Privacy Policy

Last updated 8 October 2026.

Who we are

back2back is run by Stereogram Ltd, a company registered in England and Wales (company number 13058941), registered office c/o Cooper Hathaway Limited, Maple House, High Street, Potters Bar, Hertfordshire, EN6 5BS, England. In this policy, "we" means Stereogram Ltd.

For anything about your personal data, write to info@back2back.dev.

What this policy covers

• This website, back2back.dev.
• The Artist OS at artist-os.back2back.dev, where artists sign in to their own dashboard. We decide how its data is used, so we are its controller.
• The Manager OS, which we run for labels and managers. There, the label or manager decides which artists are tracked, and we process the data on their behalf under a contract with them. Their own privacy notice applies, and this policy describes our part.

What we collect

Your account. Your email address, and when you last signed in. We send a one-time code to your email to sign you in. If you sign in with Google, Google gives us your name, email address and profile picture.

What you add. The artist profile you claim, links to your accounts on music and social platforms, your sub-genres, and the releases you choose to follow.

Public information about artists and their music. To build the dashboard, we collect what music and social platforms publish about the artists we track: profile details, follower and streaming figures, audiences by country and city, releases, playlists, posts and videos. Some of it is about other people:

• people who post videos with an artist's music, with their public handle, caption and follower count;
• public comments on an artist's releases, with the commenter's public username;
• producers and writers credited on a release, and the curators of playlists that include it;
• people named in news and web pages about an artist.

Technical data. Our servers log each request, including your IP address. The dashboard shows images straight from the platforms they belong to (for example Spotify, Instagram and TikTok), so those platforms see your IP address when your browser loads them.

Your calendar. The events you, or your manager, add in back2back: title, date and time, time zone, place and notes, and whether each one is private or visible to your manager. A private event shows to your manager only as "Busy" at its times. Your birthday, if you or your manager enter it: the calendar shows the day and the month, never your age.

A connected Google Calendar. If you connect one, we keep your Google email address (to show which account is connected), the list of your calendars, a copy of the events on the calendars you choose to bring in (private ones included), and an access token, encrypted, that lets us read and update those events for you.

Your messages. What you write to us by email.

We do not sell personal data, show advertising, or use it for any purpose not listed here.

Why we use it, and on what legal basis

• To run your account and the dashboard, your calendar included: this is necessary for our contract with you.
• To collect and analyse public information about artists and the people around their music: our legitimate interest, and that of artists and their managers, in understanding how the music is doing and what is trending. We use only what is already public, we keep it for limited periods, and anyone can object (see "Your rights").
• To keep the service secure, for example by logging requests: our legitimate interest.
• To meet legal obligations, such as keeping accounting records once we charge for the service.

We do not send marketing emails. We make no decision about you by automated means that has a legal or similarly significant effect on you.

AI

We use AI models to summarise news about an artist and to find trends in public videos. What we send to a model is public information: the artist's name, handles and figures, and other creators' public handles, captions and videos. We never send your email address, your account details or your calendar.

The AI providers we use are in the United States or the European Economic Area, and we use only services that do not keep what we send and do not train on it. Web searches go to search providers. They contain artist names and music terms, never your account details, and a search provider may use them to improve its own service.

Google Calendar

Connecting a Google Calendar is your choice, and you choose which of your calendars come in. back2back asks Google for two permissions, to see the list of your calendars and to see and edit the events on them, plus your email address. It uses them only to show those events in your back2back calendar, to keep that copy up to date, and to make the changes you make in back2back, such as adding, editing or deleting an event, in Google Calendar too.

back2back's use and transfer to any other app of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements. We do not sell this information, use it for advertising, or use it to train AI models, and nobody at back2back reads it unless you ask us to, it is needed for security, or the law requires it.

You can disconnect at any time from the calendar's Calendars panel. Disconnecting revokes our access at Google and deletes the copy of your events from back2back; nothing is deleted from Google Calendar. You can also remove back2back's access from your Google Account, at myaccount.google.com/permissions.

Who handles it for us

We use service providers for:

• hosting the database, the accounts and the servers, in the European Union;
• hosting this website;
• sending the emails that carry your sign-in codes;
• sign-in with Google, if you use it;
• Google Calendar, if you connect it: the events you add or change in back2back are written to it;
• the AI models and web searches described above;
• public music and social data. These providers receive the artist names, handles and identifiers we look up, never your account details.

Each one gets only what its job needs. If you ask, we tell you which providers have handled your data.

Transfers outside the UK and the EEA

Our database and servers are in the European Union. We are a UK company: the European Commission recognises the UK's data protection as adequate, and the UK recognises the EEA's. Some of our providers are in the United States. For them we rely on the EU–US Data Privacy Framework and its UK extension where the provider is certified, or on the standard contractual clauses approved by the European Commission and the UK.

How long we keep it

• Your account: while it is open, and 30 days after you close it. Our backups keep a copy for 7 more days.
• Your calendar: the events you add, and your birthday, while your account is open or until you delete them.
• A connected Google Calendar: its copy and its token until you disconnect it, which deletes both at once.
• Public information about an artist: while the artist is tracked. When an artist asks us to stop, we delete it and do not collect it again.
• Other creators' public videos and their AI readings: 60 days after we last see the video.
• Public comments: while the release they were left on is tracked.
• Records of AI requests: 90 days, to check quality and cost.
• Server logs: 30 days.
• Accounting records, once we charge: as long as the law requires.

Your rights

You can ask us for a copy of your personal data, to correct it, to delete it, to restrict how we use it, or to receive it in a portable format. You can object to any use based on our legitimate interest, including if you are a creator, commenter or anyone else whose public information appears in back2back.

Write to info@back2back.dev. We answer within one month, and we may ask you to confirm who you are first. For a Manager OS deployment, we pass your request to the label or manager who runs it, and help them answer.

You can also complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority of the country where you live, work, or where you think the problem happened. In Italy, that is the Garante per la protezione dei dati personali (garanteprivacy.it).

Age

Accounts are for people aged 18 or over. If a younger artist uses back2back, a parent or their manager holds the account.

Cookies and browser storage

This website sets no cookies and loads no analytics or advertising. The dashboard keeps your sign-in session in your browser's storage, plus your display preferences, such as the theme. All of it is needed for the service you asked for, so we do not ask for consent and there is no cookie banner. Connecting a Google Calendar sets one cookie for up to ten minutes, which makes sure the connection finishes in the browser that started it. The sign-in page loads Google's button, which may read Google's own cookies to show your Google account.

Security

Data travels encrypted. Only our own service has access to the database, and the tokens of connected calendars are stored encrypted on top of that. Each artist reaches only their own data, and each Manager OS client has a deployment and a database of its own.

Changes

When this policy changes, we update the date at the top. If the change matters to you, for example a new company running back2back, we email account holders before it takes effect.