Privacy Policy

Last updated: October 21, 2026 · Version: privacy-2026-09-28.v1

This policy explains how 4Labs Digital, Inc. ("4Labs Music", "we", "us") collects, uses and shares personal information when you use 4labsmusic.net, our forms, our emails and our services. 4Labs Digital, Inc., 805 Lake St, #209, Oak Park, IL 60301, United States, is responsible for your personal information.

1. Information we collect

Information you give us.

• Contact and "get started" forms: your name, email address, phone number (if you give it), the services and budget you choose, your genre, the regions you want to target (if you choose any), your song or project details, and anything else you type into the form.
• Our quiz: your email address, your name (if you give it), and your answers about your music, goals and budget.
• Playlist Fit Check: your email address, the Spotify track link you submit, your genre and budget choices, your goal, what you already have ready (for example a released song, a music video or social content), your career stage, the regions you want to target (if you choose any), and details we look up about that track from Spotify. If you add a recommended package to your cart, we attach your track link and any regions you chose to that order.
• Orders: your name, email address, billing details and order details, including the artist name, track and campaign details we need to deliver what you bought, and how the order was placed (for example the payment method, such as card, Apple Pay, Google Pay or PayPal, and whether you used our standard or express checkout).
• Payments: card and wallet payments are handled by our payment providers: WooPayments (processed by Stripe), including Apple Pay, Google Pay and WooPay, and PayPal, including Venmo and Pay Later. We never receive or store your full card number or security code. Our payment providers may send us, and we may keep with your order or with a card you choose to save, limited card details such as the card brand, the last four digits and the expiry date. If you save a card, the card itself is held by our payment provider; we keep only a reference to it. If you use WooPay, you also have an account with WooPay, which is run by Automattic (the company behind WooCommerce).

Information collected automatically.

• Always, because the site cannot work or stay secure without it:
  • your IP address, browser/user-agent, pages requested and the time, in our servers' and hosting providers' logs;
  • short-lived security data, such as the rate limits that stop abuse of our forms;
  • the cookies that run the cart and checkout;
  • fraud-prevention cookies and scripts from our payment providers (Stripe and PayPal) on product, cart and checkout pages;
  • cookies that remember your privacy choices, including whether Statistics was switched on by default or by you (fl_stats_default), and whether your device's time zone is in a region where Statistics is on by default (fl_stats_region), whether Marketing was switched on by default or by you (fl_mkt_default), whether your device's time zone is in a region where Marketing is on by default (fl_mkt_region), and a random ID for your privacy-choice record (fl_consent_id);
  • your IP address and browser details, which reach the third-party servers that deliver fonts and some images on our pages (for example, Google Fonts).
• Statistics (on by default, except in the regions listed in section 4, where it is off until you switch it on; you can turn it off at any time): how you use the site (pages viewed, clicks, where you came from, campaign parameters such as utm_source), collected with analytics cookies and similar technology. This includes session recordings of how pages are used, and analytics events our servers send about quiz submissions, purchases and our reminder emails, and product analytics about our checkout that our payment provider WooPayments (Automattic) receives (see sections 3 and 4). Statistics is off if you turn it off, if you chose "Deny" earlier, if your device is set to a time zone in one of the regions listed in section 4 or its time zone is hidden or set to UTC (until you switch Statistics on yourself), or if your browser sends a Global Privacy Control signal (unless you switched Statistics on yourself).
• Where your order came from. While Statistics is on, we keep with your order a coarse record of where your visit came from: the kind of channel (for example email, paid search, organic search, social or direct), the page you first landed on (the path only, without its query string), the referring website's domain, and the campaign labels in the link you followed (utm_source, utm_medium, utm_campaign), and the hour of your first visit. We do not keep ad-click identifiers, your IP address or device identifiers in this record.
• Marketing (on by default, except in the regions listed in section 4, where it is off until you allow it; you can turn it off at any time): advertising cookies and identifiers from Google and Meta, and the advertising measurement described in section 3. If Marketing is off for you, Google's and Meta's advertising tags are not loaded.

2. How we use your information, and our legal bases

The legal-basis column applies to visitors in the UK, the European Economic Area and Switzerland. Where a row also names a basis for other regions, that basis applies there.

3. Who we share information with

We do not sell your personal information for money. However, while Marketing is on, the advertising sharing described below may count as "selling" or "sharing" personal information, or as "targeted advertising", under some US state privacy laws. We treat it that way. Outside the regions listed in section 4, Marketing is on by default. You can opt out at any time: turn Marketing off with the "Your privacy choices" link at the bottom of every page, or email us (section 6). If your browser sends a Global Privacy Control signal, we treat it as a request to opt out: Marketing is turned off for you, even if you allowed it before, for as long as your browser sends the signal.

Service providers who process information for us, under our instructions.

Hosting and delivery:

• HostGo (website hosting);
• Vercel (application hosting);
• QUIC.cloud (content delivery network for our website, when it is active);
• Supabase (database).

Running the business:

• monday.com (our customer, lead, order and supplier records; it receives the details you submit in our forms);
• Resend (automated email, such as follow-up, reminder and receipt emails, and messages sent to our contact address; Resend delivers email using Amazon Web Services);
• Google Workspace (our team email, and appointment booking if you book a call through our booking link);
• Slack (internal team notifications; failure alerts carry a reference ID only, never lead details);
• ManyChat (messaging on Instagram and Messenger, if you contact us there);
• Anthropic (an AI service that reads our suppliers' invoices for us; these invoices can include your artist name and song title);
• our promotion partners, such as playlist curators and other suppliers who deliver the campaigns you buy (they receive the artist, track and campaign details needed to do that work);
• Complianz (our consent tool, which records your privacy choice).

We also use Spotify's public data service to look up the details of the track you submit to Playlist Fit Check.

Payments:

• WooPayments (by Automattic/WooCommerce), processed by Stripe, including Apple Pay, Google Pay and WooPay. Stripe also uses payment information as an independent controller for its own purposes, such as fraud prevention and legal compliance.
• PayPal (including Venmo and Pay Later). PayPal is an independent controller of the payment information it processes, not a joint controller with us; see PayPal's privacy statement on paypal.com.

Analytics (Statistics: on unless you turn it off or your browser sends Global Privacy Control; in the regions listed in section 4, off until you switch it on):

• PostHog (product analytics and session recordings). Our servers also send PostHog events when you submit the quiz or complete a purchase; purchase events may be linked to your email address.
• Google Analytics. Our servers may also send Google Analytics events about purchases and about our reminder emails (for example, that a reminder was sent or that you clicked a link in it). Purchase events can include a one-way hashed (SHA-256) copy of your email address, phone number and name. Reminder-email events use an identifier derived from your email address.
• WooPayments product analytics ("Tracks", run by Automattic, the company behind WooCommerce and WooPayments). When you view our product, cart, checkout or order-confirmation pages, or place an order paid with WooPayments, our server may send Automattic an event describing it (for example "cart page viewed" or "order placed", and the payment method name for WooPayments orders), together with your browser type and language setting, identifiers of our store, and a random anonymous ID that is also kept in a cookie (tk_ai) until you close your browser. It does not include your name or email address.

Our website's tag manager, Pixel Manager for WooCommerce (a plugin that runs on our own website), loads the Google and Meta tools described here and follows your Statistics and Marketing choices.

Advertising partners, while Marketing is on.

• Google (Google Ads).
  • Google's advertising tags on our pages measure whether our ads work, and let Google show our ads to you on other sites and apps (remarketing), including ads for products you viewed (dynamic remarketing).
  • If you submit our quiz or Playlist Fit Check after clicking one of our Google ads, we send Google a one-way hashed (SHA-256) copy of your email address, together with Google's ad-click identifier, so Google can tell us the ad led to your request.
  • Our tag manager is also set up to use Google's "enhanced conversions", which sends Google one-way hashed copies of contact details you give us at checkout, so Google can match a purchase to an ad.
  • Your Marketing choice controls both of Google's consent signals: using your data for advertising (ad_user_data), and personalised advertising (ad_personalization). One switch controls both: while Marketing is on, both are on; when it is off, both are off.
• Meta (Facebook and Instagram).
  • Meta's pixel on our pages measures our ads and lets Meta show our ads to you (remarketing).
  • When you submit one of our forms (the contact form, "get started", the quiz or Playlist Fit Check), or start or complete a checkout, our servers also send Meta an event describing that action. Such an event can include:
    • one-way hashed copies of your email address, phone number and name;
    • your IP address and browser/user-agent;
    • Meta's click and browser identifiers;
    • a hashed identifier we create;
    • the page and campaign it came from.
  • Our tag manager is also set up to send Meta its own server-side events about shopping and checkout activity, with "advanced matching", which can add one-way hashed copies of contact details you have given us, such as your email address, phone number and name.

We send all of the above only while Marketing is on for you under the current version of this policy: after you allow it in the regions listed in section 4, or by default elsewhere unless you turned Marketing off or your browser sends Global Privacy Control.

We do not currently upload customer lists to Google or Meta to build advertising audiences. If we start, we will update this policy first.

Google's and Meta's own use of this information is described at https://policies.google.com/privacy and https://www.facebook.com/privacy/policy.

Used only in some cases.

• Trustpilot. Where review invitations are enabled for your order, we send Trustpilot your name, email address and order details so it can invite you to review us.
• Our previous checkout. Some orders were placed through our previous checkout, which used Stripe directly. For those orders, Stripe holds the payment records, and our systems may still receive updates about them from Stripe.
• Older pages. A few older order and payment-confirmation pages on api.4labsmusic.net, left from our previous checkout, can use Google Tag Manager, the Meta pixel and Vercel Web Analytics. They do so only with the same Statistics and Marketing choices described in section 4.

Others. We share information when the law requires it, to protect our rights or users' safety, or as part of a sale or reorganisation of our business.

4. Cookies, session recordings and your choices

When you first visit, our privacy banner lets you choose. Statistics is switched on by default and you can switch it off there, or at any time later, except in these regions: if your device is set to a time zone in Europe (this includes the time zones of the United Kingdom, Switzerland, Turkey, Ukraine and western Russia), a place outside Europe's time zones that is part of the EU or EEA (Cyprus, Iceland, the Canary Islands, the Azores, Madeira, Ceuta, Jan Mayen, Guadeloupe, Martinique, French Guiana, Reunion, Mayotte and Saint-Martin), Svalbard, the America/Toronto time zone (most of Quebec and Ontario) or Blanc-Sablon, South Korea, or mainland China (not Hong Kong or Macau), Statistics stays off until you switch it on. We work out the region only from the time zone setting of your device, in your browser; we do not use your IP address or your location for this. If your device's time zone is hidden, or it is set to UTC, GMT or another time zone that does not name a place (as privacy-focused browsers often report it), we treat you as being in one of these regions, so Statistics stays off until you switch it on. If your browser does not report a time zone at all, or reports one that is not a recognised time zone name, Statistics is on by default, as it is everywhere else, and you can switch it off at any time. Marketing follows the same regions. In the regions listed above, and if your time zone is hidden or set to UTC, GMT or another time zone that does not name a place, Marketing stays off until you allow it, and nothing is used for Marketing before you choose. Everywhere else, including when your browser does not report a recognised time zone at all, Marketing is on by default and you can turn it off at any time; if your browser sends a Global Privacy Control signal, Marketing is not switched on by default.

Attribution cookies. Our first-party attribution cookies and WooCommerce order attribution record where you came from, for example the campaign or ad-click reference in the link you followed. We never pass ad-click identifiers from them to Google or Meta unless you have allowed Marketing.

How we record where an order came from. While Statistics is on, we attach a short, general note to your order describing how you reached our site during that visit. The note contains only: the general type of visit (for example email, paid social, organic search, a Google Shopping free listing, a referral from another website, or a direct visit); the address of the first page you visited, without any tracking parameters; the name of the website that sent you, without the page address (for example "instagram.com"); the campaign labels in the link you followed (utm source, medium and campaign), where present; and the hour of your first visit. It contains no advertising click IDs, no IP address, no device or browser details and no identifier that could follow you across websites or visits, and no cookie is set to create it. While you browse, your browser keeps the note in its session storage for that tab only, and it is deleted when you close the tab. If you have items in your cart, a copy may also sit in the shopping-cart session our store already uses. If Statistics is off, or you turn it off, no note is recorded. Section 2 gives the legal basis and section 5 how long we keep it.

Session recordings. While Statistics is on, PostHog records how you move through our pages (clicks, scrolling and the page content you see), together with technical data such as page performance and browser error messages, so we can find problems. What you type into form fields is masked, and page text that contains personal information is masked, so it is not included in recordings. PostHog is set to discard your IP address. Recordings are kept for 30 days and then deleted (deletion by PostHog can take a short time after that).

Browser privacy signals. If your browser sends a Global Privacy Control signal, neither Statistics nor Marketing is switched on by default, and we treat the signal as a request to opt out of the sale or sharing of your personal information and of targeted advertising. Marketing is therefore turned off for you, even if you allowed it before, for as long as your browser sends the signal. If you have yourself allowed Statistics, that choice stays in place until you change it in "Your privacy choices".

Changing your mind. Use the "Your privacy choices" link at the bottom of every page, or the "Manage consent" button in the corner of the screen, at any time. Turning Statistics or Marketing off stops future collection straight away. It does not undo information already collected while it was on. To ask us to delete that, contact us (section 6).

You can also change your choices here:

5. How long we keep information

We keep personal information only as long as we need it for the purposes in section 2, or as long as the law requires. Where we give a target period below, it is the longest we intend to keep that information; we delete or anonymise it when it is no longer needed.

• Enquiries and leads that did not become orders: kept while we are in contact with you, with a target of deleting them no later than 24 months after our last contact.
• Customers and orders: kept as long as tax and accounting laws require, which is generally up to 7 years.
• Where your order came from and how it was placed: the coarse order-source record, first-party attribution data and payment method are kept with the order record, for as long as we keep that order (generally up to 7 years).
• First-party attribution cookies on your device: up to 12 months (_4l_ft) and 90 days (_4l_attr), or until you turn Statistics off.
• Marketing email: until you unsubscribe. After that, we stop sending and keep your email address on a do-not-contact list so we do not email you again.
• Consent records: kept as long as we need to show what you agreed to, with a target of no longer than 5 years. When you tick the box to receive our marketing emails on our contact or "get started" form, the record of that consent includes the time, your IP address and the version of the consent wording you saw.
• Analytics:
  • PostHog session recordings: 30 days.
  • PostHog analytics events: PostHog keeps these for up to 7 years, depending on our PostHog plan.
  • Google Analytics: detailed (user- and event-level) data is deleted automatically at the end of the retention period set in our Google Analytics account. Aggregated reports may be kept longer.
• Server and security logs:
  • our application host's (Vercel) request logs: about 1 day;
  • our database provider's (Supabase) platform logs: 7 days;
  • our website host's server logs and backups: only as long as needed to keep the site secure and fix problems, after which they are deleted or overwritten.

6. Your rights

Depending on where you live, you may have the right to:

• access, correct or delete your personal information;
• object to or restrict how we use it;
• receive a copy of it;
• withdraw consent at any time (this does not affect what we did before);
• opt out of the sale or sharing of personal information, or of targeted advertising (use the "Your privacy choices" link, or turn on Global Privacy Control in your browser);
• complain to your data-protection authority.

To use any of these rights, email contact@4labsmusic.net, or write to us at 4Labs Digital, Inc., 805 Lake St, #209, Oak Park, IL 60301, United States. We may need to confirm your identity first. You can also ask someone to act for you (an authorised agent); we may ask for proof that you gave them permission, and may still need to confirm your identity with you directly. We will reply within the time the law requires.

7. Children

Our site and services are not directed to children, and we do not knowingly collect personal information from anyone under 16. If you are under 16, please do not send us your details or buy from us without a parent or guardian. If we learn that we have collected personal information from someone under 16 without a parent's or guardian's consent, we will delete it, except for any order records the law requires us to keep. If you believe a child has given us information, contact us (section 12).

8. International transfers

We are based in the United States, and our providers mainly process information there. If you are outside the US, your information is transferred to and processed in the US, and some providers may process it in other countries.

Where the law requires a safeguard for these transfers, we rely on appropriate safeguards such as:

• the EU-US Data Privacy Framework, and where they apply its UK Extension and the Swiss-US Data Privacy Framework, for providers certified under them. When we checked the official Data Privacy Framework List, Google, PostHog, Vercel, Stripe, monday.com, Slack (Salesforce) and ManyChat were listed under all three frameworks; Meta was listed under the EU-US and Swiss-US frameworks; and Resend was listed under the EU-US framework and the UK Extension;
• the European Commission's Standard Contractual Clauses, with the UK and Swiss additions where they apply, which are included in providers' data-processing terms (for example, Supabase's), and PayPal's Binding Corporate Rules and contractual clauses.

9. Representatives

We have not appointed a representative in the European Union or the United Kingdom. If we appoint one, we will add their contact details here. Wherever you are, you can contact us directly using the details in section 12.

10. Security

We use reasonable technical and organisational measures to protect personal information. No method of sending or storing information online is completely secure.

11. Changes

If we change this policy, we will post the updated version here with a new "Last updated" date. If a change affects how we use your information for Marketing, we will ask for your Marketing consent again.

12. Contact

4Labs Digital, Inc., 805 Lake St, #209, Oak Park, IL 60301, United States · contact@4labsmusic.net