Privacy Policy

Privacy Policy

Effective: 2025 — Konduktum OÜ, Narva mnt 5, Tallinn, Estonia Privacy questions: privacy@konduktum.com

This policy is written to be read, not to hide things. Every section has a plain-English opening. If you find anything unclear or that contradicts what we’ve told you elsewhere, email privacy@konduktum.com and we’ll fix it.

1. Who We Are#

Konduktum OÜ is a platform company registered in Estonia (Narva mnt 5, Tallinn 10117). We build infrastructure for creators — musicians, artists, filmmakers, writers, and anyone making work that matters.

We are two people. We have no investors and no outside money. We do not run advertising. We do not sell data. We make money when creators make money, through a transparent fee on funded Demands only.

This policy explains what personal data we collect, why we collect it, what we do with it, and what rights you have over it. It applies to all users of the Konduktum platform, whether you are a creator or a fan.

2. Summary: The Short Version#

If you read nothing else, read this table. The sections below are the legal detail behind each answer.

Question

Short answer

What do we collect?

Name, email, username. Nothing else.

Do you sell our data?

Never. Not now, not if we're acquired.

Do you run advertising?

No. No ads, no ad tracking, no behavioural profiling.

Who owns the subscriber list?

You do. Always. Export it any time, for free.

What happens if Konduktum is sold?

You get 30 days notice and full data export rights before any transfer.

Do we use cookies for tracking?

Only for platform function. No advertising or cross-site tracking.

How long do we keep data?

Until you leave, then deleted within 30 days.

Can I delete my account?

Yes, immediately, no questions asked.

Who processes payments?

Stripe. We never see your raw card data.

Is this GDPR compliant?

Yes. You are the controller of your subscriber data. We are the processor.

3. What Data We Collect#

3.1 What You Give Us#

We collect only what is necessary to run the platform. When you create an account, we collect:

• Your name
• Your email address
• Your chosen username

That is the complete list of personal data you provide us directly. We do not ask for your address, phone number, date of birth, gender, nationality, or any other personal information unless required by law for a specific transaction.

3.2 What We Collect Automatically#

When you use the platform, our servers automatically collect standard technical data:

• Your IP address (used for security and fraud prevention, not for tracking or profiling)
• Browser type and version
• Device type and operating system
• Pages visited and features used, with timestamps
• Error and crash reports

This data is used solely to keep the platform running, secure, and improving. It is not used to build behavioural profiles, target advertising, or sell to third parties.

3.3 Payment Data#

All payments are processed by Stripe. We never see, store, or handle your raw card data. When you make a payment, your card details go directly to Stripe. Konduktum receives only a transaction confirmation and the amount. Stripe’s privacy policy is atstripe.com/privacy.

3.4 Social Login Data#

If you register using a social media account (Facebook, Twitter/X, or similar), we receive from that provider only your name, email address, and profile picture. We use this only to create and authenticate your account. We do not access your friends list, your posts, or any other social data.

3.5 Subscriber Lists (Creator-Specific)#

When you build an audience on Konduktum, your subscribers’ email addresses are stored on our servers on your behalf. This data belongs to you, not to us.

We are the data processor for your subscriber list. You are the data controller. That is not just legal language — it means the decisions about that data are yours: you can export it, you can delete it, and you take it with you if you leave.

3.6 What We Do Not Collect#

We do not collect:

• Sensitive personal data (health, biometric, racial or ethnic origin, political opinions, religious beliefs, sexual orientation)
• Geolocation data beyond the country level inferred from IP address
• Behavioural or interest data for advertising purposes
• Data from third-party sources about you
• Data about minors — the platform is for users aged 18 and over

4. Why We Process Your Data#

4.1 To Run the Platform#

We process your account data (name, email, username) to:

• Create and authenticate your account
• Deliver content from creators to subscribers
• Process Demands and manage transactions
• Send you platform notifications directly related to your account or activity
• Provide support when you contact us

Legal basis: Contract — processing is necessary to provide the service you signed up for (GDPR Article 6(1)(b)).

4.2 For Security and Fraud Prevention#

We process IP addresses and usage data to detect and prevent fraud, abuse, and unauthorised access.

Legal basis: Legitimate interests — maintaining a secure platform for all users (GDPR Article 6(1)(f)).

4.3 To Comply With the Law#

We retain transaction records as required by Estonian and EU tax law. We respond to lawful requests from regulatory authorities.

Legal basis: Legal obligation (GDPR Article 6(1)(c)).

4.4 To Improve the Platform#

We analyse anonymised, aggregated usage data to understand how the platform is used and how to improve it. This analysis does not identify individual users.

Legal basis: Legitimate interests (GDPR Article 6(1)(f)).

4.5 Marketing Communications#

If you opt in, we may send you updates about new platform features or creator spotlights. You can unsubscribe at any time from any email we send. We do not send marketing on behalf of third parties.

Legal basis: Consent (GDPR Article 6(1)(a)). Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

We will never use your subscriber list to send Konduktum marketing communications to your fans. Their emails are yours. We use them only to deliver content you direct us to send on your behalf.

5. Cookies and Tracking#

5.1 What We Use#

We use cookies and similar technologies for platform function only:

• Session cookies to keep you logged in
• Security cookies to protect against cross-site request forgery
• Preference cookies to remember your settings

5.2 What We Do Not Use#

We do not use:

• Advertising cookies or tracking pixels
• Cross-site tracking technologies
• Third-party analytics that profile individual behaviour
• Fingerprinting or device identification for marketing purposes

Konduktum does not serve advertising. There are no advertisers on this platform. There are therefore no advertising cookies to accept or reject. If you see a browser extension flagging advertising trackers on our site, please report it to privacy@konduktum.com — it shouldn’t be there.

5.3 Do-Not-Track#

We respect Do-Not-Track (DNT) browser signals. When your browser sends a DNT signal, we do not collect analytics data beyond what is strictly necessary for platform security and function. We do not track you across other websites under any circumstances.

6. When and With Whom We Share Data#

6.1 Stripe#

We share transaction data with Stripe to process payments. Stripe is bound by its own privacy policy and by contractual obligations to us. We share only what Stripe needs: transaction amount, currency, and account identifiers.

6.2 Legal Requirements#

We may disclose personal data to law enforcement or regulatory authorities when required by law, court order, or to protect the safety of our users. We will notify affected users before disclosure where we are legally permitted to do so.

6.3 What We Do Not Do#

We do not:

• Sell personal data to any third party, ever
• Share data with advertisers or marketing platforms
• Share data with AI training datasets or AI companies
• Share creator subscriber lists with any third party for any purpose
• Share data with other users without your explicit consent

7. If Konduktum Is Ever Acquired#

We intend to build this platform independently, for the long term. But we are honest enough to address the scenario where that changes, because this is exactly where other platforms have failed their creator communities.

If Konduktum is ever subject to a merger, acquisition, or sale of assets, the following commitments apply:

• We will notify all creators and users by email at least 30 days before any transfer of data to a new entity
• All creators will have the right to export their full subscriber list and account data before any transfer takes effect
• We will only proceed with a transfer if the acquiring entity contractually agrees to honour the same data commitments in this policy
• We will publish the identity of any acquirer and the terms of their data commitments before the transfer date

Your subscriber list belongs to you. We will not allow an acquisition to become a mechanism for transferring your audience relationship to a new owner without your knowledge and consent. This commitment is the legal and moral floor, not a marketing statement.

8. How Long We Keep Your Data#

8.1 While Your Account Is Active#

We keep your account data (name, email, username) and your subscriber list for as long as your account is open. We do not retain data beyond what is needed for the platform to function.

8.2 When You Leave#

When you close your account:

• Your account data is deleted from active systems within 30 days
• Your content files are deleted from our servers within 30 days, unless you request an extension
• Your subscriber list is exported to you in full before deletion, if you request it
• You receive a confirmation email when deletion is complete

8.3 What We Retain for Legal Compliance#

We retain transaction records (amount, date, type — not card data) for 7 years as required by Estonian tax law and EU VAT regulations. We retain records of disputes and complaints for 3 years as required for legal defence. This is the minimum required by law.

8.4 Backup Systems#

Deleted data may persist in encrypted backup archives for up to 90 days before those backups are overwritten. During this period, the data is isolated from active systems and is not accessible or processed.

9. Your Rights#

9.1 Under GDPR (EEA and UK Users)#

You have the following rights over your personal data:

• Access: request a copy of all personal data we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your data (“right to be forgotten”)
• Portability: receive your data in a structured, machine-readable format
• Restriction: request that we limit processing of your data in specific circumstances
• Objection: object to processing based on legitimate interests
• Withdraw consent: withdraw any consent you have given, at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, email privacy@konduktum.com. We will respond within 30 days. We will not charge a fee for reasonable requests.

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or with the supervisory authority in your country of residence.

9.2 Creator-Specific: Subscriber List Portability#

As a creator, your subscriber list is yours. You can export it at any time, with no restrictions, no fees, and no conditions. To export your list:

• Go to account settings and select ‘Export subscriber list’
• Your full list is delivered as a CSV within 5 business days
• You may export as frequently as you need

We will never make it difficult to export your subscriber list. If you encounter any friction in the export process, email support@konduktum.com immediately. That friction is a bug, not a policy.

9.3 Deleting Your Account#

You can delete your account at any time from account settings or by emailing support@konduktum.com. Deletion is immediate and permanent. We will send you a confirmation email and your subscriber list export (if requested) within 5 business days.

10. How We Protect Your Data#

We implement appropriate technical and organisational security measures:

• All data in transit is encrypted via TLS
• All data at rest is encrypted
• Access to personal data is restricted to the two people who operate the platform, and to Stripe for payment processing
• We conduct regular security reviews
• We do not store payment card data at any point

No platform can guarantee absolute security. If we become aware of a data breach that affects your personal data, we will notify you and the relevant supervisory authority within 72 hours, as required by GDPR Article 33.

11. AI and Training Data#

Konduktum does not use your content, your subscriber data, or any other personal data to train AI models.

We do not licence your data to AI companies. We do not allow third parties to scrape the platform for training purposes. We take technical measures to prevent automated scraping.

This applies to all data on the platform regardless of whether it is AI-labelled content or fully human-created work.

Artists should not become fuel for AI systems they did not consent to train. This is not a legal technicality for us — it is a values commitment that predates the regulatory conversation.

12. International Data Transfers#

Konduktum is based in Estonia and our servers are located in Estonia and Germany, within the European Economic Area (EEA). Your data does not leave the EEA under normal circumstances.

Stripe may process payment data in the United States. Stripe is certified under the EU-US Data Privacy Framework and uses Standard Contractual Clauses. Details are in Stripe’s privacy policy.

If you access the platform from outside the EEA, you understand that your data will be stored and processed within the EEA, where GDPR applies.

13. Children’s Privacy#

Konduktum is not intended for users under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has registered on the platform, please contact privacy@konduktum.com and we will delete the account immediately.

14. Changes to This Policy#

We may update this policy when necessary — to reflect changes in the law, in our practices, or in the platform. When we do:

• We will notify all users by email at least 30 days before changes take effect
• We will publish a plain-English summary of what changed and why
• Material changes give you the right to close your account and export your data before they take effect
• We will not apply changes retroactively

The effective date at the top of this document will be updated with each revision. Previous versions are available on request.

15. Contact Us#

For any privacy question, data subject request, or concern:

Email: privacy@konduktum.com

We read everything and respond to every genuine privacy enquiry personally. We are two people — you will not receive an automated response.

If you have a complaint about how we have handled your data, please contact us first. We would rather fix it than have you go straight to a regulatory authority — though that is always your right.

This policy was written to reflect what we actually believe: that creators deserve a platform that is structurally on their side, and that every person who uses Konduktum deserves honesty about how their data is handled. If anything in here contradicts that belief, tell us. We will fix it.