Privacy Policy

Account Information

• Name and display name
• Email address
• Username / handle and profile avatar
• Creative role and public profile details you choose to add (bio, social links)
• Authentication data (you sign in through Google; we receive your basic Google account profile, not your Google password)

Content You Upload

• Audio files and stems
• Video files
• Images, including cover art and photos
• Lyrics, credits, split-sheet details, and other documents or notes

Payment Information

• If you buy a paid plan or make a payment, our payment processor (Stripe) collects and processes your card details. We do not receive or store full card numbers; we receive limited billing and subscription status information.
• If you sell through the Service, Stripe collects the identity, bank, and tax details it needs to verify you and pay you out. We store only your Stripe account reference and the status Stripe reports back; the details themselves stay with Stripe.

Connected Services

• If you connect a social account (e.g. Instagram) or Google Calendar, we receive the tokens and data needed to provide that feature, such as basic account details, posting permissions, calendar events, and public engagement metrics.
• If you link a Spotify artist profile for stats, we store the profile reference and retrieve available public metrics for it. If you connect a Spotify listener account to enable automatic saves (for example through a pre-save page), we store the authorization tokens securely and use them only to perform the saves and follows you requested. You can revoke this connection at any time in your Spotify account settings (spotify.com/account/apps).

Fan Pre-Saves, Unlocks & Public Pages

• When you pre-save a release as a fan, we collect the email address you submit, along with any name or phone number the artist’s form requests and you choose to provide, your chosen platform, and general information about how you arrived at the page.
• This information is collected on behalf of the artist who published the page: it is used to deliver what you asked for (a release-day notification and any unlock the artist offers) and is visible to that artist. It is not used to send you unrelated marketing.
• When you unlock or buy a project, we record your account, the project, the amount you paid, and the date, and show the artist who unlocked their project and what they paid. Your email address is shared with the artist for their updates only if you tick the box agreeing to hear from them.

Usage & Device Data

• How you interact with the Service and which features you use
• Activity on your public links and pages (link clicks, views, and downloads)
• Progress data such as tasks completed and XP earned
• Device and browser information, and IP address

• Provide, operate, and maintain the RolloutXP platform
• Store, process, and display the content you upload
• Enable collaboration and sharing between users you invite
• Process payments, manage subscriptions, and administer XP and rewards
• Send service messages and notifications (including reminders for scheduled posts)
• Deliver pre-save experiences fans request: release-day notifications, artist-offered unlocks, and, where a fan explicitly connects a streaming account, the saves and follows they asked for
• Process fan purchases, pay artists out through Stripe, and keep the records needed for refunds, disputes, and tax reporting
• Understand and improve product performance
• Maintain security, prevent fraud and abuse, and comply with legal obligations

Some features use artificial intelligence to help you create content, for example generating draft split-sheet agreements, generating images, and extracting details from documents you upload. When you use these features, the content you provide is sent to an AI service provider for processing and returned to you.

AI-generated output may contain errors and is not legal, financial, or professional advice. You are responsible for reviewing any AI-generated content before you rely on or share it. Please do not submit other people’s confidential information into AI features without permission.

We do not sell your personal information for money. We share it only as described below, including the advertising measurement in Section 6, which some US state privacy laws treat as “sharing” for targeted advertising.

Service providers (subprocessors). We use trusted third parties to run the Service. They may process your data only to provide services to us:

• Base44: application hosting and database
• Amazon Web Services (S3): storage of uploaded files
• Mux: video hosting, encoding, and playback
• Stripe: payment processing
• Resend: transactional email delivery
• Google: sign-in and, if you connect it, Google Calendar
• Meta / Instagram: if you connect it, to post content and read public metrics; and, separately, to measure the performance of our advertising as described in Section 6
• Spotify: for release lookups, linked artist-profile stats, and, only where a fan connects their account, the saves and follows they request
• AI service provider: to power the AI features described above

Collaboration. Content and profile details you choose to share within a project are visible to collaborators you invite, and public pages you create are visible to anyone with the link.

Legal and safety. We may disclose information if required by law or to protect the rights, safety, and security of our users or the Service.

Business transfers. If the Service is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

The Service integrates with third-party platforms (such as Instagram and Google). Your use of those platforms is governed by their own terms and privacy policies. We are not responsible for the behavior of third-party platforms, changes to their APIs or policies, or actions taken outside the Service.

We use browser storage and similar technologies to keep you signed in and to operate core features, and we use limited first-party analytics to measure activity on public links and pages.

Advertising measurement (Meta pixel)

Our public pages (our home page, pricing page, campaign landing pages, public project and link pages) load the Meta (Facebook) pixel so we can tell whether our ads are working. It records that a page was viewed, and records when a subscription is started. For this, Meta sets two cookies in your browser: _fbp, and _fbc, which is only set if you reached us from one of our ads.

When a subscription completes, we also send Meta a record of that event from our server. It contains the amount paid and, so Meta can match the event to an ad click, a one-way hashed (SHA-256) copy of your email address and of your account identifier. We do not send Meta your email address in readable form.

The pixel does not run inside the signed-in application. What you do in your own workspace (the projects, files, tasks and pages you work on) is not sent to Meta.

Depending on where you live, advertising cookies like these may count as “sharing” personal information for targeted advertising. You can stop it: block advertising or third-party cookies in your browser, adjust your Meta ad preferences at facebook.com/adpreferences, or email us at info@rolloutxp.com and we will action the request.

You retain full ownership of the content you upload.

By using RolloutXP, you grant us a limited, non-exclusive license to host, store, process, and display your content solely to operate and provide the Service to you and the collaborators you designate. We do not sell your content or claim ownership of it.

We keep your information for as long as your account is active or as needed to provide the Service. When you delete your account (Settings → Delete Account), we delete your projects, files, and associated data, and cancel any active subscription. Residual copies may remain in encrypted backups for up to 30 days before being overwritten, and we may retain limited records where required for legal, tax, or security reasons.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your account and data (available in-app, or by contacting us)
• Request a copy of your data
• Object to or restrict certain processing
• Opt out of the advertising measurement described in Section 6

We do not sell your personal information for money, and we will not discriminate against you for exercising your rights. Some US state privacy laws treat the advertising cookies described in Section 6 as “sharing” for targeted advertising, and you can opt out by any of the methods listed there. To make a request, email info@rolloutxp.com.

We implement reasonable technical and organizational safeguards to protect your information, including access controls and encryption in transit. No system is perfectly secure, and we cannot guarantee absolute security.

We operate in the United States, and our service providers may process and store data in the United States and other countries. By using the Service, you understand that your information may be transferred to and processed in countries whose data-protection laws may differ from those of your country.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will delete it.

We may update this Policy from time to time. When we do, we will revise the “Last Updated” date above, and material changes may be communicated in-app or by email. Continued use of the Service after an update constitutes acceptance of the revised Policy.

Questions or requests about this Policy or your data:

RolloutXP
100 Phoenix Ave, Unit 2B, Lowell, MA 01852
info@rolloutxp.com