Privacy policy
This Privacy Policy explains how BRAIN PAIN MUSIC GmbH handles personal data when people visit PUBLIC.BUZZ, create an account or interact with customer pages. Our processing is governed primarily by the Swiss Federal Act on Data Protection (FADP). Where another law is mandatorily applicable to a particular processing activity, this policy does not limit rights under that law.
1. Who operates PUBLIC.BUZZ?
BRAIN PAIN MUSIC GmbH
Bahnhofstrasse 6, 9201 Gossau SG, Switzerland
Email: hello(at)public.buzz
2. Our role and the role of page owners
We are responsible for personal data we use to operate the PUBLIC.BUZZ service, administer accounts, provide support, secure the platform and manage subscriptions.
Customers create and manage their own pages. Where a customer collects newsletter signups, contact form messages, event registrations or other visitor information for their own purposes, that customer determines how those details are used. PUBLIC.BUZZ provides the technical service and may process such information on the customer’s behalf. Page owners are responsible for their own communications and for informing their visitors about their use of personal data.
For questions about information collected for a particular customer’s newsletter or contact form, please contact the relevant page owner. You can also contact us if you need help identifying the relevant contact.
3. Hosting and security
Our platform, database and uploaded images and videos are hosted with Infomaniak Network SA in Switzerland. Every night an encrypted backup is stored with Infomaniak Swiss Backup, also in Switzerland; it is encrypted before it leaves our server. We apply technical and organisational measures to protect data and control access. Some integrated services, such as payment processing, may process information outside Switzerland as explained below.
To keep automated sign-ups out, the sign-up form runs a short check in your browser (a small calculation when you tick “I’m not a robot”) and contains a hidden field that only bots fill in. This check runs entirely on our own server – no third-party service, no cookies and no tracking. A new account must be confirmed by email within 60 minutes; unconfirmed accounts are deleted automatically after that time.
4. Visitors, server logs and page statistics
When you visit PUBLIC.BUZZ or a customer page, our server processes technical connection information such as your IP address, access time, requested page and browser details. We use this information to deliver the site, maintain performance, protect the service and investigate misuse. Server logs are kept only for as long as needed for these purposes, subject to technical and legal requirements.
Page owners see simple statistics for their page. When someone opens a customer page or a link on it, PUBLIC.BUZZ adds one to a daily total: page views per day, with the website the visitor came from (only its name, for example instagram.com, or the utm_source in the link), the country and the approximate city, and clicks per link per day. Country and city are looked up on our own server from the IP address using a local list (IP Geolocation by DB-IP); the IP address itself is never stored for statistics. So that a visit is counted only once, our server keeps a one-way checksum of the IP address and the page (with a key that changes every day) for 30 minutes and then deletes it; it cannot be turned back into the IP address. To count visits, our web server also writes a short log of page requests that is deleted after three days. We use no cookies or similar identifiers for this and create no visitor profiles. Visits by search engines, link previews, other automated programs and the page owner are not counted. Only the daily totals are kept – no data about individual visitors. Page owners can download the totals; they are deleted together with the page.
Measuring our ads on Instagram (Meta). On our own website (for example the home page, pricing, sign-up and subscription pages) – never on customer pages – we ask for your consent before using the Meta Pixel from Meta Platforms Ireland Ltd. Only if you click “Accept” does your browser load Meta’s script, which may set cookies (such as _fbp and _fbc) and send Meta information about your visit, for example which page you viewed and that you signed up. If you then take out a subscription, our server also tells Meta about the purchase (the amount, the currency and your email address and account number in irreversibly encrypted form), so that Meta can link it to our ad (Conversions API). We use this only to measure and improve our ads; Meta may also use the data in accordance with its own privacy policy and may process it in the United States (under the EU-U.S. Data Privacy Framework and its Swiss extension). If you click “Decline”, none of this happens and our website works just the same. You can change your choice at any time under “Cookie settings” at the bottom of our pages. Apart from this, we do not use third-party analytics or cross-site tracking on our own pages, and we do not load fonts or scripts from other companies on them.
5. External media, calendars, shops and links
Music, video and booking services. Customer pages may offer embedded content from Spotify, SoundCloud, Apple Music, Bandcamp, YouTube, Vimeo, Calendly, Cal.com, OpenTable, TheFork and similar providers. We display a preview first; the external player or booking service is only loaded when you choose to open it. Once the external service loads, that provider may process your connection data and use its own cookies in accordance with its privacy policy.
Shopify products. If a page offers products from a customer’s Shopify store, our server may retrieve product details from that store. When you add a product to your cart or proceed to checkout, Shopify processes the cart and transaction. A cart cookie may remain on the page for up to 14 days. Payments, fulfilment and delivery details are handled by the page owner and their shop provider; PUBLIC.BUZZ does not receive your full payment-card information.
Events and maps. Ticket buttons and map links may take you to an external ticketing platform or map service. Those third parties process data under their own policies when you open their services.
Link previews. When a page owner adds a link card, our server may retrieve and store publicly available preview information, such as a title and thumbnail, so that the preview can be displayed without loading the linked site for every visitor.
6. Contact forms and event registrations
If you send a message through a contact form on a customer page, the details you enter – such as your name, email address, message and, where asked, a date and location – are processed so that the message can be emailed to the page owner. PUBLIC.BUZZ does not keep a copy and offers no message inbox in the platform. To prevent misuse, we briefly record the IP address of the sender (for one hour). The email provider and any technical delivery records may process the message as necessary to send it. The page owner is responsible for how they handle your request after receiving it.
If you register for an event on a customer page, we store your name, email address, the number of people, a registration code and whether the page owner has marked your payment as received, so that the page owner can manage the guest list and you can receive confirmations. The page owner receives these details by email and in their dashboard. Payments are made directly between you and the page owner using the payment service you choose (for example TWINT or PayPal); PUBLIC.BUZZ does not receive, process or store payment details. You can cancel your registration with the link in your confirmation email. Guest lists are deleted 30 days after the event. To prevent misuse, we briefly record the IP address of the sender (for one hour).
7. Customer accounts and saved content
To create and manage an account, we process your email address, login credentials stored as a secure password hash, verification and account status information, and the content and settings you choose to publish or save (including texts, links, images, videos and events). We use this information to provide the service, authenticate access, communicate about your account and prevent abuse.
If you connect Bandsintown, Shopify or another supported service, we process the information and connection details needed to retrieve the content you have chosen to display.
Support requests. If you contact us via “Help” in your dashboard, we process your message, an optional screenshot, your account email, the page you were working on, your plan and your device and browser type, so we can answer and fix problems. We reply by email and show our reply under “Help” in your dashboard. We handle support requests with the help of a text-processing (AI) service provider, which may also process data in the United States.
The PUBLIC.BUZZ app for Shopify. If you install our app in your Shopify store, we store your store’s address and name, a public storefront access key created for PUBLIC.BUZZ, and which PUBLIC.BUZZ pages you connected. With it we read the active products of your online store and create carts, so visitors can check out in your Shopify checkout. We do not access your orders, your customers or their personal data. Access to your store’s administration is only requested while you use the app inside Shopify and is not stored. When you remove the app or close your store, Shopify informs us and we delete these details and disconnect your pages.
Connected AI assistants (optional). You can connect an AI assistant of your choice to your account, so that it can edit your pages when you ask it to in a conversation. You sign in with us and allow the access; the assistant never sees your password. It can read the content and settings of your pages and make the changes you could also make in your dashboard, within your plan. It cannot access your newsletter subscriber list, contact or event-registration messages, payment details, your password or your account settings. Deleting content or making a page public or private requires your explicit confirmation in the conversation. The page content the assistant reads, and everything you write in your conversation, is processed by the provider of the assistant you chose, under that provider’s own privacy terms; we do not control that processing. We store which assistants you connected and when they were last used, and, so that every change can be undone, the state of your page before each change made through an assistant. You can see and disconnect connected assistants at any time under Account → AI assistants in your dashboard.
8. Subscriptions and payments
Paid subscriptions are sold by our online reseller Link (Sold through Link, LLC, a Stripe company), the Merchant of Record for all our orders. You enter your payment details in Link’s checkout, and Link processes them under its own privacy policy. PUBLIC.BUZZ receives the subscription status and the order information needed to provide paid features, support your account and meet accounting obligations. We do not receive your full card number. Invoices and payment receipts are sent by Link.
9. Newsletter signups, release reminders and pre-saves
Customers using the relevant paid features can invite visitors to subscribe to their newsletter. A visitor must confirm the signup by email before being added to the confirmed list. Unconfirmed newsletter signups are deleted after seven days. Unless the page owner turns this off, we email the page owner each confirmed address and let them know by email when someone unsubscribes. Confirmed subscribers can unsubscribe at any time using the link provided, which removes the address from the list immediately, and the customer can access or export the subscriber list. The page owner decides how to use the list and is responsible for the content of messages sent with other newsletter services.
Release reminders are separate from newsletter subscriptions. If you request a reminder for a particular release, we use your email address to send the requested release notification after confirmation. A release reminder does not subscribe you to a general newsletter. Unconfirmed reminders are deleted after seven days, and confirmed reminders 30 days after the notification has been sent.
Some release pages offer a pre-save before release day. You always sign in with the music service itself; we never see your password. Apple Music: your browser loads Apple’s MusicKit only when you press the button, you sign in with Apple, and your browser adds the release to your Apple Music library directly at Apple. Your Apple sign-in token is not sent to us; we only count that a pre-add happened. TIDAL: after you sign in with TIDAL and allow access to your collection, TIDAL gives us a sign-in token and your TIDAL user number. We keep them encrypted until the release is out, then add the track to your TIDAL collection and delete them immediately. If the track does not appear on TIDAL within 14 days after release day, we delete them without saving. We keep only the number of pre-saves per release, not who made them. Apple’s and TIDAL’s own privacy policies apply to your sign-in with them.
10. Service emails
We send account confirmations, password-reset emails, booking-request messages, event-registration emails, newsletter confirmations and notices to page owners, and release reminders through Infomaniak in Switzerland. Our system emails contain no tracking pixels and no tracked links; the only image is our logo, loaded from our own server.
11. Cookies and similar technologies
We use only cookies and comparable browser storage needed for the service, such as login sessions, form security, time-zone preferences and, when applicable, a Shopify cart, and a cookie that remembers your choice in our cookie notice. Cookies for measuring our ads (Meta) are only used on our own website and only with your consent – see section 4. Customer pages never use them. Third-party content activated by visitors may have its own technologies, which are governed by the provider’s policies.
12. Service providers and processing abroad
To operate PUBLIC.BUZZ, we use service providers for hosting, email delivery, payment processing and handling support requests. Hosting and email delivery are in Switzerland. The text-processing (AI) service provider we use for support requests may process data in the United States. Link, which sells our paid plans, may process data abroad, including in the United States, the European Union and other countries where Stripe operates. Where Swiss data protection law requires safeguards for international disclosures, we apply the relevant legal requirements and contractual measures (such as standard contractual clauses).
13. How long data is kept
Account information and page content are kept while the account exists. If an account is deleted, its page, links and uploaded content are removed from the live service immediately. Before each update of the platform we keep up to 10 copies of the database on our server; older copies are deleted automatically, so deleted data can remain in these copies for a limited time. Encrypted nightly backups in Switzerland are kept for 30 days; deleted data and files disappear from them after at most 30 days.
Confirmed newsletter entries remain available until they are unsubscribed or removed by the page owner. Unconfirmed newsletter entries are deleted after seven days. Event registrations are deleted 30 days after the event. TIDAL pre-save sign-in tokens are deleted once the track has been saved, or at the latest 14 days after release day. Support requests and screenshots are deleted two years after they were sent. Connections of AI assistants are kept until you disconnect them; their access keys expire after one hour, and renewal keys after 30 days without use. The page state saved before a change made through an AI assistant is deleted after 30 days (we keep at most the last 50 changes per page). Page statistics (daily totals without personal data) are kept while the page exists. Server and delivery logs are retained only as needed for security, troubleshooting and lawful operations. Accounting records are kept for the applicable statutory retention period, which is generally ten years under Swiss law.
14. Your rights and contact
Subject to the requirements and exceptions of applicable law, you can request information about personal data processed about you, ask for inaccurate information to be corrected, request deletion and exercise other rights available under Swiss law. Most account data you can view, change and delete yourself in your dashboard. Where PUBLIC.BUZZ processes customer-page data on behalf of a page owner, we may refer your request to that page owner and assist them as appropriate.
Contact: hello(at)public.buzz. You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC).
15. Updates
We may update this policy to reflect changes to our service or data processing. The latest version, including its update date, is published on this page.