Privacy Policy

Who we are

Dubsend is run by ANGVIS LTD ("we"), a company registered in England and Wales, number 12763866, registered office 61 Bridge Street, Kington HR5 3DJ, United Kingdom. For anything about your data, email support@dubsend.com.

Dubsend is for people aged 18 or over using it for their music business.

Our two roles

Under the UK GDPR we act in two ways:

• Controller for the data of our customers (people with a Dubsend account), visitors to this website, and the records we keep to protect email delivery and stop abuse (described below).
• Processor for the contact lists our customers upload and for what their recipients do with their promos. The label or artist who sent a promo is the controller of that data, and our Data Processing Agreement covers how we handle it. If you received a promo, contact the sender first; see For DJs.

Data we are responsible for

If you have an account

• Your email address and password. Our login provider stores the password only in hashed form; we can't see it.
• Your brands: name, logo, colour, bio, social links, reply-to email address and time zone.
• Your plan and usage: plan, number of recipients emailed each month, emails sent each day, plan changes.
• Billing references: your Stripe customer and subscription identifiers, your plan, its status and its dates. We never see your card details; see Who we share it with for how payments work.
• Login records. Our login provider, Supabase, records the IP address and browser of each login in your session records and its security logs; we delete your login records when the account is closed.
• Emails you send to support.

Records that protect delivery and stop abuse

• The Dubsend-wide block list. When an email to an address hard-bounces or the person reports it as spam, we store a hash (SHA-256) of the address, the reason and the date. No account can email that address through Dubsend again. The hash stays when the customer deletes the contact or closes their account. A hash isn't the address, but anyone who already has an address can work out its hash, so we treat it as personal data. Amazon SES, our email provider, also keeps addresses that hard-bounced or reported spam on our account's suppression list, as plain addresses, and won't send to them.
• The sending record. For every email sent we keep the message reference, the account, brand and campaign, a hash of the recipient's address and the send time for 90 days, even after a campaign or account is deleted, so late bounces and complaints still count.
• Import counts. How many addresses each account checked or imported and how many were blocked, to spot misuse.
• Rate limits. To limit sign-ups, downloads and other requests we count them per key for 2 days: a keyed hash of the visitor's IP address (never the address itself), a hash of an email address, or an account, recipient or link id.
• Sending limits. For each account: a hash of each address emailed in a month (the monthly recipient count), emails sent, bounced and reported per day, sending pauses and plan changes.
• Unsubscribes. When someone unsubscribes from a brand, the unsubscribe record stays even if you delete the contact. If the brand is deleted, we keep a hash of the address for the whole account, so they can't be added back by mistake.

If you visit this website

The public pages set no cookies and we use no analytics or advertising. Our hosting provider (Cloudflare) logs each request (IP address, page, browser and time) to run and secure the service; these logs are kept for up to 7 days and we only look at them to fix problems or investigate abuse.

Data we process for labels

For each customer, and only on their instructions, we store and use:

• Contacts: email address, name, role (DJ, radio, press, curator or other), country, tags, notes, and the consent record (basis, date and source).
• Join page sign-ups: email address, name, role and consent. A sign-up that isn't confirmed by email is deleted after 7 days.
• Promo activity per recipient: delivered, bounced or reported as spam; email opened (we record an open when the cover image in the email loads; email privacy tools such as Apple Mail can load it without anyone reading, so those opens are shown separately); page visits; seconds played per track; downloads (WAV or MP3); feedback (rating, favourite track, comment, and how long the person had listened when they wrote it); unsubscribes and reminder settings.
• Downloads: each downloaded file is tagged with the recipient's name, email address and the brand's name.
• Reports: a customer can share a read-only feedback report with others, such as its artists. Reports never include email addresses, and recipients' names appear only if the customer chooses. Report links can be revoked; we store their codes only as hashes.

So Dubsend keeps plain email addresses in each label's contacts and in the records of promos it sent; Dubsend's own block list keeps only a hash of each address.

Dubsend's database doesn't store recipients' IP addresses, browsers or locations. Our hosting provider, Cloudflare, logs each request (including the IP address and browser) for up to 7 days, and on join pages Cloudflare Turnstile checks the browser to tell people from bots. Personal promo links are stored only as hashes.

Why we use it

We don't send marketing emails and we never sell personal data.

Who we share it with

These companies process data for us under contracts that require them to protect it:

Independent controllers

Payments are processed by Stripe. The reseller and merchant of record is Link, part of Stripe: you buy your plan from Link, which handles payment details, receipts, invoices, tax and refunds as its own controller under its own privacy policy. When you start a checkout, Dubsend sends Stripe your account's email address and your Dubsend account id, so the payment is linked to your account. Dubsend receives only your Stripe customer and subscription identifiers, your plan, its status and its dates, never your card details.

We may also disclose data when the law requires it, or to protect our rights or someone's safety.

Transfers outside the UK

Our data is stored in the UK and the EU, and support emails are stored in Switzerland. Some providers are based in the United States or Switzerland and may access data from there for support or security. Those transfers are covered by UK adequacy regulations (for the EU, the EEA and Switzerland), the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

How long we keep it

Deleted data can stay in our providers' encrypted backups for a short time until those backups expire.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, limit how we use it, object to how we use it, or send it to you in a machine-readable format. Email support@dubsend.com; we reply within one month. If you received a promo, the label that sent it decides about that data: contact the label first, and if you can't reach it, we will pass your request on.

You can also complain to the Information Commissioner's Office: ico.org.uk, telephone 0303 123 1113.

Cookies

We only use cookies that are strictly necessary to log you in and keep you logged in. Promo emails record an open when their cover image loads. Details are in our Cookie notice.

Security

• Every connection is encrypted (HTTPS).
• The database only lets each account read its own rows.
• Files are stored privately and only served through links that expire within an hour.
• Personal promo links and report links are stored only as hashes. The block list stores a hash of each address.
• Keys for our providers have only the permissions they need.

Changes

If we change this policy we will update this page and the date at the top. If a change matters for account holders, we will email them before it applies.