Privacy Policy
This notice explains how the Dream Big Music audience-intelligence platform (“Platform,” “we,” or “us”) handles information when you request access, create an account, work with an artist's analytics, or authorize a social or advertising account. The Platform supports independent artists, managers, labels, and their authorized teams. The organization operating the Platform must be identified in the finalized notice.
1. Information we collect
- Access requests: name, email, artist or project name, organization, account type, message, and request status. To limit abuse, we also store a hashed identifier derived from the request's network address for a short period.
- Individual accounts: email, display name, salted password hash, team and artist permissions, invitation records, login session information, security events, and records of acceptance of the Terms of Use.
- Artist and campaign information: artist names, account handles and IDs, uploaded CSV data, content captions, post identifiers and links, performance metrics, creative annotations, goals, experiments, and AI-generated analysis where enabled.
- Authorized integrations: Instagram, TikTok, Meta Ads, or TikTok Ads account identifiers, granted scopes, encrypted access/refresh credentials, connection and synchronization status, and data returned by the provider's authorized APIs. Depending on authorization and availability, this may include post views, engagement, reach, account audience counts, campaign names, advertising impressions, clicks, and spending.
- Technical and security information: session cookies, server request logs, timestamps, approximate connection information, and records used to investigate misuse or errors.
Please do not upload passwords, government identifiers, sensitive personal information, or artist information you are not authorized to provide.
2. How we use information
We process information to review access requests, authenticate users, enforce organization and artist permissions, show analytics, rank and compare content, import authorized social and ad-account data, prepare requested creative insights, troubleshoot issues, prevent abuse, maintain backups, and administer the Platform. We may also use service-performance and security information to improve reliability. We do not use connected advertising credentials to make ad purchases; the current advertising integration is reporting-only.
3. Connected Instagram, TikTok, and advertising accounts
Connections require action by an authorized user and are subject to the relevant third-party platform's rules and available permissions. We request the scopes needed for the chosen integration. Access credentials are stored encrypted by the application rather than displayed in the dashboard. Authorized team administrators or artist users, according to their permissions, can connect or disconnect applicable accounts. Removing a connection stops future sync for that connection and deletes linked records where the application uses cascading database deletes; it does not necessarily remove separately imported or derived data, backups, or copies held by third parties.
Accounts and providers can change available metrics, API fields, access permissions, or token lifetimes. Users can also revoke authorization through the relevant provider's settings. Meta, Instagram, TikTok, and other providers apply their own privacy terms to activity on their services.
4. AI and external service providers
When AI-assisted summaries or analyses are enabled, relevant analytics context, prompts, and other submitted content may be transmitted to an AI API provider to generate the requested result. Hosting, database infrastructure, security, and analytics service providers may also process information to deliver the Platform. Confirm the complete list of service providers and the current AI-data handling settings before finalizing this notice. Do not enter information you are not permitted to submit to an AI service.
5. Who can access information
Authorized Dream Big Music platform administrators can access information across workspaces. Team administrators and members can access their assigned teams and artists according to their roles. Direct artist viewers can access the artist records they have been granted. Access controls are implemented in application code. We do not intentionally expose one unrelated team's private reporting to another team's users. We may disclose information to service providers working on our behalf, to a user's authorized organization, or where legally required. We do not represent that aggregated campaign data identifies the artist responsible for each campaign unless attribution has been established.
6. Cookies and security
The Platform uses an essential, HTTP-only login-session cookie to keep authorized users signed in, together with server-side session and anti-forgery controls. Session records expire under the application configuration. The Platform also uses encryption for connected-account credentials and password hashing; it stores some logs and abuse-prevention records. No security system provides absolute protection. We do not currently describe any optional advertising-tracking cookie or marketing-pixel program; if one is introduced, this notice and any required choices must be updated.
7. Storage and retention
Platform records are currently stored in a SQLite database on persistent Render-hosted storage. We keep access-request records, artist analytics, connections, and other service data as needed for the purposes described above, subject to applicable law, customer agreements, and operational needs. Some short-lived OAuth states, session records, and rate-limit events expire or are cleaned up automatically. Long-term retention periods for customer records and backups have not yet been finalized; a production privacy review must establish specific deletion and backup schedules before external-scale onboarding.
8. Data access, corrections, and deletion requests
If you wish to request access to, correction of, export of, or deletion of information about you, contact Dream Big Music through DreamBigMusic.biz until a dedicated privacy contact is designated. We will review requests under applicable law and any relevant agreements, including verification of the requester's identity and authority. Requests involving an artist's organization may require coordination with that organization's administrator. Deleting a user account, revoking an Instagram permission, and deleting stored analytics are separate operations and may require different actions. Backups or legal obligations may affect timing.
9. International access and children
Data may be processed in the United States and other places used by approved providers; exact locations and cross-border safeguards require confirmation before final publication. The Platform is designed for professional artist and team use, not for children under 18. If you believe a minor supplied personal information, contact the operator to request review.
10. Your choices and applicable rights
You can decline to submit an access request, choose whether to authorize eligible connected accounts, ask your team administrator to adjust access, or revoke an integration with the third-party platform. Depending on where you live, privacy law may provide additional rights, such as information access, correction, deletion, objection, or appeal. We will respond as required by applicable law. This notice does not promise that all regional rights apply to every user or account.
11. Changes to this notice
We may update this notice as functionality and privacy practices change. Material updates should be communicated when required and reflected by a new version/date. Continued operation of any feature must be assessed against the notice in effect and any additional permissions or agreements.
12. Privacy contact
Privacy inquiries: contact Dream Big Music using DreamBigMusic.biz. Before adoption, replace this general contact route with a verified direct privacy email or mailing address and identify the legal operating entity.