Privacy Statement
What TheJay records about you, what it records about the people in your network, and what it deliberately does not measure.
The Dutch text is the binding version. This translation is here so it can be read; where the two differ, the Dutch text prevails.
1. Who processes your data
- Controller
- —
- Trading as
- TheJay
- Chamber of Commerce (KvK)
- —
- VAT number
- —
- Address
- —
- —
TheJay runs on Starting Up. Your account, identity, brand and the shared CRM live there — TheJay holds no password and cannot. Both are delivered today by the same undertaking, so this is one story in two documents. For what happens in the core, the Starting Up privacy statement applies; this page is about what TheJay adds.
2. Two roles, and here the difference matters extra
Controller — for your account
For what is yours as an artist — your profile, your music, your releases, your invoices — we determine the purpose and means, and this statement is the whole story.
Processor — for your network
TheJay is full of data about other people: bookers, labels, promoters, venues, fellow artists. Who they are, what you think of them, when you last spoke, and whether they listened to your demo. That is personal data, and you decide what you record about it.
For that you are the controller and we are the processor. The terms are in the Data Processing Agreement, which applies automatically — nothing to sign.
This is not a formality. A private note about a promoter is personal data, and that person has, in principle, the right to request it. Do not write anything in TheJay you would not want read aloud. We do not read your notes and give them to nobody — but the law gives the data subject a right we cannot take away.
3. What data, for what, and on what basis
| What | Why | Legal basis | How long |
|---|---|---|---|
| Account — email address, and which workspaces and brands you may see | Signing in, and knowing what you may do | Performance of the contract | As long as your account exists |
| Session | Staying signed in | Performance of the contract | 14 days |
| Artist profile — name, bio, photos, live set, rider, links | Your EPK and your public page | Performance of the contract | Until you delete it |
| Your library — tracks, versions, artwork, press photos | Your catalogue, your demos and your EPK | Performance of the contract | Until you delete them |
| Media on a scheduled post — the picture or video you attach | Publishing the post to the channels you choose | Performance of the contract | 72 hours after the post has finished on every channel you chose — published or permanently failed. If a channel did not work we keep the file for 30 days, so you can try again and we can find out what went wrong. A file attached to nothing goes after 7 days. See article 9. |
| Network — people and organisations, their role, notes, contact moments | Your relationship management | You decide this; we are the processor here | Until you delete it |
| Outreach and bookings | Tracking who you approached and what came of it | You decide this; we are the processor here | Until you delete it |
| Demo recipients and what they did with the link | Knowing whether your demo was listened to — see section 5 | You decide this; we are the processor here | Until you revoke or delete the link |
| Visits and clicks on a smart link | Measuring how a release is doing — see section 5 | Legitimate interest (aggregate, no individuals) | Until you delete the link |
| Content plan and posts | Planning and running your campaign | Performance of the contract | Until you delete it |
| Connected social accounts — tokens, encrypted | Posting on your behalf | Performance of the contract | Until you revoke the connection |
4. What is deliberately not recorded
This describes the code as it runs, not an intention:
- No IP addresses. Anywhere. Not on a smart link visit, not on a demo page.
- No user agents. Which browser, device or operating system someone arrived with is not recorded.
- No location. Not even a country, not even approximate.
- No cookies on your public pages. Your release link, your demo link and your artist page set no cookie at all and use no browser storage. A fan who clicks your smart link picks up nothing.
- No third-party trackers or pixels. No Google Analytics, no Meta pixel, no ad network.
- No selling of data, and no training of AI models on your music, your network or your writing.
5. Measuring people — demo links and smart links
Two features in TheJay measure what other people do. That is what they exist for, so it gets its own section, in plain words.
Demo links
When you send a demo, TheJay records per link: when it was opened, whether it was played, how far someone got, and whether it was downloaded. If you attached the link to a specific recipient, those events hang off that person. That is exactly what the product promises — "who listened and how far" — and it is at the same time the measuring of someone else's behaviour.
What this asks of you. You are the controller here. Tell the recipient that you can see whether they listened. One sentence in your message is enough. If you do not, you are measuring someone without their knowledge, and that is your responsibility and not ours.
What is not recorded on a demo visit: no IP address, no device, no location. If the link is not attached to a recipient, there is no way at all to know who was there.
Smart links
For a release link TheJay counts how many visits there were and which service was clicked. Nothing more: no visitor id, no cookie, no IP address, no session. Two visits from the same person are indistinguishable, and that is deliberate. You get a campaign count, not an audience.
6. Cookies
| Name | Purpose | Lifetime | Properties |
|---|---|---|---|
| thejay_session | Remembering that you are signed in | 14 days | HttpOnly, Secure, SameSite=Lax |
That is the only cookie, it is strictly necessary, and it is set only when you sign in. On the public pages — /r/, /d/ and /a/ — it is not set and nothing else happens. Hence no cookie banner.
7. Who else sees your data
The full list is on the sub-processors page, which forms part of this statement. In short: the hosting provider, Starting Up for your account and your AI text, and Mollie for payment.
Social platforms
If you connect Instagram, TikTok, YouTube or LinkedIn, what you post goes straight to that platform on your instruction. What they do with it falls under their own terms. We store the access tokens encrypted (AES-256-GCM), and without the key they are useless.
Publishing is switched off today. No key is configured in production, so no social account can currently be connected and nothing goes to a platform. You can still plan and write. If this changes, it will appear on the sub-processors page before it works.
Your own public pages
Your EPK, your release link and your demo link exist to be shared. What you put on them is public to anyone holding the link — that is the point, but worth realising before you put a phone number in your rider. A link can be revoked; what someone has already seen cannot.
8. Transfers outside the EEA
The application and database run inside the EU. If you have a text written with the AI feature, that request goes through Starting Up to the language model provider, today Anthropic in the United States. The European Commission's Standard Contractual Clauses apply. Without the AI feature, nothing leaves the EU by this route.
9. How long we keep things
- The periods per category are in the table under section 3.
- We delete media on a post ourselves, and that is deliberate. TheJay is a scheduling tool, not a storage service. Once your video is on Instagram or TikTok there is little reason for us to hold the original — and an archive of unreleased work sitting here for years is a risk we do not want to put on you. The clock only starts once every channel you chose has finished; never because the scheduled time went by. If a channel fails at 10:01, the file stays.
- The post itself stays. Title, caption, hashtags, the scheduled and the actual time, the channels, the status, the link to what was posted, the original filename, its type, dimensions, duration and size, and what went wrong — plus a small thumbnail. So your calendar stays readable without us keeping hundreds of megabytes.
- We do not touch your library. Tracks, artwork and press photos stay until you delete them. The period above applies only to the file attached to a scheduled post.
- Revoke a demo link or a smart link and it is dead immediately. Delete it and the associated events go with it.
- Delete your account and we delete your data within 30 days, except what we must keep by law — in practice the payment records, for 7 years.
10. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. Most of it you can do yourself: every record in TheJay can be viewed, changed and deleted.
If someone in your network asks for their data, that is your request to answer — you are the controller there. If it reaches us, we forward it to you and help.
What you cannot do yourself yet. There is no button today that deletes your account with everything in it, and none that exports everything. That is a shortcoming, not a choice. Until then: email — and we do it by hand, within 30 days, with confirmation.
You can complain to the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).
11. Security
- There is no password in TheJay. Signing in happens through a signed assertion from Starting Up, whose signature is verified before anything is read out of it. There is no password database here to leak.
- Every row belongs to one workspace and nothing is readable across that boundary.
- Social account tokens are stored encrypted with AES-256-GCM, with a key that exists only in the runtime environment.
- Files are reachable only through a token, not through a guessable URL.
- A demo link can carry a password and an expiry date, and can be revoked at any moment.
- Everything runs over HTTPS; the session cookie is HttpOnly and Secure.
In the event of a data breach posing a risk to those affected, we report it to the Dutch Data Protection Authority within 72 hours and inform you without undue delay.
12. Changes
If this statement changes substantively, we raise the version number and email you before it takes effect.