Privacy Notice.

1. Who we are

This Privacy Notice is issued by POST WORK (postwork.run), the project that operates PRESS-KIT.CLOUD (the "Service"). POST WORK is not a company. It is run by AI agents and operated by one individual based in Italy, who is the data controller for the personal data described here: about people who use the Service, and about people we email (section 10).

Contact: hello@postwork.run.

2. Data we collect

• Account data: email address, password hash, authentication identifiers.
• EPK content: artist name, bio, genre, location, links, photos and other content you upload.
• Support data: messages and attachments you send to us.
• Usage and telemetry: pages viewed, EPK views/downloads, approximate location, device and browser type.
• How you found us: when you create an account, we record with it the site that sent you to us (domain only, for example instagram.com), the page you landed on and any campaign tags in the link (utm_*, ref), as your browser passed them to the page you signed up from. Nothing is stored in your browser for this: no cookie, no identifier. If you leave without signing up, nothing is kept. We use it only to count which channels bring sign-ups and buyers. It is deleted with your account. You can object at any time (section 7).
• Technical data: IP address, log files, cookie identifiers.

Payment data (card details, billing address) is collected directly by our Merchant of Record, Paddle, and is not stored by us.

3. Why we use your data and legal basis

• Provide the Service (account creation, hosting your EPK, generating PDFs) — performance of a contract.
• Process payments via Paddle — performance of a contract and legal obligation.
• Security and fraud prevention — legitimate interests in protecting the Service.
• Improve the product (analytics, debugging) — legitimate interests.
• Count how you found us — our legitimate interest in knowing which channels bring users (Art. 6(1)(f) GDPR). Nothing is stored on your device for this. You may object (Art. 21); we then delete the record.
• Customer support — performance of a contract.
• Emails to account holders: service emails only (sign-in, account, purchase). There is no marketing opt-in at sign-up, so we send account holders no marketing.
• One product announcement to people on our contact list — as described in section 10.
• Comply with legal obligations (tax, accounting, lawful requests) — legal obligation.

4. Who we share data with

• Paddle.com — our Merchant of Record for sale of the product, payments, tax compliance and invoicing.
• Hosting and infrastructure providers (Cloudflare, Supabase) — to host the application, database and uploaded media.
• Google — only if you sign in with Google. Nothing is loaded from Google until you click Continue with Google on the sign-in page. Then the page loads Google's sign-in button from Google, so Google receives your IP address and browser details, and Google's script stores a cookie on this site, g_state (section 9). When you sign in, Google sends us your name, email address and Google account ID.
• Analytics and error-monitoring providers — to understand usage and diagnose issues.
• Brevo (France, EU) — sends the emails described in section 10. Aruba (Italy) and Google (Gmail) — host the mailboxes where your emails to us arrive.
• Professional advisers (legal, accounting) where necessary.
• Public recipients of your EPK — anything you publish on a public EPK link is visible to anyone with the link.
• Authorities where required by law.

5. International transfers

Some of our providers are based outside the UK/EEA (for example in the United States). Where personal data is transferred internationally we rely on appropriate safeguards such as the EU Standard Contractual Clauses or an applicable adequacy decision.

6. Retention

We keep your account and EPK data for as long as your account is active. If you delete your account, we delete or anonymise personal data within 30 days, except where we are required to keep certain records for legal or accounting purposes (typically up to 10 years for invoicing).

7. Your rights

Under the GDPR and equivalent laws you have the right to: access your data, including where it came from, request rectification or erasure, restrict or object to processing, data portability, and withdraw consent at any time. You may also lodge a complaint with your local data protection authority. To exercise your rights, email hello@postwork.run. We respond within one month.

8. Security

We use appropriate technical and organisational measures to protect your data, including TLS encryption in transit, encryption at rest for stored files, access controls and audit logging. No system is perfectly secure; please use a strong, unique password.

9. Cookies and browser storage

Technical, no consent needed: they make the site work.

• sb-…-auth-token (local storage, Supabase): keeps you signed in. Only after you sign in; removed when you sign out.
• pk_next (session storage): the page to return to after a Google sign-in. Gone when you close the tab.
• tsr-scroll-restoration-v1_3 (session storage, our page framework): how far you had scrolled on each page, to put you back there when you go back. Gone when you close the tab.

Nothing else is stored in your browser by us.

From Google, only after you ask to sign in with Google: when you click Continue with Google, the page loads Google's sign-in button and Google's script writes a cookie on this site, g_state, with the state of its sign-in prompt. It is part of the sign-in you asked for. Before that click nothing is loaded from Google and no g_state is written. We do not read it.

Visits are counted in aggregate by our host, Cloudflare (Web Analytics): a Cloudflare script sends the page address, the referring site, the browser type and load times. No cookie and nothing stored in your browser.

10. If we emailed you and you have no account

This section is for people who received an email from press-kit.cloud by POST WORK (hello@press-kit.cloud) without ever using the Service.

• Who: the data controller is the individual who operates POST WORK, based in Italy (section 1). Contact: hello@press-kit.cloud. The emails are written and sent by AI agents. A human reviews every data request.
• What data: your email address. For each email we send: delivered or bounced, opened (only if your mail app loads images), which link you clicked, unsubscribed, marked as spam. If you reply, your message.
• Where it comes from: you entered your address on a free music download page on Hypeddit, between February 2024 and May 2026. It was not bought and not taken from a public directory.
• Why: one email announcing press-kit.cloud, and at most one reminder. Nothing else. We do not sell, rent or share the list.
• On what basis: your address came from a Hypeddit download page. Hypeddit's privacy policy states that addresses used to unlock a download are shared with the uploader in order to contact you. Every email has a one-click unsubscribe, and we stop at the first request.
• Who handles it for us: Brevo (France; data stored in the EU) sends the emails and records the events above. Cloudflare hosts the site the link opens. Aruba (Italy) and Google (Gmail) host the mailbox where replies arrive.
• How long: we delete the list and its events from Brevo within 60 days of the last email. If you unsubscribe or ask us to erase your data, we keep only your address on a do-not-contact list, so that we never write to you again.
• Your rights: ask what we hold about you and where it came from (Art. 15 GDPR); object to this use (Art. 21: we stop at once); ask us to erase it (Art. 17); correct or restrict it. You can complain to a supervisory authority: in Italy the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority where you live or work. We answer within one month, free of charge.
• How to stop: the one-click unsubscribe link in every email, or reply STOP. Either is enough. You will get nothing more from us.

If we sent you a press kit you did not ask for

This part is for DJs and artists who received an email from press-kit.cloud with a press kit PDF attached.

• Who: the data controller is the individual who operates POST WORK, based in Italy (section 1). Contact: hello@press-kit.cloud. The emails and the kit are prepared by AI agents; a human reviews every data request.
• Where your data comes from: the email address you publish on your own public profile (SoundCloud or Mixcloud, and the pages it links to), and the facts, texts and photos you publish there. Nothing was bought, and nothing was taken from a page you did not publish yourself.
• What we hold: that email address; your artist name, city, genres and the public facts and photos used in the kit; the address of the page where we found them and the date; your replies.
• Why: to send you one email with your kit, and at most one reminder. The kit stays private. We publish it only if you reply “yes”.
• Legal basis: our legitimate interest in offering a working artist a free tool for their work, through the address they published for it (Art. 6(1)(f) GDPR). One email and one reminder, no publication without your yes, and a one-word way out.
• Who handles it for us: each email is sent one to one, from hello@press-kit.cloud, through Brevo (France; data stored in the EU), which delivers it and records whether it was delivered, opened or clicked. Aruba (Italy) and Google (Gmail) host the mailbox where replies arrive. The unpublished kit and the PDF are kept as files on the operator’s computer, not on our servers. Only if you reply “yes” does the kit become a page on press-kit.cloud, stored like every other kit by Supabase (EU, Ireland) and served by Cloudflare (section 4).
• How long: if you say no, or do not reply within 30 days of the last email, we delete the kit, the PDF and the facts we collected. We keep only your email address, the address of the page where you published it and the date, for 3 years, so that we can show where it came from and never write to you again.
• Your rights: you can object at any time (Art. 21): reply “no” or write to hello@press-kit.cloud and we stop at once. You can also ask what we hold and where it came from (Art. 15), and ask us to correct or erase it. You can complain to the Garante per la protezione dei dati personali (garanteprivacy.it) or to the authority where you live or work. We answer within one month, free of charge.

11. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be notified by email or in-product banner.

See also our Terms & Conditions and Refund Policy.