Your data

Privacy policy.

What we collect, why we collect it, who else sees it and what you can ask us to do about it. We collect as little as we can, and we don't sell any of it or use it to advertise to you.

Last updated 29 September 2026

01Who we are

subTotem Ltd decides how your data is used, and is responsible for it under UK data protection law.

subTotem Ltd, registered in England and Wales (company number 17145546), is the data controller for the information described here. That means we're responsible for how it's used and kept.

This policy covers the subTotem website and the subTotem app. For anything about your data, including any of the requests in section 9, email legal@subtotem.com.

02What we collect

Your account details, what you put on your page, what you listen to, and what you buy. Never your card or bank details.

What you give us

Your account: email address, password (stored only as a scrambled hash we can't reverse), display name, username, country and whether your email has been confirmed.
Signing in with Google, Apple or Facebook: if you choose to, we store which provider you used, the account reference they give us, and the email address they report. We never get your password. If you use Apple's "hide my email", we only ever see the relay address.
Artists: your real name, location, biography, pictures, links, genres, roles, your music and its credits (songwriters, producers and musicians), your diary, events, videos and merch, and your PRS for Music answer and IPI/CAE number if you give one, and the domain you connect to your page, if you connect one.
Artists being paid: the bank account your earnings go to, as described under Payments below.
Buying something: the delivery address you give us — a name, address, postcode and anything you tell the artist about the order — and what you bought.
The waiting list: your name, country, and your email address or WhatsApp number.
Joining an artist's email list: your email address, whether you said you're 18 or over, and when you confirmed or unsubscribed. Soon
Your date of birth, the first time you try to message an artist. We ask once and don't ask for proof. It's used only to check you're 14 or over, and whether the extra protections for under-18s apply. You can't change it yourself afterwards, so if it's wrong, email us.
Anything you write to us, such as a support email.

What we record as you use subTotem

Plays and streams: which track you played, when, and whether it counted as a paid stream. This is how artists get paid, so we have to keep it accurate.
Playlists you make, and comments you leave on tracks.
Private messages between you and an artist: what was written, when it was sent and read, and whether either of you has muted, closed, blocked or reported the conversation.
Push notifications: if you turn them on in the app, the notification token your phone gives us.
Technical information that arrives with any web request, such as your IP address and browser. We use it to keep subTotem working and to stop abuse, and we don't store it in our database alongside your account.

Payments

When you pay us, we never see or store your card number or your bank details. Payments are handled by Stripe, and you type your details into Stripe's own form or on Stripe's page. All we keep is the reference Stripe gives us for your customer record and your Direct Debit, plus what you're subscribed to and when it renews.

When we pay you, it's different. Artists give us the UK bank account to send their earnings to — the name on it, the sort code and the account number — because we pay artists ourselves rather than through a third party. The sort code and account number are encrypted in our database, and are only ever decrypted to build a payment run. Nobody at subTotem browses them, and the site never shows them back to you beyond the last four digits.

We don't buy data about you from anyone, we don't track you across other websites, and we don't use your data for advertising.

03Why, and the legal basis

Mostly because we need it to run subTotem and pay artists. Marketing emails only if you ask for them.

UK data protection law says we have to have a reason, in law, for each use. Ours are:

To provide subTotem — your account, your page, playing music, taking payments, and paying artists what they've earned. Basis: performing our contract with you.
To count streams and work out payments, including patronage. Basis: performing our contract, and our legitimate interest in paying artists accurately.
To keep subTotem safe — confirming your email, stopping fake accounts, and finding artificial streams. Basis: our legitimate interest in protecting the service and the artists on it.
To keep private messages safe — using your date of birth to check you're old enough to message an artist, stopping contact details being passed to or from anyone under 18, and looking into a message someone reports. Basis: our legitimate interest in protecting the people who use subTotem, children above all, and our duties under the Online Safety Act.
To tell you things you need to know, such as a receipt, a failed payment or a change to these policies. Basis: performing our contract.
To report plays of PRS members' songs to PRS for Music. Basis: our legitimate interest, and the artist's, in songwriters being paid.
To send you an artist's emails, once you've joined their list and confirmed from the email we send you. Basis: your consent. Every email has a link to unsubscribe. Soon
To send you news or offers by email. Basis: your consent. You can withdraw it at any time, and every such email has an unsubscribe link.
To meet our legal duties, such as keeping accounting records. Basis: legal obligation.

05What's public

An artist page is public on purpose. Your listening is not.

Artists: your page, and what you put on it, is public to anyone on the internet, including search engines. That's the point of it. What you don't publish stays private to you.
Listeners: what you play is never shown to other listeners. Artists see counts of their own streams and how many people played a track, not a list of who you are and what you played at what time.
Comments and playlists you choose to share are visible to others.
Your delivery address is never public. It goes to the artist you bought from, and nobody else.
A playlist a Champion shares can be seen by anyone with its link, with their name on it unless they choose to show "A subTotem Champion" instead. Stopping sharing ends the link.
Private messages are between you and the artist. The artist sees your name, whether you support them, and a mark if you're under 18, never your date of birth. Nobody at subTotem reads a conversation unless something in it is reported, and then only that one. A manager or label working with an artist will never see a conversation with anyone under 18.
Champion fan pages will be public when they open, and you'll choose what goes on yours. Soon

06How long we keep it

While you have an account, and 30 days after you close it. Payment records last longer because the law says so.

Your account and its content: until you delete your account. After that the record is closed straight away, so nothing of yours is reachable, and the data is wiped 30 days later. The 30 days give us a window to put it back if the account was closed by mistake or in error.
Stream and payment records: kept as long as we need them for artists' statements, and for six years where accounting or tax law requires it. That includes a record of payments made to an artist, though not the account number they went to.
An artist's bank details: until you change them or close your account. Changing them replaces what was there.
Orders and delivery addresses: kept for six years, because an order is an accounting record and both you and the artist may need to refer to it. Each order keeps the address it was sent to, so changing your address later doesn't rewrite an old order.
Private messages and your date of birth: until you delete your account, like the rest of it. Deleting either account in a conversation deletes the conversation for both of you. A message we take down after a report is hidden from everyone straight away, and kept with the report until then.
An artist's email list: while you're on it. When you unsubscribe, we keep your address marked as unsubscribed, so that artist can't email you again; ask us and we'll delete it altogether. Soon
The waiting list: until the role opens and you've been invited, or until you ask us to remove you.
Confirmation codes and password reset links: a few hours, then they expire and are cleared.

07Where it's stored

On Cloudflare's network, which is worldwide. Anything leaving the UK is protected by approved contract terms.

subTotem runs on Cloudflare's network, which has servers around the world, and our other providers are in the UK, the EU and the United States. That means your data may be handled outside the UK.

Where it is, we rely on the safeguards UK law allows: the UK's adequacy decisions for countries with equivalent protection, or the International Data Transfer Agreement, or the UK Addendum to the EU's standard contractual clauses, in our contracts with each provider.

08Cookies and storage

We don't use tracking cookies, so there's no cookie banner to click away.

subTotem doesn't set advertising or analytics cookies, and doesn't track you across other websites. That's why you've never seen a cookie banner here.

When you sign in, we keep a sign-in token and your basic account details in your browser's own storage, so you stay signed in. Clearing your browser data signs you out. Stripe sets what it needs to take a payment safely, and that's covered by Stripe's privacy policy.

09Your rights

You can ask for a copy of your data, have it corrected or deleted, and complain to the ICO.

Under UK data protection law you can ask us to:

Give you a copy of the data we hold about you.
Correct it if it's wrong. You can edit most of it yourself in Settings.
Delete it. You can delete your account yourself in Settings. Some records, such as payments, we have to keep for the periods in section 6.
Send it on, to you or to another service, in a machine-readable form.
Stop or limit a use you object to, where we rely on legitimate interests.
Withdraw consent you've given, such as for marketing emails.

Email legal@subtotem.com and we'll answer within one month. It's free, and we may ask you to confirm who you are first.

If you're not happy with how we've handled it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd rather you came to us first, so we can put it right.

10Children

13 and over for a free listener account, with a parent's permission. 14 and over to message an artist. 18 and over to pay or to be an artist.

subTotem isn't meant for children under 13, and we don't knowingly collect their data. From 13 you can have a free listener account with a parent's or guardian's permission, and you need to be 18 or over to pay for a plan or join as an artist.

Messaging an artist is for 14 and over, and we ask for your date of birth before you can. Only a fan can start a conversation, never an artist, and messages are text only. If you're under 18, neither side can send a way to reach you outside subTotem, such as a phone number, email address, social handle or web link.

If you're a parent and think your child has given us their data, email legal@subtotem.com and we'll delete it.

11Keeping it safe

Passwords are hashed, everything travels encrypted, and your music is never publicly downloadable.

Your password is stored as a hash, not as text. Nobody at subTotem can read it.
Everything between you and subTotem travels over an encrypted connection.
Audio is only ever served through a short-lived signed link to someone allowed to play it. Artists' master files are never served at all.
Only people who need it can reach personal data, and the details you pay us with sit with Stripe rather than with us.
The bank account we pay an artist into is encrypted with a key held outside the database, so a copy of the database alone can't reveal it. Changing it needs your password, sends you an email, and holds payments for a few days — so if it wasn't you, there's time to stop it.

No service can promise perfect security, but if there's ever a breach that puts you at risk, we'll tell you and the ICO as the law requires.

12Changes and contact

We'll tell you about any change that matters, and you can always email us.

If we change this policy in a way that affects you, we'll email you before it takes effect. The date at the top always shows when it was last changed.

Questions, requests and complaints: legal@subtotem.com, or write to subTotem Ltd, registered in England and Wales, company number 17145546.