Privacy Policy

Last updated: March 23, 2026

1. Data Controller

This website (sxs.soldoutrecords.ro) is operated by:

The website serves the promotional campaign “The International Law of Love” for the music single “International Law” by the artists Stefania and Speak. The campaign includes a digital petition (“declaration”), email early-access distribution, and a promotional giveaway contest of €500.

2. Personal Data We Collect

When you sign the declaration on our website, we collect the following personal data:

  • First name and last name — to identify your signature
  • Email address — to send you early access to the music video and campaign updates
  • Age — to verify eligibility for the contest (must be 18+)
  • Phone number — to contact contest winners
  • Address and city — to deliver prizes to contest winners and for demographic statistics
  • Instagram handle — to automatically verify contest participation via Instagram Graph API
  • TikTok handle (optional) — for potential future contest verification

We also automatically collect:

  • Timestamp — the date and time you signed
  • UTM parameters — from the URL (utm_source, utm_medium, utm_campaign) to understand which marketing channels drive signups

3. Data Collected via Instagram Graph API

To automatically verify contest entries, we use the Instagram Graph API (provided by Meta Platforms, Inc.) to search for public posts containing the hashtag #InternationalLaw and mentions/tags of @iamspeak and @cristinaa.stefaniaa.

From public Instagram posts that match the contest criteria, we collect:

  • Instagram username — to match with the Instagram handle provided during signup
  • Post permalink — a link to the qualifying post
  • Post caption — to verify the presence of required hashtags
  • Followers count — for campaign analytics
  • Timestamp of post — to verify the post was made during the contest period

We do not access your private messages, stories, private posts, or any content not publicly available. We only read publicly available post data relevant to the contest hashtag and tags.

4. Legal Basis for Processing (GDPR Art. 6)

  • Consent (Art. 6(1)(a))— By clicking “I Sign This Declaration”, you explicitly consent to the collection and processing of your personal data for the purposes described in this policy.
  • Contract performance (Art. 6(1)(b)) — Processing is necessary to deliver the services you signed up for: early access email, contest participation, and prize delivery.
  • Legitimate interest (Art. 6(1)(f)) — We have a legitimate interest in understanding our audience demographics and campaign effectiveness through anonymized analytics.

5. Purpose of Data Processing

We use your personal data exclusively for:

  • Registering your signature on the “International Law of Love” declaration
  • Sending you early access to the “International Law” music video on April 6, 2026 at 8:00 AM
  • Automatically verifying your contest entry on Instagram (matching your Instagram handle with public posts)
  • Contacting contest winners to arrange prize delivery (€500 giveaway)
  • Sending occasional promotional updates about Stefania & Speak (you can unsubscribe at any time)
  • Internal campaign analytics (total signups, geographic distribution, traffic sources)

6. Data Storage and Security

Your personal data is stored on:

  • Supabase (https://supabase.com) — a cloud database platform. Our database is hosted in the European Union. Supabase implements encryption at rest, encrypted connections (TLS), and regular backups.
  • Cloudflare Pages (https://pages.cloudflare.com) — static website hosting. Cloudflare serves the website globally via its CDN but does not store your personal data.

We implement row-level security (RLS) policies on our database to ensure that personal data cannot be accessed through the public API. Only authorized administrators can read signature records.

7. Third-Party Data Sharing

We share your data with the following third-party services, strictly for the purposes described:

  • Supabase Inc. — database hosting provider (Data Processor). Supabase processes data on our behalf under their Privacy Policy.
  • Cloudflare Inc. — website hosting and content delivery. Cloudflare may process minimal request logs under their Privacy Policy.
  • Meta Platforms Inc.— we use the Instagram Graph API to read public post data. We do not send your personal data to Meta. We only query Meta’s API to read publicly available Instagram posts. Meta’s Privacy Policy applies to your use of Instagram.

We do not sell, rent, or trade your personal data to any third party. We do not use your data for advertising purposes. We do not use tracking cookies.

8. Cookies and Tracking

This website does not use cookies for tracking or analytics. We do not use Google Analytics, Facebook Pixel, or any third-party tracking scripts. The only data we collect is what you explicitly provide through the signature form.

9. Data Retention Period

  • Campaign data — retained until June 30, 2026 (3 months after campaign launch), then deleted unless you opt in to continued communications.
  • Contest data — retained for 12 months after the contest ends (as required for tax and legal compliance related to prize distribution).
  • Email subscription — retained until you unsubscribe.

You can request early deletion at any time (see Section 10).

10. Your Rights Under GDPR

As a data subject in the European Union, you have the following rights:

  • Right of access (Art. 15) — You can request a copy of all personal data we hold about you.
  • Right to rectification (Art. 16) — You can ask us to correct any inaccurate data.
  • Right to erasure (Art. 17) — You can request deletion of your data. Visit our Data Deletion page for instructions.
  • Right to restrict processing (Art. 18) — You can ask us to temporarily stop processing your data.
  • Right to data portability (Art. 20) — You can request your data in a machine-readable format (JSON/CSV).
  • Right to withdraw consent (Art. 7(3)) — You can withdraw your consent at any time. This does not affect the lawfulness of processing before withdrawal.
  • Right to lodge a complaint — You can file a complaint with the Romanian data protection authority (ANSPDCP) at www.dataprotection.ro.

To exercise any of these rights, contact us at: office@soldoutmedia.ro

We will respond within 30 days of your request.

11. Children’s Privacy

This website and the contest are intended for individuals aged 13 and older. Contest participation and prize eligibility requires participants to be at least 18 years old. We do not knowingly collect data from children under 13. If you believe a child under 13 has submitted data, contact us and we will delete it immediately.

12. International Data Transfers

Our primary data storage (Supabase) is located in the EU. Some third-party services (Cloudflare, Meta) may process data in the United States under EU-US Data Privacy Framework adequacy decisions or Standard Contractual Clauses (SCCs).

13. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last updated” date. If we make significant changes that affect your rights, we will notify you via email.

14. Contact Information

For any questions about this Privacy Policy or your personal data:

← Back to the declarationData Deletion