Privacy Notice
Last updated: August 2026
Who we are
IndieForge ("IndieForge", "we", "us") operates indieforge.link and the IndieForge smart-links service. For the personal data described in this notice, IndieForge is the data controller — we decide what data is collected and why. You can reach us at support@indieforge.link.
Where you use IndieForge to collect email addresses from your own fans, you are the controller of those fan records and we process them on your behalf.
What we collect, why, and on what legal basis
Email address, display name, hashed password or federated sign-in identifier. Used to create and secure your account and to contact you about the service. Legal basis: performance of our contract with you.
Artist name, release titles, artwork, audio previews, platform links, canvas media. Used to build and serve your public release pages. Legal basis: performance of our contract with you.
Page views, click counts on streaming buttons, referrer, approximate country derived from IP address, device and browser type. Used to give you link analytics and to improve the product. Legal basis: our legitimate interest in measuring and improving the service.
Email address, and the release the fan signed up from. Collected on your behalf so you can own and export your fan list. Legal basis: consent given by the fan when submitting the form, and our contract with you as the artist.
Anything you send us by email. Used to answer you and keep a record of the issue. Legal basis: legitimate interest in providing support.
IP address, request metadata, authentication events. Used to detect fraud, abuse, and security incidents. Legal basis: legitimate interest in keeping the service secure, and legal obligation where applicable.
We do not track visitors across the web, we do not run ad networks, and we do not sell personal data.
Who we share data with
- Service providers and subprocessors — hosting, database, storage, email delivery, and error monitoring providers that run the infrastructure behind IndieForge, acting on our instructions.
- Paddle.com — our Merchant of Record for the sale of IndieForge plans. Paddle handles checkout, payment processing, subscription management, invoicing, tax compliance, and refunds, and processes the billing information you enter at checkout under its own privacy notice.
- Professional advisers — legal and accounting advisers, where necessary.
- Authorities — where we are required to disclose data by law or valid legal process.
International transfers
Our providers may process data outside your country, including in the United States. Where data leaves the UK or EEA we rely on appropriate safeguards such as Standard Contractual Clauses or an applicable adequacy decision.
How long we keep data
- Account and release content: for as long as your account is active.
- After account deletion: removed or anonymised within 30 days, except where we must keep records longer for legal, tax, or fraud-prevention reasons.
- Link analytics: retained in aggregated form for up to 24 months, then deleted or anonymised.
- Fan email records: kept until you delete them or close your account. You can export or delete them at any time.
- Support emails: up to 24 months after the conversation ends.
Security
We use appropriate technical and organisational measures to protect personal data: encryption in transit (HTTPS) and at rest with our hosting providers, hashed passwords, row-level access rules in our database so accounts can only read their own data, least-privilege access for administrators, and monitoring for suspicious activity. No system is perfectly secure, but if a breach affects your data we will notify you and any relevant regulator as required by law.
Cookies
We use a small number of essential first-party cookies and similar local storage for authentication (keeping you signed in) and preferences (such as your light/dark theme choice). We use limited first-party analytics to count link views and clicks. We do not use third-party advertising or cross-site tracking cookies. You can clear or block cookies in your browser settings; blocking essential cookies will stop sign-in from working.
Your rights
Depending on where you live, you have the right to access your data, correct it, have it erased, restrict or object to processing, receive a portable copy, and withdraw consent where processing is based on consent. Under UK/EU GDPR you also have the right to complain to your local supervisory authority.
Email support@indieforge.link to exercise any of these rights. We will respond within one month. You can also export or delete most of your data yourself from your dashboard at any time.
Changes and related policies
We will update this notice as the service changes and will post the new date at the top. See also our Terms of Service and Refund Policy.