Privacy policy
listenthru lets artists and labels publish a page for each release and see which posts and ads lead people to music services. This policy explains what we collect, why, who receives it and the choices you have. listenthru is operated by Y7 Technology合同会社, 〒150-0043 東京都渋谷区道玄坂1丁目10番8号 渋谷道玄坂東急ビル2F-C.
Two roles
Visitors to release and artist pages. These pages belong to the artist who published them. For the measurement on them (pixels and server events sent to the artist's Meta and TikTok accounts), the artist decides what is collected and why; Y7 Technology合同会社 processes it on the artist's behalf, as their processor. Questions about an artist's own use of that data are best sent to the artist; we will help them answer.
People who use listenthru (the home page, the dashboard, our own ads and emails). Here Y7 Technology合同会社 decides what is collected and is responsible for it.
When you visit a release page
- What. If the artist has connected them, the page uses the Meta Pixel and the TikTok Pixel, and our server sends the same events to Meta and TikTok (Conversions API and Events API) with the same event ids, so each is counted once. These events contain your IP address, your browser's user agent, the page you opened, the music service you chose, and the advertising cookies of those platforms (such as _fbp, _fbc and _ttp, and the ttclid in an ad link).
- Other ad platforms. An artist can also add the Google tag (Google Analytics and Google Ads), the Snap Pixel, the X Pixel or the Pinterest Tag to their pages. These load in your browser under the same consent rules, send the page view and the service you chose to that platform with the platform's own cookies (such as _ga, _gcl_aw, _scid, _twclid or _epik), and get no copies from our server.
- Counts. For the artist's insights we keep daily totals of visits and taps per page and where they came from (for example Instagram, TikTok or an ad); the source travels in the page's own links, with no cookie. These totals identify no one. We also count, per day, the country (estimated from your browser's language setting, such as ja-JP), the type of device (iPhone, Android or computer), the app the page was opened in (for example Instagram or TikTok) and the campaign name in the link. We do not store your IP address or user agent for these counts.
- What we do not collect. Your name, email address or music service account, unless you sign up for the artist’s news (below).
- Your choice. In the European Economic Area, the United Kingdom and Switzerland nothing is loaded or sent to Meta or TikTok until you choose Allow on the page; if you choose Decline, nothing is. You can change your choice with “Cookie settings” at the bottom of the page. Each artist asks separately, because each artist's ads are their own: we remember your answer for that artist in a cookie (lt_consent_<artist>, 180 days), and lt_ads_<artist> marks that their ads may run. Elsewhere you can block these cookies in your browser or turn off ad personalisation in your Meta and TikTok settings.
- Release and artist pages never carry listenthru's own advertising tags, only the artist's.
When you sign up for an artist's news
An artist can add a form to their pages where you leave your email address to hear from them. The artist decides how your address is used (the controller); Y7 Technology合同会社 keeps it on the artist's behalf (the processor) and uses it for nothing else.
- What. Your email address, the page and source you signed up from, the page's language, and when you signed up and confirmed.
- Confirmation. We send one email to check the address is yours. Nothing reaches the artist unless you confirm; unconfirmed sign-ups are deleted after 7 days.
- Basis. Your consent. You can withdraw it at any time with the link in that email, or by asking the artist or us.
- How long. Until you unsubscribe, the artist removes you, or the artist's account is deleted. An artist who downloads their list is responsible for the copy they keep.
- Never sent to Meta, TikTok or any other ad platform.
When you use listenthru
- Account. Your name, email address and profile picture from Google sign-in or your email address for sign-in links (Firebase Authentication). Your language choice (lt_lang cookie) and a sign-in marker (lt_in) so our home page can point you back to the dashboard.
- What you create. Artists, releases, artwork, links, theme, team members and invitations, and the insights for your pages.
- Ad accounts. Pixel ids and access tokens you add. Tokens are encrypted with Google Cloud KMS and decrypted only to send your pages' events.
- Payments. Handled by Stripe. We receive your plan, billing status, billing country and, if you give one, your tax id; we never see or store your card number.
- Emails. We send emails about your account and pages: sign-in links, invitations, receipts from Stripe, and a few emails that help you get started (for example a reminder to publish your first page, your first numbers, or that a trial is ending). Every email that is not strictly needed for the service has a one-click unsubscribe link.
How we measure our own advertising
Y7 Technology合同会社 advertises listenthru to musicians on Google, Meta and TikTok. To learn which ads lead to sign-ups and paid plans, our own pages (the home page, these policy pages and the dashboard) can use the Google tag (Google Ads), the Meta Pixel and the TikTok Pixel. Release and artist pages never use them.
- What is sent. Your browser sends directly to Google, Meta and TikTok: the pages you view, your IP address and browser details, ad click ids in the address (such as gclid, fbclid or ttclid) and the platforms' cookies (such as _gcl_aw, _fbp, _fbc, _ttp). On sign-up, a sign-up event; on a paid plan, a purchase event with price, currency and the Stripe checkout reference (never card details). On these two events your email address is given to Google's tag, which hashes it (SHA-256) in your browser before sending (enhanced conversions). Our server sends none of this to the platforms.
- Why. To measure and improve our own ads. We do not sell this data.
- Your choice. In the EEA, the UK and Switzerland none of these tags load until you choose Allow in the cookie notice. Elsewhere they are on by default. Change it any time: cookie settings (remembered in lt_own_consent, 180 days).
Legal bases (EEA, UK, Switzerland)
Ad cookies, pixels and the events sent with them: your consent. Your account, pages and payments: performance of our contract with you. Security, fraud prevention and aggregate counts: legitimate interests. Invoices and payment records: legal obligation.
Who receives data
- Google Cloud (hosting, database, file storage and key management, all in the Tokyo region) and Firebase Authentication.
- Stripe (payments, invoices and tax).
- Our email provider, to deliver emails.
- Meta and TikTok, for an artist's pages, under that artist's own accounts and terms; and Google, Meta and TikTok for our own advertising, as described above.
- Google, Snap, X and Pinterest, for an artist's pages when that artist has added their tags, under that artist's own accounts and terms.
We do not sell personal data. We disclose it to authorities only when the law requires it.
Where data is kept
Our data is stored in Japan (Google Cloud, Tokyo). Japan has an adequacy decision from the European Commission and the UK. Some providers above may process data in other countries, including the United States, under their own safeguards such as the EU Standard Contractual Clauses.
How long
- Account, artists, pages and insights: while your account exists, then deleted within 30 days of your request or of the account's deletion.
- Fan sign-ups: confirmed ones until you unsubscribe or the artist removes them; unconfirmed ones 7 days.
- Server logs: 30 days.
- Payment and invoice records: 7 years, as Japanese tax law requires.
- Cookies: as listed above. Data received by Meta, TikTok and Google: under their own policies.
Your rights
You can ask us to tell you what we hold about you, correct it, delete it, give you a copy, or stop or restrict a use of it, and you can withdraw consent at any time. Write to yudai.sasaki@y7technology.com; we answer within 30 days. In the EEA, the UK and Switzerland you can also complain to your data protection authority. Visitors to an artist's page can also contact the artist.
Security
Connections use HTTPS. Access tokens are encrypted with Google Cloud KMS. Access to production data is limited to the people who run the service.
Children
listenthru is for artists, labels and their teams, not for children. You must be at least 16 to create an account.
Changes
We will post changes here and, for significant ones, tell account holders by email before they take effect.
Contact
Y7 Technology合同会社, 〒150-0043 東京都渋谷区道玄坂1丁目10番8号 渋谷道玄坂東急ビル2F-C. yudai.sasaki@y7technology.com