has opted in, product updates from R.O.S.Y.
  • Marketing on behalf of Artists: deliver campaign emails Artists send to their own Fans through the CRM.
  • Security: detect abuse, prevent fraud, enforce rate limits, and investigate incidents.
  • Platform improvements: understand which features are used and diagnose bugs.
  • AI recommendations: generate content suggestions and analytics summaries at the Artist’s request.
  • Customer support: respond to questions and troubleshoot issues.
  • Legal compliance: comply with applicable laws, respond to lawful requests, and enforce our terms.

4. Information Sharing

R.O.S.Y. does not sell personal information. We share information with the following categories of third parties, each acting as a processor or independent controller for a specific purpose:

  • Stripe — payments, payouts, and Stripe Connect onboarding.
  • Supabase — database, authentication, and file storage (our underlying cloud data platform).
  • Meta (Facebook, Instagram) — social media publishing and insights, only for Artists who connect their accounts.
  • Google / YouTube — video publishing and channel metadata, only for Artists who connect their accounts.
  • TikTok — content publishing, only for Artists who connect their accounts.
  • Printful, Printify, ElasticStage — print-on-demand fulfillment, when the Artist has enabled and configured these providers.
  • Email providers — transactional and campaign email delivery.
  • SMS providers — reserved for future SMS features; not currently active.
  • Cloud infrastructure providers — the underlying compute, storage, and CDN services that host the Service.

We may also share information (a) with the Artist whose page a Fan interacts with; (b) when required by law or legal process; (c) to protect the rights, property, or safety of R.O.S.Y., our users, or the public; and (d) in connection with a merger, acquisition, or asset sale, subject to continued protection of your information.

5. Cookies & Tracking Technologies

See our Cookie Policy for a description of the cookies we use.

6. Data Retention

We retain personal information for as long as an account is active and as needed to provide the Service. Financial records associated with completed transactions may be retained for the period required by tax and accounting laws (typically up to seven years). Aggregated or de-identified information that cannot reasonably be linked to an individual may be retained without time limit.

7. User Rights

Depending on your jurisdiction, you may have rights to access, correct, port, or delete your personal information, to object to certain processing, or to withdraw consent. To exercise these rights, use the tools available in your account or contact us using the details below. See Data Deletionfor account deletion instructions.

7.1 Account Deletion

Both Artists and Fans can request deletion of their accounts. Some information (for example, records of completed financial transactions) may be retained to comply with legal obligations even after account deletion.

8. Children’s Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

9. International Users

The Service is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

10. California Privacy Rights

California residents may have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt out of the sale or sharing of personal information. R.O.S.Y. does not sell personal information. To exercise your rights, contact us using the details below.

11. GDPR Considerations

Where the General Data Protection Regulation applies, R.O.S.Y. relies on the following legal bases: performance of a contract (to provide the Service), legitimate interests (to secure and improve the Service), consent (for optional communications and certain integrations), and compliance with legal obligations. Data subjects may exercise rights of access, rectification, erasure, restriction, portability, and objection.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email. The “Last updated” date at the top of this page indicates when the policy was most recently revised.

13. Contact Information

Questions about this policy or requests regarding your information can be sent to privacy@myrosy.app.

PrivacyTermsCookiesData DeletionAccessibility