​

This Privacy Policy explains how Compound ("Compound," "we," "us," or "our") collects, uses, discloses, and safeguards information when you use the Compound platform — our artist business operating system for independent artists and artist managers (the "Service").

​

If you have questions about this policy, contact us at privacy@compoundlondon.com.

​

1. Who We Are

Compound is operated by Compound London, LTD, a company registered in the United Kingdom. Compound connects data from music streaming and social media platforms into a single dashboard, giving independent artists and their managers a unified view of their performance and revenue.

​

For the purposes of UK GDPR and, where applicable, EU GDPR, Compound London, LTD is the data controller responsible for the personal data described in this policy.

​

2. What Data We Collect

We collect the following categories of data:

Account information

• Name and email address

• Login credentials, if you sign up via Google (we do not store your Google password — authentication is handled through NextAuth.js/Google OAuth)

 

Platform data you authorize us to access

When you connect a third-party account, we request only the data needed to power your dashboard and analytics. Specifically:

​

Platform Data we access

InstagramPost reach, engagement metrics, follower growth, and basic profile information, accessed via the Instagram Graph API using permissions you explicitly grant

SpotifyStreams, listener counts, saves, playlist adds, and top tracks

Apple MusicPlay counts, listener counts, and chart performance

TikTokVideo views, follower growth, and top-performing videos

​

We only request the minimum permissions required for these features, and access is granted directly by you through each platform's own authorization flow. You can revoke this access at any time, either within the Compound dashboard or directly through the third-party platform's own settings.

​

Usage data

Information about how you interact with the Service — pages visited, features used, and general device/browser information — collected to maintain and improve the Service.

​

Payment information

If you subscribe to a paid plan, payment is processed by Stripe. We do not store your full payment card details on our own servers.

​

3. How We Use Your Data

We use the data described above to:

• Aggregate your streaming, social, and performance data into a single dashboard

• Identify correlations between social activity (e.g. Instagram or TikTok posts) and streaming performance (e.g. Spotify or Apple Music activity), which is a core feature of the Service

• Power the "AI Manager" feature, which uses the Anthropic API (Claude) to help you interpret your data and make recommendations. Relevant account and performance data may be shared with Anthropic solely to generate these insights, subject to Anthropic's own data handling terms

• Process payments and manage subscriptions

• Maintain, secure, and improve the Service

• Communicate with you about your account or the Service

 

We do not sell your personal data or your platform data to third parties.

 

4. Our Legal Basis for Processing (UK/EU GDPR)

Where UK GDPR or EU GDPR applies, we rely on the following legal bases to process your data:

• Contract — processing your account, platform, and payment data is necessary to provide the Service you've signed up for

• Consent — connecting a third-party platform (e.g. Instagram, TikTok) is done via your explicit authorization through that platform's own consent flow, and you can withdraw this consent at any time

• Legitimate interests — for usage data used to maintain, secure, and improve the Service, and for basic communications about your account, where this doesn't override your own rights and interests

• Legal obligation — where we're required to retain or disclose data to comply with the law

 

Where processing relies on consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

 

5. Who We Share Data With

We share data only as necessary to operate the Service, with the following categories of service providers:

• Vercel — application hosting

• Supabase / PlanetScale — database storage (PostgreSQL)

• Anthropic — AI-powered analysis features (AI Manager)

• Stripe — payment processing

• Meta (Instagram), Spotify, Apple, and TikTok — solely to retrieve the data you've authorized us to access on your behalf; we do not share your Compound account data back to these platforms beyond what's required for authentication

 

If you manage artists through Compound, data connected by artists you manage is visible to you within your manager dashboard, consistent with the access those artists grant.

 

We may also disclose information if required by law or to protect the rights, safety, or property of Compound or our users.

 

All third-party service providers listed above are contractually bound (via data processing agreements) to handle your data only as instructed by us and to apply appropriate security measures.

 

6. Data Retention

We retain your account and platform data for as long as your account remains active, or as needed to provide the Service. If you disconnect a platform (e.g. revoke Instagram access) or delete your account, we will delete the associated data within 30 days, except where we're required to retain it for legal, tax, or accounting purposes (typically up to 6 years under UK law for financial records).

 

7. Your Rights

Under UK GDPR and, where applicable, EU GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you

• Rectification — request correction of inaccurate or incomplete data

• Erasure — request deletion of your data ("right to be forgotten"), subject to our legal retention obligations

• Restriction — request that we limit how we use your data in certain circumstances

• Data portability — request your data in a structured, commonly used, machine-readable format, and have it transferred to another provider where technically feasible

• Object — object to processing based on legitimate interests, or to direct marketing at any time

• Withdraw consent — for any processing based on consent (e.g. a connected platform), at any time, without affecting processing already carried out

• Not be subject to solely automated decision-making that produces legal or similarly significant effects concerning you. Our "AI Manager" feature provides recommendations and insights to support your own decisions - it does not make decisions on your behalf or take automated action without your review

 

To exercise any of these rights, contact us at privacy@compoundlondon.com. We will respond within the timeframe required by UK/EU GDPR (generally one month). If you are located in the UK or EU, you also have the right to lodge a complaint with your local data protection authority — in the UK, the Information Commissioner's Office (ICO), at ico.org.uk.

 

8. Data Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS) and secure authentication practices. However, no system is completely secure, and we cannot guarantee absolute security of your data.

 

9. International Data Transfers

Compound is based in the United Kingdom, but some of our service providers — including Anthropic, Stripe, and Vercel — are based in or process data in the United States. Where we transfer personal data outside the UK or EU, we rely on appropriate safeguards recognized under UK/EU GDPR, such as the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses (SCCs), to ensure your data receives an equivalent level of protection.

 

10. Cookies and Similar Technologies

Our website (compoundlondon.com) may use cookies and similar tracking technologies for essential site functionality, analytics, and, where you've given consent, marketing purposes. You can manage or withdraw cookie consent through your browser settings or, where provided, our cookie banner. Essential cookies required for the site to function do not require consent under UK/EU rules.

 

11. Children's Privacy

The Service is not directed at individuals under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us so we can delete it.

 

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via the Service or by email. The "Last Updated" date at the top of this page reflects the most recent revision.

 

13. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at:

privacy@compoundlondon.com Compound London, LTD