What we collect, and what we don't.

The short version

We never see your card details. We don't store artists' bank account numbers. We don't track you around the internet, we don't run advertising, and we don't sell anything about you to anyone. The data we do hold exists so that a fan's money reaches an artist and both of them get told it worked.

If you tip an artist

We record:

• Your email address, so we can send your receipt, and so the artist can recognise repeat support. We store it lowercased and trimmed. It is never shown publicly. We do not use it to market to you unless you tick the box at checkout asking to hear from that artist — see Updates from artists.
• The payment itself: the tip amount, our fee, the total, the currency, which payment provider handled it, whether it succeeded, and a reference number.
• A display name, if you choose to give one, and whether you ticked the box to appear on the artist's public supporters list. Both are optional and off by default. Without both a name and an explicit opt-in, you do not appear anywhere publicly.
• A private note, if you write one. It is visible to that artist in their dashboard and to nobody else. It never appears on the public page.

We do not receive or store your card, bank, or wallet details. Payment is taken on a page hosted by Paystack or Flutterwave, who handle those details under their own terms and their own PCI compliance. Hipstarr is told only whether the payment succeeded and for how much.

Updates from artists

When you tip, you can tick a box asking to hear from that artist. It is not ticked for you, it is not required, and leaving it alone does not affect your payment in any way.

What we collect. Your email address and which artist you asked to hear from. Nothing else is collected for this.

Why. So that artist can send you updates through Hipstarr: new music, release alerts, and thank-you messages. We send them on the artist's behalf; your address is not handed to the artist to use elsewhere.

Our lawful basis is your consent, given by ticking that box. We record what the wording said, the date, and which payment it was given with, so it is always possible to show exactly what you agreed to. If you did not tick it, you get your payment receipt and nothing else.

It is per artist. Ticking the box for one artist does not sign you up to hear from any other, and never signs you up to hear from Hipstarr about Hipstarr.

Separately, an artist can send you one thank-you for a payment. That is a single message about the tip you just sent, it can only be sent once per payment, and it does not depend on the box above. If you would rather not receive even that, email us and we will stop it.

You can stop it at any time. Every update email carries an unsubscribe link that works in one tap, with no login and no reply needed. Stopping is meant to be at least as easy as starting was. You can also email hipstarrmusic@gmail.com.

We do not sell your address and we do not share it with anyone else for their own marketing. The emails are delivered by Resend, our email provider, listed with our other processors below.

What we keep after you unsubscribe. The record that you consented — the wording, the date and the payment — is kept, along with the fact that you later withdrew. That record is the only thing that can show we had permission at the time, so deleting it would remove the proof that protects you as much as us. It is not used to contact you again.

If you ask us to erase your data altogether, your email address goes from that record and from everywhere else it appears. What remains is that a consent existed, when, and for which artist, with nothing in it that identifies you. We keep that much because it is the only thing that could answer a question about an email sent before you asked us to stop — and it is no longer about you.

Anyone who tipped before this existed has not consented. The box did not exist when they paid, so there is nothing to infer, and they will not receive artist updates unless they tick it on a future payment.

If you are an artist

We record your name, email address, page address, chosen payout currency, profile photo, welcome message, and any social links you add. All of that except your email is public by design, because it is your page.

Your bank account number is not stored by Hipstarr. When you onboard, your account number and bank are passed straight to Paystack and Flutterwave to create the payout account that your tips split into. We keep only the reference those providers hand back. We could not tell you your own account number from our records, because we don't have it.

Visits to artist pages

When an artist page is viewed we record which artist was viewed, when, and a scrambled code. There is no third-party analytics script, no advertising, and no tracking cookies.

The code is made by putting your network address, your browser type and today's date through a one-way scrambler. We never store your network address or your browser type, only the scrambled result, which cannot be turned back into either. Because the date goes into it, the same visitor produces a different code tomorrow, so it cannot be used to follow anyone from one day to the next.

It answers one question and is incapable of answering any other: is this the same visit again? That lets us count a person once a day instead of once per page refresh, so we can see how many people reached an artist's page versus how many completed a tip. We could not identify you from it, and neither could anyone who obtained our database.

If you arrived from a link an artist shared, that link may carry a short label the artist chose, like bts-studio, and we record it so they can see which of their links people actually came from. Alongside it we keep the website you came from (the site name only, never the full address), your country, and a rough category for your device, one of ios, android, desktop or in-app.

None of that names you. We still do not store your network address or your browser type: the country comes from our hosting provider, which tells us the country and nothing more precise, and the device category is six possible words rather than the long identifying string your browser sends.

Cookies

We set cookies only to keep artists signed in to their dashboard. There are no analytics, advertising, or tracking cookies on this site. If you never log in as an artist, we set no cookies at all.

One other thing is stored in your browser, and it is not a cookie and never leaves your device: when you dismiss the privacy notice that appears on your first visit, we remember that so it does not appear again. It records nothing but the fact that you closed it.

Who else touches your data

Hipstarr Media & Technologies is the data controller: we decide what is collected and why. The companies below are our processors. They act only on our instructions and only for the purposes Hipstarr needs, and none of them may use your data for their own ends. Each does a single job:

• Paystack, takes naira payments and pays artists out. Receives your email address; the amount and currency; your card or bank details, which are entered on their page and never reach us; an artist's bank account number at signup. Processing takes place: nigeria, with group infrastructure that may extend abroad. Their privacy policy.
• Flutterwave, takes us dollar and pound payments and pays artists out. Receives your email address; the amount and currency; your card or wallet details, which are entered on their page and never reach us; an artist's bank account number at signup. Processing takes place: nigeria, with group infrastructure that may extend abroad. Their privacy policy.
• Supabase, the database, and artist sign-in. Receives everything Hipstarr stores: your email address, any display name and note you wrote, and the payment record. Processing takes place: outside nigeria. supabase has no nigerian region. Their privacy policy.
• Vercel, hosts the website. Receives your network address, in the ordinary course of serving you the page; the country it resolves to, which is all they report back to us. Processing takes place: outside nigeria, on a global network. Their privacy policy.
• Resend, sends receipts and notification emails. Receives your email address; the contents of the email we send you, which includes the artist, the amount, and any note you wrote to them. Processing takes place: outside nigeria. Their privacy policy.

We do not sell personal data, and we do not share it with advertisers or data brokers. We will disclose data where we are legally required to.

Your data leaves Nigeria, and here is exactly how

The services Hipstarr is built on are hosted outside Nigeria, so your personal data is transferred abroad and stored there. This is not incidental and it is not occasional. Our database has no Nigerian region available to it, so every record described on this page lives on servers outside the country from the moment you give it to us.

The mechanics, stated plainly:

• Paystack holds your email address; the amount and currency; your card or bank details, which are entered on their page and never reach us; an artist's bank account number at signup. Where: nigeria, with group infrastructure that may extend abroad.
• Flutterwave holds your email address; the amount and currency; your card or wallet details, which are entered on their page and never reach us; an artist's bank account number at signup. Where: nigeria, with group infrastructure that may extend abroad.
• Supabase holds everything Hipstarr stores: your email address, any display name and note you wrote, and the payment record. Where: outside nigeria. supabase has no nigerian region.
• Vercel holds your network address, in the ordinary course of serving you the page; the country it resolves to, which is all they report back to us. Where: outside nigeria, on a global network.
• Resend holds your email address; the contents of the email we send you, which includes the artist, the amount, and any note you wrote to them. Where: outside nigeria.

Nigeria has not issued an adequacy decision for these countries, and no approved cross-border transfer instrument is in force. We rely instead on your consent, which is why this is written out rather than buried, and on each provider's own contractual data protection commitments.

What this means for you. Data held abroad is subject to the laws of the country it sits in, which may include lawful access by authorities there, and the protections available to you may differ from Nigerian law. If you would rather this did not happen, the way to avoid it is not to give us the data: you can tip without a display name and without a note, and an artist can ask us to close their account. We cannot take a payment without passing your email and the amount to a payment provider, so there is no version of tipping that keeps your data in Nigeria. That is a real limitation and you should know it before you decide, not after.

You can withdraw your consent at any time by emailing hipstarrmusic@gmail.com. Withdrawing it means we remove your details, as described under Your rights below. It cannot unwind a transfer that has already happened, and it cannot erase the financial record of a payment.

How long we keep it

Payment records: six years. That is ordinary practice for financial records and it is the period we are working to. It covers the amount, the currency, the date and the gateway's reference.

Your email, the name you chose and any note you wrote: with the payment, or until you ask us to remove them, whichever comes first. These are not needed for the financial record, so a request removes them straight away and the payment record continues without them.

Artist accounts: while the page is live, and the payment history for six years after, because it is also the record of what that artist earned.

Page visits: 24 months. There is nothing in them that identifies you. We store a scrambled one-way code built from your network address, your browser and today's date, which stops being able to match you the following day.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Under the Nigeria Data Protection Act 2023, and, where it applies to you, the UK and EU GDPR, you also have the right to object to processing and to complain to your data protection authority.

Email hipstarrmusic@gmail.com from the address you used, or the one on your artist account, and say what you want done. We will act within 30 days and write back to tell you it is done.

Here is exactly what deletion does, so that nothing about it is a surprise. We remove your email address, the name you chose to be shown by, any private note you wrote, and your place on any public supporters list. What stays is the payment itself: the amount, the currency, the date and the reference. Once your details are gone that record describes a transaction and no longer describes you.

The one limit worth stating plainly: we cannot delete the record that a payment happened, because keeping financial records is a separate legal obligation. Everything about that payment that points to you, we can and will remove.

If you are an artist, deletion also takes your page down and clears your photo, your welcome message and your links. Your record of what you earned is kept for the same six years, for the same reason.

Children

Hipstarr is not intended for people under 18. We do not knowingly collect data from children.

Changes

If we change this policy we will update the date at the top of the page. Material changes affecting artists will also be emailed.

Contact

Hipstarr Media & Technologies, hipstarrmusic@gmail.com. See also our terms of service and our questions page.