← Back to Rollout Heaven

Privacy Policy

Rollout Heaven LLC ("Rollout Heaven," "we," "us," the "Service") operates a marketing command center for independent musicians, and includes Rollout Heaven Live — a live-streaming platform where host artists review songs on air and fans can watch, chat, submit songs, and support artists. This policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data. By using the Service you agree to the practices described below.

1. Information We Collect

1.1 Information You Provide

• Account information. Email address and a one-way hashed (bcrypt) password when you register. We never store plaintext passwords.
• Release metadata. Song titles, artist names, release dates, ISRC/UPC/ISWC codes, songwriter and publisher details, PRO information, cover art, streaming links, and any other material you choose to add to the Release Intake form.
• Generated content. Hooks, captions, marketing calendars, outreach templates, press releases, email campaigns, and other material produced by the AI generation pipeline on your behalf.
• Support communications. Emails, support tickets, and any other correspondence you send to us.

1.2 Information Collected Automatically

• Session data. A secure HTTP-only session cookie and a corresponding server-side session record used solely to keep you logged in.
• Technical logs. Standard web server logs (IP address, user-agent, request path, timestamp) retained for operational, debugging, and abuse-prevention purposes.
• Gamification data. XP, level, achievements, and action counters tied to your account.

1.3 Information From Third Parties

• Payment information. When you subscribe, Stripe collects and stores your payment details directly. We never see or store your card number, CVC, or full bank account information. We receive and store only a Stripe customer ID, subscription status, tier, and billing period end date.

1.4 Rollout Heaven Live — Fan Information

When you interact with a host artist's live show as a fan, we collect what you provide:

• Fan profile. First name, chat display name, email address, and optionally a phone number. If you set a PIN for your fan profile, it is stored one-way hashed (bcrypt), never in plaintext.
• Song submissions. The song or video link, title, artist name, and any context you include, plus the submission's queue and review status.
• Chat messages. Messages you send in a show's live chat, with your chat display name.
• Support payments. Records of paid submissions, gifts, donations, and monthly support (amount, timestamp, optional message). Card details go directly to Stripe — see Section 1.3.
• Marketing consent records. If you check the box to receive marketing texts and/or emails, we store the fact of your consent, the exact consent text you agreed to, and a timestamp, as required by law. Consent is never a condition of purchase, and you can withdraw it at any time (reply STOP to any text, use the unsubscribe link in any email, or email us).
• Guest broadcasts. If you join a show as an on-camera guest, your camera and microphone feed is transmitted into the host's live broadcast. We do not retain a separate copy of your raw camera feed; it becomes part of the broadcast and its recordings (see Section 5).

1.5 Social Media Account Connections (Optional)

Rollout Heaven Live lets you optionally connect your own social accounts so that a live show can be simulcast to those destinations. Connecting is entirely optional and only happens when you initiate it. When you connect an account, we receive and store the following from the provider:

• YouTube (via Google). Your channel's basic identifying information (channel ID and name) and an OAuth access token and refresh token authorizing us to create and manage live broadcasts on your own channel. Requested scope: https://www.googleapis.com/auth/youtube.
• Facebook and Instagram (via Meta). Your Facebook public profile, the list of Pages you manage, and access tokens authorizing us to create live videos on the Page or profile you select. Requested permissions: public_profile, pages_show_list, pages_read_engagement, pages_manage_posts, pages_manage_metadata, pages_read_user_content, and publish_video.

2. How We Use Your Information

• To operate the Service -- authenticate you, render your saved releases, generate campaigns on request, and track your progress.
• To operate Rollout Heaven Live -- run the submission queue, notify you when your song is about to be reviewed, display chat, process gifts and support, and share your fan information with the host artist you engaged with (Section 4.3).
• To process subscription payments, issue receipts, and manage your plan and billing.
• To send transactional emails you have explicitly requested (verification links, password resets, subscription receipts, queue notifications), and — only with your separate express consent — marketing texts and/or emails, which you can stop at any time (reply STOP, use the unsubscribe link, or email us).
• To debug issues, monitor Service health, and prevent abuse of AI generation endpoints.
• To comply with legal obligations, enforce our Terms, and respond to lawful requests.

We do not sell your personal information. We do not use your release metadata, personal data, or generated campaigns to train any AI model.

3. AI Data Processing

When you use AI-powered features (campaign generation, content creation, etc.), the following data may be sent to Anthropic's Claude API:

• Release metadata you entered (song titles, artist names, genre, release dates).
• Contextual prompts assembled by the Service to generate relevant marketing content.

This data is transmitted over encrypted HTTPS connections. Per Anthropic's API terms, data sent via the API is not used to train Anthropic's models. Rollout Heaven does not control Anthropic's data retention practices; please review Anthropic's privacy policy for details.

4. Who We Share Information With

We only disclose information to the following trusted service providers, and only as necessary for them to perform their function:

• Stripe -- payment processing and subscription management. Governed by Stripe's privacy policy.
• Anthropic (Claude API) -- AI-powered content generation as described in Section 3. Governed by Anthropic's privacy policy.
• Resend -- transactional email delivery (verification, receipts, notifications). Governed by Resend's privacy policy.
• Serper -- optional web search enrichment during campaign generation. Only non-identifying query strings are sent.
• Railway -- infrastructure hosting (compute, database, persistent storage).
• Google LLC (YouTube) -- when you connect YouTube, to create and manage live broadcasts on your own channel. Governed by Google's privacy policy.
• Meta Platforms -- when you connect Facebook, to create live videos on the Page or profile you select. Governed by Meta's privacy policy.
• TikTok (ByteDance) -- when you sign in with or connect TikTok, to verify your identity and confirm your account's eligibility to livestream. We access your basic TikTok profile (such as username, display name, avatar, and follower count) and do not post to your TikTok account without your action. Governed by TikTok's privacy policy.

We may also disclose information if required by law, subpoena, court order, or governmental request, or to protect our rights, users, or the public.

4.1 YouTube (Google API Services)

Rollout Heaven Live's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use your YouTube data solely to create and operate live broadcasts on your own channel when you start a show, to label the connected channel, and to relay live chat during your broadcast. We do not use it for advertising, we do not sell it, and we do not share it with third parties except as needed to provide this feature. By connecting YouTube you also agree to the YouTube Terms of Service. You can disconnect at any time from the studio, which revokes and deletes the stored tokens, and you can additionally revoke access through your Google Account security settings.

4.2 Facebook and Instagram (Meta)

We use the access you grant through Facebook Login for Business solely to create and end live videos on the Facebook Page or profile you select when you start a show, and to display your available broadcast destinations. Access tokens are stored in encrypted form and used only for this purpose. You can disconnect at any time from the studio, and you can additionally remove Rollout Heaven Live under Facebook Settings → Business Integrations. To request deletion of data obtained through Meta, email rolloutheaven@gmail.com.

4.3 TikTok

Rollout Heaven Live's use of information received from TikTok adheres to TikTok's Developer Terms and to the Login Kit permissions you authorize. When you sign in with or connect TikTok, we access your basic TikTok profile (such as username, display name, avatar, and follower count) solely to verify your identity and confirm your account's eligibility to livestream. We do not post to your TikTok account without your action, we do not use this data for advertising, we do not sell it, and we do not share it with third parties except as needed to provide this feature. You can disconnect at any time from the studio, which revokes and deletes any stored tokens, and you can additionally revoke access in your TikTok settings under Settings and privacy, Security and permissions, Manage app permissions. Governed by TikTok's privacy policy.

4.4 Host Artists (Rollout Heaven Live)

When you engage with a host artist's show — signing up for their fan list, submitting a song, chatting, gifting, or supporting them — the information you provide (your name, chat display name, email, phone number if given, and your engagement history with that show) is shared with that host artist. The fan relationship belongs to the host: they may contact you directly about their shows and music, and if you gave marketing consent, they (or we, on their behalf) may send you marketing texts or emails until you opt out. Hosts are required to honor opt-outs and to use fan data lawfully, but they are independent artists — if you want a specific host to stop contacting you or to delete your information, use the opt-out in their message (reply STOP / unsubscribe) or email us and we will process it. We do not share your data with hosts whose shows you have not engaged with, and we never sell fan data.

5. Live Streams, Chat & Broadcasts Are Public

Live shows are public broadcasts. Anything that appears on a broadcast is visible to everyone watching, on Rollout Heaven and on any platform the show is simulcast to (including YouTube and Facebook).

• Chat is public and may appear on the broadcast itself. Your chat display name and messages can be shown on screen as part of the show, and gift and submission shout-outs may display the name you provided.
• Broadcasts are recorded. Shows — including on-screen chat, guest appearances, and reviewed songs — are recorded and may persist as replays and clips on third-party platforms. Once content has been distributed to a third-party platform or captured by viewers, we cannot retract it; we will make reasonable efforts to honor removal requests for content under our direct control.
• Guests appear on camera. Joining a broadcast as a guest transmits your camera, microphone, name, and likeness into the live show and its recordings.

Use a chat display name you are comfortable broadcasting, and do not share personal information (yours or anyone else's) in chat.

6. How Disclosure Happens

All disclosures occur programmatically over encrypted HTTPS/TLS connections at the moment a feature requires them. For example, your card details are sent directly from your browser to Stripe via Stripe's hosted checkout, and your release context is sent to Anthropic only when you initiate content generation. No human at Rollout Heaven accesses your data in the normal course of operating the Service.

7. Security Practices

• All traffic is served over HTTPS/TLS.
• Passwords are hashed with bcrypt (cost factor 10) before storage; plaintext is never written to disk or logs.
• Session cookies are httpOnly, secure in production, and sameSite=lax. Sessions are stored server-side in an encrypted database, not in client-side cookies.
• The application database is on a private infrastructure volume that is not publicly reachable.
• API keys for third-party providers are held in server environment variables and never exposed to the browser.
• Sensitive onboarding credentials are encrypted at rest using AES-256-GCM with authenticated encryption.
• CSRF protection via origin/referer header validation on all state-changing requests.
• Rate limiting on authentication endpoints to prevent brute-force attacks.
• Access to the production environment is limited to the site operator.

8. Data Retention

• Your data is retained for as long as your account is active.
• Fan profiles, submissions, and marketing-consent records are retained while you remain on a host's fan list. Opting out of marketing stops messages immediately; consent and opt-out records are kept as proof of compliance. You may request full deletion of your fan data at any time.
• On account deletion, we remove your account record, saved releases, generated campaigns, sessions, and gamification data within 30 days.
• Stripe records may be retained by Stripe for legal and tax purposes per their retention policies.
• OAuth tokens for connected social accounts (YouTube, Facebook) are stored encrypted and are deleted immediately when you disconnect the account or delete your account.
• Server logs are retained for up to 90 days for debugging and abuse prevention, then purged.
• Backup copies may persist for up to 30 days after deletion before being purged from backup systems.

9. Your Rights

9.1 All Users

You may request access to, correction of, or deletion of your personal data at any time by emailing rolloutheaven@gmail.com. We will respond within 30 days.

9.2 California Residents (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know. You have the right to request information about the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, our purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete. You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale. We do not sell your personal information. If this changes, we will provide a "Do Not Sell My Personal Information" link.
• Right to Non-Discrimination. We will not discriminate against you for exercising your privacy rights.
• Right to Correct. You have the right to request that we correct inaccurate personal information.

To exercise these rights, contact rolloutheaven@gmail.com. We may need to verify your identity before processing your request. We will respond within 45 days, with one 45-day extension if needed.

9.3 European Economic Area, UK, and International Users

If you are located in the EEA, UK, or another jurisdiction with applicable data protection laws, you may have additional rights including the right to access, rectification, erasure, restriction of processing, data portability, and objection. To exercise these rights, contact us at the email above.

10. Cookies

• Session cookie. One strictly necessary cookie used to keep you logged in. This cookie is httpOnly, secure, and sameSite=lax. It does not track you across websites.
• Stripe. Stripe may set cookies as part of the checkout process for fraud prevention and payment processing.
• We do not use advertising, analytics, or cross-site tracking cookies.
• We do not use browser fingerprinting or persistent tracking technologies.

11. Text Messages (SMS)

We send marketing text messages only to fans who gave express written consent by checking an unchecked consent box (the exact consent language and a timestamp are stored as proof). Consent is never a condition of purchase. Message and data rates may apply, message frequency varies, and you can opt out at any time by replying STOP to any message. Phone numbers that opt out or become unreachable are suppressed from future sends. We do not sell or share phone numbers for others' marketing.

12. CAN-SPAM Compliance

Transactional emails sent by Rollout Heaven (verification, receipts, password resets) comply with CAN-SPAM requirements. If you use Rollout Heaven's tools to create email campaigns, you are the sender under CAN-SPAM and are responsible for including a valid physical mailing address, a working unsubscribe mechanism, and honest subject lines.

13. Children

Rollout Heaven platform accounts, hosting, and all purchases are limited to users 18 and older. Interactive fan features on Rollout Heaven Live (fan profiles, chat, song submissions) require users to be at least 13, and users under 18 may use them only with a parent or guardian's permission. The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that a child under 13 has provided personal information, we will promptly delete it. Parents or guardians may contact us at the email below to review or delete a minor's information.

14. Changes to This Policy

We may update this policy from time to time. Material changes will be announced in-app or by email at least 30 days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

15. Contact

Questions, data requests, or privacy concerns: rolloutheaven@gmail.com