Privacy Policy

Rollout Heaven LLC ("Rollout Heaven," "we," "us," the "Service") operates a marketing command center for independent musicians, and includes Rollout Heaven Live, a live streaming platform where creators broadcast shows in several formats (music reviews, Bible study, engineer and producer sessions, barber shop and gaming) and fans can watch, chat, submit songs, buy from the Live Shop, and support creators. This policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data. By using the Service you agree to the practices described below.

1. Information We Collect

1.1 Information You Provide

• Account information. Email address and a one-way hashed (bcrypt) password when you register. We never store plaintext passwords.
• Release metadata. Song titles, artist names, release dates, ISRC/UPC/ISWC codes, songwriter and publisher details, PRO information, cover art, streaming links, and any other material you choose to add to the Release Intake form.
• Generated content. Hooks, captions, marketing calendars, outreach templates, press releases, email campaigns, and other material produced by the AI generation pipeline on your behalf.
• Support communications. Emails, support tickets, and any other correspondence you send to us.
• Rollout Heaven Live creator applications. If you claim a creator page: your name, email address, artist name, an optional link and note, the show format you chose, the plan you picked, a referral code if you arrived on one, and the studio PIN you set (stored one way hashed). After checkout we keep your Stripe customer and subscription ids. When you sign the Studio Confidentiality Agreement we keep the signed agreement: your legal name, the details you entered, an audit record of the signing, and the PDF. When you accept the Rollout Live Community Standards Agreement we keep the name you typed, the version, the time, your IP address and your browser, as the record of your acceptance. We also keep the state of your subscription (active, payment failed, ended, removed) and a log of the account emails we sent you, so none is sent twice.
• Rollout Radio Listeners. If you create a Listener account at rolloutheaven.com/play: your name, email address, and a one way hashed (bcrypt) password; the songs you play, the artists you follow, your artist subscriptions, the songs you buy, and the playlists you unlock. Radio Artists see play counts, subscriber counts, and earnings for their own music. They do not see your email address.
• Rollout Radio Artists. If you create a Radio Artist account: your artist name, email address, hashed password, music category, and page address; the audio, artwork, release details, and credits you upload; and the email address of any collaborator you add to a song split. We email that collaborator the song details and how to get paid. Card details for your plan, and the identity and bank details Stripe needs to send your payouts, are collected by Stripe. We do not store them.

1.2 Information Collected Automatically

• Session data. A secure HTTP-only session cookie and a corresponding server-side session record used solely to keep you logged in.
• Technical logs. Standard web server logs (IP address, user-agent, request path, timestamp) retained for operational, debugging, and abuse-prevention purposes.
• Gamification data. XP, level, achievements, and action counters tied to your account.
• Playback quality data. On creator pages where the low latency player is switched on, the player sends technical samples while you watch (buffer lag, stalls, player type, picture size, and a device class such as phone or desktop) tagged with a random id for that browser tab. No name, email, account id or IP address is stored with them, and they are kept for up to 90 days.

1.3 Information From Third Parties

• Payment information. When you subscribe, Stripe collects and stores your payment details directly. We never see or store your card number, CVC, or full bank account information. We receive and store only a Stripe customer ID, subscription status, tier, and billing period end date.

1.4 Rollout Heaven Live: Fan Information

When you interact with a host artist's live show as a fan, we collect what you provide:

• Fan profile. First name, chat display name, email address, and optionally a phone number. If you set a PIN for your fan profile, it is stored one-way hashed (bcrypt), never in plaintext.
• Song submissions. The song or video link, title, artist name, and any context you include, plus the submission's queue and review status.
• Chat messages. Messages you send in a show's live chat, with your chat display name.
• Support payments. Records of paid submissions, gifts, donations, and monthly support (amount, timestamp, optional message). Card details go directly to Stripe (see Section 1.3).
• Marketing consent records. If you check the box to receive marketing texts and/or emails, we store the fact of your consent, the exact consent text you agreed to, and a timestamp, as required by law. Consent is never a condition of purchase, and you can withdraw it at any time (reply STOP to any text, use the unsubscribe link in any email, or email us).
• Guest broadcasts. If you join a show as an on-camera guest, your camera and microphone feed is transmitted into the host's live broadcast. We do not retain a separate copy of your raw camera feed; it becomes part of the broadcast and its recordings (see Section 5).
• Auction bids. Your chat display name and bid amounts are shown to everyone watching and on the broadcast, and the auction result (winner name and price) is kept. If you win, the name and email you give at checkout are used to deliver the beat and its license.
• Live Shop orders. Your name (your legal name for a beat, since the license is issued to it), email, the song or material you send with the order, the license issued to you, and the delivery and download record.
• Service bookings. For an engineer booking: your stems, reference audio and notes, and the finished files the Host delivers. Delivered files are removed 30 days after delivery, or sooner once you confirm you have saved them. For a barber chair booking: your name, email, the service, the day and start time, an optional note, and the shop's status notes (in chair, done, no show). A reminder email goes out the day before.
• Prayer requests and questions. On a Bible study page, the name and text you send go privately to the Host's studio and may be shown on the broadcast if the Host features them.
• Playlist placement orders. Artist name, email, song title, link, an Instagram handle if you give one, the tier you bought and the position assigned.
• Creator memberships. On a Godly Gaming page: the tier you chose, your membership status and paid through date. Card details stay with Stripe.

1.5 Social Media Account Connections (Optional)

Rollout Heaven Live lets you optionally connect your own social accounts so that a live show can be simulcast to those destinations. Connecting is entirely optional and only happens when you initiate it. When you connect an account, we receive and store the following from the provider:

• YouTube (via Google). Your channel's basic identifying information (channel ID and name) and an OAuth access token and refresh token authorizing us to create and manage live broadcasts on your own channel. Requested scope: https://www.googleapis.com/auth/youtube.
• Facebook and Instagram (via Meta). Your Facebook public profile, the list of Pages you manage, and access tokens authorizing us to create live videos on the Page or profile you select. Requested permissions: public_profile, pages_show_list, pages_read_engagement, pages_manage_posts, pages_manage_metadata, pages_read_user_content, and publish_video.
• Other destinations (Twitch, Kick, TikTok and custom RTMP). If you add a destination by pasting a stream key, we store that key encrypted and use it only to push your broadcast there while you are live. Where a platform offers it, we relay its public chat for your channel into your studio during your show.

1.6 Comments on Rollout Heaven's Own Instagram Posts

When you comment the keyword shown in one of Rollout Heaven's own Instagram posts, Meta sends us your Instagram username, your Instagram user id and the text of your comment. We reply once by direct message with the link the post promised, and if you answer, one automatic follow up may go out before a person takes over. Your replies are emailed to our inbox. We keep the list of people who commented and the message log so nobody is messaged twice, and we use it for nothing else. This runs only on our own posts and only for the keyword. To be removed, email rolloutheaven@gmail.com.

2. How We Use Your Information

• To operate the Service: authenticate you, render your saved releases, generate campaigns on request, and track your progress.
• To operate Rollout Heaven Live: run the submission queue, notify you when your song is about to be reviewed, display chat, process gifts and support, and share your fan information with the host artist you engaged with (Section 4.3).
• To run auctions, the Live Shop, service bookings and creator memberships: take bids, deliver files and licenses, send booking reminders, and pay Hosts their share.
• To process subscription payments, issue receipts, and manage your plan and billing, including opening Stripe's billing page when you press Manage subscription in your studio.
• To send Rollout Live creators account messages about their subscription and page, based on where their setup stands: whether they finished checkout, signed their agreement, set up payouts and went live, plus a monthly recap counted from their shows, paid submissions and new fans, payment problems, a notice before a yearly renewal, and notes after a subscription ends. Reply to any of them to stop the optional ones.
• To send transactional emails you have explicitly requested (verification links, password resets, subscription receipts, queue notifications), and, only with your separate express consent, marketing texts and/or emails, which you can stop at any time (reply STOP, use the unsubscribe link, or email us).
• To debug issues, monitor Service health, and prevent abuse of AI generation endpoints.
• To comply with legal obligations, enforce our Terms, and respond to lawful requests.

We do not sell your personal information. We do not use your release metadata, personal data, or generated campaigns to train any AI model.

3. AI Data Processing

When you use AI-powered features (campaign generation, content creation, etc.), the following data may be sent to Anthropic's Claude API:

• Release metadata you entered (song titles, artist names, genre, release dates).
• Contextual prompts assembled by the Service to generate relevant marketing content.
• If you use lyric transcription in Release Intake, the audio of the song you upload is sent to Groq, which turns the vocals into text. That text may then be sent to Anthropic to format the lyrics.

This data is transmitted over encrypted HTTPS connections. Per Anthropic's API terms, data sent via the API is not used to train Anthropic's models. Rollout Heaven does not control Anthropic's data retention practices; please review Anthropic's privacy policy for details.

4. Who We Share Information With

We only disclose information to the following trusted service providers, and only as necessary for them to perform their function:

• Stripe: payment processing and subscription management. Governed by Stripe's privacy policy.
• Anthropic (Claude API): AI-powered content generation as described in Section 3. Governed by Anthropic's privacy policy.
• Groq: speech to text for the lyric transcription feature described in Section 3. It receives the song audio you upload for transcription. Governed by Groq's privacy policy.
• Resend: transactional email delivery (verification, receipts, notifications). Governed by Resend's privacy policy.
• Serper: optional web search enrichment during campaign generation. Only non-identifying query strings are sent.
• Railway: infrastructure hosting (compute, database, persistent storage).
• Our live video delivery provider: carries Rollout Heaven Live broadcasts from the Host's studio to viewers. It receives the broadcast itself and, like any website you load, each viewer's IP address and basic device information so it can deliver the video.
• Google Fonts: many of our pages load their typefaces from Google's font servers (fonts.googleapis.com and fonts.gstatic.com), so your browser sends Google your IP address and the page address when it fetches them. Governed by Google's privacy policy.
• Restream: when a Host connects a Restream account, to read the streaming event the Host prepared there and send the broadcast to it (for example to reach TikTok). The connection details stay on our server. Governed by Restream's privacy policy.
• Google LLC (YouTube): when you connect YouTube, to create and manage live broadcasts on your own channel. Governed by Google's privacy policy.
• Meta Platforms: when you connect Facebook, to create live videos on the Page or profile you select. Governed by Meta's privacy policy.
• Meta Platforms (advertising measurement): on the Genjutsu pages only, the Meta Pixel described in Section 10 sends page view and checkout events to Meta so we can measure our own ads. Governed by Meta's privacy policy.
• GIPHY: when a fan opens the GIF picker in a Rollout Heaven Live chat, the search runs through our server, but the GIF images themselves load into the fan's browser from GIPHY's servers, which means GIPHY receives the requesting IP address and browser details the way any image host does. Governed by GIPHY's privacy policy.
• TikTok (ByteDance): when you sign in with or connect TikTok, to verify your identity and confirm your account's eligibility to livestream. We access your basic TikTok profile (such as username, display name, avatar, and follower count) and do not post to your TikTok account without your action. Governed by TikTok's privacy policy.
• Meta Platforms (Instagram messaging): for the comment replies described in Section 1.6, through the Instagram API with Instagram Login. Governed by Meta's privacy policy.
• Twitch, Kick and other stream destinations you connect: to push your broadcast there and, where offered, relay the channel's public chat into your studio. Governed by that platform's privacy policy.
• Bible text services (bolls.life and bible-api.com): when a Host prepares a scripture passage in the studio, our server fetches the passage text from one of these sites. Only the book, chapter and verse numbers are sent, never any personal data.

We may also disclose information if required by law, subpoena, court order, or governmental request, or to protect our rights, users, or the public.

4.1 YouTube (Google API Services)

Rollout Heaven Live's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use your YouTube data solely to create and operate live broadcasts on your own channel when you start a show, to label the connected channel, and to relay live chat during your broadcast. We do not use it for advertising, we do not sell it, and we do not share it with third parties except as needed to provide this feature. By connecting YouTube you also agree to the YouTube Terms of Service. You can disconnect at any time from the studio, which revokes and deletes the stored tokens, and you can additionally revoke access through your Google Account security settings.

4.2 Facebook and Instagram (Meta)

We use the access you grant through Facebook Login for Business solely to create and end live videos on the Facebook Page or profile you select when you start a show, and to display your available broadcast destinations. Access tokens are stored in encrypted form and used only for this purpose. You can disconnect at any time from the studio, and you can additionally remove Rollout Heaven Live under Facebook Settings → Business Integrations. To request deletion of data obtained through Meta, email rolloutheaven@gmail.com.

4.3 TikTok

Rollout Heaven Live's use of information received from TikTok adheres to TikTok's Developer Terms and to the Login Kit permissions you authorize. When you sign in with or connect TikTok, we access your basic TikTok profile (such as username, display name, avatar, and follower count) solely to verify your identity and confirm your account's eligibility to livestream. We do not post to your TikTok account without your action, we do not use this data for advertising, we do not sell it, and we do not share it with third parties except as needed to provide this feature. You can disconnect at any time from the studio, which revokes and deletes any stored tokens, and you can additionally revoke access in your TikTok settings under Settings and privacy, Security and permissions, Manage app permissions. Governed by TikTok's privacy policy.

4.4 Host Artists (Rollout Heaven Live)

When you engage with a host artist's show, whether signing up for their fan list, submitting a song, chatting, gifting, buying, bidding, booking, or supporting them, the information you provide (your name, chat display name, email, phone number if given, and your engagement history with that show) is held by Rollout Heaven, which operates every Rollout Live page, and is shared with that host artist. Rollout Heaven and the host may each contact you about your submissions, purchases and the host's shows, and if you gave marketing consent, the host (or we, on their behalf) may send you marketing texts or emails until you opt out. If a show you paid for cannot happen because the host's page is paused or removed, we email you about a refund and may tell you about other creators on Rollout Live you can send your music to. Your information stays with Rollout Heaven if the host leaves, and a departing host may receive an export of their fan list. Hosts are required to honor opt-outs and to use fan data lawfully, but they are independent artists. If you want a specific host to stop contacting you or to delete your information, use the opt-out in their message (reply STOP / unsubscribe) or email us and we will process it. We do not share your data with hosts whose shows you have not engaged with, and we never sell fan data.

5. Live Streams, Chat & Broadcasts Are Public

Live shows are public broadcasts. Anything that appears on a broadcast is visible to everyone watching, on Rollout Heaven and on any platform the show is simulcast to (including YouTube and Facebook).

• Chat is public and may appear on the broadcast itself. Your chat display name and messages can be shown on screen as part of the show, and gift and submission shout-outs may display the name you provided.
• Broadcasts are recorded. Shows, including on screen chat, guest appearances, and reviewed songs, are recorded and may persist as replays and clips on third-party platforms. Once content has been distributed to a third-party platform or captured by viewers, we cannot retract it; we will make reasonable efforts to honor removal requests for content under our direct control.
• Guests appear on camera. Joining a broadcast as a guest transmits your camera, microphone, name, and likeness into the live show and its recordings.

Use a chat display name you are comfortable broadcasting, and do not share personal information (yours or anyone else's) in chat.

6. How Disclosure Happens

All disclosures occur programmatically over encrypted HTTPS/TLS connections at the moment a feature requires them. For example, your card details are sent directly from your browser to Stripe via Stripe's hosted checkout, and your release context is sent to Anthropic only when you initiate content generation. No human at Rollout Heaven accesses your data in the normal course of operating the Service.

7. Security Practices

• All traffic is served over HTTPS/TLS.
• Passwords are hashed with bcrypt (cost factor 10) before storage; plaintext is never written to disk or logs.
• Session cookies are httpOnly, secure in production, and sameSite=lax. Sessions are stored server-side in an encrypted database, not in client-side cookies.
• The application database is on a private infrastructure volume that is not publicly reachable.
• API keys for third-party providers are held in server environment variables and never exposed to the browser.
• Sensitive onboarding credentials are encrypted at rest using AES-256-GCM with authenticated encryption.
• CSRF protection via origin/referer header validation on all state-changing requests.
• Rate limiting on authentication endpoints to prevent brute-force attacks.
• Access to the production environment is limited to the site operator.

8. Data Retention

• Your data is retained for as long as your account is active.
• Fan profiles, submissions, and marketing-consent records are retained while you remain on a host's fan list. Opting out of marketing stops messages immediately; consent and opt-out records are kept as proof of compliance. You may request full deletion of your fan data at any time.
• On account deletion, we remove your account record, saved releases, generated campaigns, sessions, and gamification data within 30 days.
• Stripe records may be retained by Stripe for legal and tax purposes per their retention policies.
• OAuth tokens for connected social accounts (YouTube, Facebook) are stored encrypted and are deleted immediately when you disconnect the account or delete your account.
• Server logs are retained for up to 90 days for debugging and abuse prevention, then purged.
• Order, license, auction, booking, membership and payout records are kept for at least seven years for tax and accounting purposes.
• Files delivered for an engineer booking are removed 30 days after delivery, or sooner once you confirm you have saved them. Playback quality samples are kept for up to 90 days. Instagram comment lead records are kept until you ask us to delete them.
• Backup copies may persist for up to 30 days after deletion before being purged from backup systems.

9. Your Rights

9.1 All Users

You may request access to, correction of, or deletion of your personal data at any time by emailing rolloutheaven@gmail.com. We will respond within 30 days.

9.2 California Residents (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know. You have the right to request information about the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, our purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete. You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale. We do not sell your personal information. If this changes, we will provide a "Do Not Sell My Personal Information" link.
• Right to Non-Discrimination. We will not discriminate against you for exercising your privacy rights.
• Right to Correct. You have the right to request that we correct inaccurate personal information.

To exercise these rights, contact rolloutheaven@gmail.com. We may need to verify your identity before processing your request. We will respond within 45 days, with one 45-day extension if needed.

9.3 European Economic Area, UK, and International Users

If you are located in the EEA, UK, or another jurisdiction with applicable data protection laws, you may have additional rights including the right to access, rectification, erasure, restriction of processing, data portability, and objection. To exercise these rights, contact us at the email above.

10. Cookies and Device Storage

• Session cookie. One strictly necessary cookie used to keep you logged in. This cookie is httpOnly, secure, and sameSite=lax. It does not track you across websites.
• Stripe. Stripe may set cookies as part of the checkout process for fraud prevention and payment processing.
• Meta Pixel (Genjutsu pages only). The Genjutsu pages at rolloutheaven.com/genjutsu, including its checkout, thank you and watch pages, load the Meta Pixel, an advertising measurement tool from Meta Platforms. It sets the _fbp and _fbc cookies and sends Meta the page you viewed, the fact that you started a checkout and the price, your IP address and browser details, so we can measure ads we run on Facebook and Instagram for that product. It runs on those pages only and not on the rest of the site, and not on any Rollout Heaven Live fan page. You can limit it by blocking third party cookies in your browser, by using a content blocker, or through your ad settings at facebook.com/adpreferences. Meta's use of this data is governed by Meta's privacy policy.
• Device storage on Rollout Heaven Live fan pages. Fan pages keep a few things in your browser's local storage rather than in cookies: your chat sign in for that artist's page, the display name you chose, which reactions and follow actions you have already done, whether you unmuted the stream, and what the Winner Pot last showed. This stays on your device, is never sent to advertisers, and clearing your browser's site data removes it.
• We do not run analytics scripts, and outside the Genjutsu pages described above we do not use advertising or cross site tracking cookies.
• We do not use browser fingerprinting.
• Do Not Track and Global Privacy Control. We do not track you across other websites, and outside the Genjutsu pages we load no advertising or analytics trackers, so on the rest of the site there is nothing for these browser signals to turn off. On the Genjutsu pages the Meta Pixel loads whether or not your browser sends these signals; you can block it as described above. We do not sell your personal information or share it for cross context behavioral advertising.

11. Text Messages (SMS)

Rollout Heaven does not send marketing text messages. On a Host artist's fan page you can check an unchecked box agreeing to receive marketing texts from that artist. If you do, that artist can see your phone number and text you. If you do not, the artist does not receive your number for marketing. We store the exact consent language and the time you agreed. Consent is never a condition of purchase. Message and data rates may apply, message frequency varies, and you can opt out of an artist's texts at any time by replying STOP to any of them. Hosts must follow the texting rules in Section 11.7 of our Terms. A phone number you add to a song submission is shown to that Host only so they can reach you about that submission. We do not sell or share phone numbers for others' marketing.

12. CAN-SPAM Compliance

Transactional emails sent by Rollout Heaven (verification, receipts, password resets) comply with CAN-SPAM requirements. Marketing emails sent through Rollout Heaven, including outreach campaigns, artist go live and shop emails, and Rollout Live renewal reminders, carry a working unsubscribe link and our postal address, and an unsubscribe is honored for every future send. If you use Rollout Heaven's tools to create email campaigns, you are still responsible for honest From names and subject lines and for the content you write.

13. Children

Rollout Heaven platform accounts, hosting, and all purchases are limited to users 18 and older. Interactive fan features on Rollout Heaven Live (fan profiles, chat, song submissions) and Rollout Radio Listener accounts require users to be at least 13, and users under 18 may use them only with a parent or guardian's permission. Rollout Radio Artist accounts are limited to users 18 and older. The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that a child under 13 has provided personal information, we will promptly delete it. Parents or guardians may contact us at the email below to review or delete a minor's information.

14. Changes to This Policy

We may update this policy from time to time. Material changes will be announced in-app or by email at least 30 days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

15. Contact

Questions, data requests, or privacy concerns: rolloutheaven@gmail.com
By mail: Rollout Heaven LLC, 1021 N Audobon Dr, Marion, IN 46952