How we collect, store, use, and protect your personal data — including data processed through advertising platform integrations such as the Google Ads API.
ŌTOCRACY (“ŌTOCRACY”, “we”, “us”, or “our”) operates this website and provides music marketing and advertising-campaign management services for recording artists and labels. This Privacy Policy explains what personal data we collect, why we collect it, how we store and manage it, and the rights you have over it.
The service is operated by Otocracy Group OÜ, a private limited company registered in Estonia (registry code 17554151), with its registered office at Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Harju maakond, Estonia. See our company details page for full registration information.
We are the data controller for the personal data described here, with one important exception: fan data collected through an artist’s smartlink or download gate belongs to that artist. The artist is the data controller; we process it on their behalf (see section 5 and our data processing terms). If you have any questions about this policy or how we handle your data, contact us at office@otocracy.com.
We collect the following categories of personal data:
We use personal data to:
Our legal bases for processing are the performance of our contract with you, your consent (which you may withdraw at any time), our legitimate interests in operating and securing the service, and compliance with applicable law.
When you connect an advertising account, we use the official APIs provided by those platforms — including the Google Ads API, Meta Marketing API, TikTok Marketing API, and YouTube/Google APIs — strictly to manage the campaigns you have authorized.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell platform data, use it for advertising unrelated to your campaigns, or allow humans to read it except where necessary to operate the service, for security purposes, or as required by law. You can revoke our access to any connected account at any time from within that platform’s own settings.
Artists and labels use our smartlink and download-gate pages to collect fan email addresses. For that data, the artist (or label) is the data controller and we are the processor: the list belongs to them, we store and handle it only to provide the service they asked for, and we never use it for our own marketing, never sell it, and never share it with other artists. The full terms are in our data processing terms.
We do not sell your personal data. We share it only with service providers who help us run the service, and only to the extent necessary:
These providers process data under contract and are not permitted to use it for their own purposes.
Personal data is stored on secured, access-controlled infrastructure. We apply encryption in transit, restrict access to authorized personnel, and retain data only for as long as needed to provide the service, meet legal and accounting obligations, and resolve disputes. When data is no longer needed, we delete or anonymize it. No method of transmission or storage is perfectly secure, but we take reasonable technical and organizational measures to protect your information.
We use cookies and similar technologies to keep the site working, to understand how it is used, and to measure our own advertising. What happens on your first visit depends on which country you are visiting from. Our hosting provider derives the country from your IP address; for this purpose we keep only its two-letter code, in the oto_geo cookie described below:
Wherever you are, you can switch analytics and marketing off, or change or withdraw your choice, at any time through Cookie Settings in the footer of every page (or the small “Cookies” button on pages without that footer). When you switch them off, we stop them and delete their cookies from your browser, and that choice then applies on every later visit, whatever country you visit from. Your choice is kept for six months, after which the rules above apply again.
utm_source, and its title), the website that referred you (its domain only), the campaign tags in the link you followed, your country, the type of device, browser family, operating system and language, and whether you started or requested a Signal Audit or began a checkout. Nothing is stored on or read from your device for this, and no cookie is set. In place of a cookie, the visit carries a pseudonymous code that our server computes from your IP address and browser details together with a secret key that changes every day and is never stored. Your IP address itself is not sent to Google, no account or email is attached, and because the key changes at midnight (UTC), neither we nor Google can connect your visits on different days. We do this on the basis of our legitimate interest in understanding how our website is used and improving it (Art. 6(1)(f) GDPR). If your browser sends a Global Privacy Control or Do Not Track signal, we do not send this copy, and you can object at any time by writing to office@otocracy.com. When analytics cookies are on (because you allowed them, or by default outside Germany), this stops and Google Analytics measures your visits with cookies instead, as described next. Unlike that measurement, it never involves session replays, advertising or Meta.oto_consent cookie that remembers your cookie choice (six months), and the oto_geo cookie that holds only your two-letter country code, so the site knows whether to ask first (30 days)._ga and _ga_*, up to two years) and Microsoft Clarity (Microsoft Ireland Operations Ltd., cookies _clck and _clsk, up to one year), which show us which pages work and which don’t. With Google signals turned on, Google may add aggregated age, gender and interest estimates for visitors signed in to a Google account who allow ad personalization; we only ever see these as totals, never per person. If you switch analytics off (or, in Germany, until you allow it), no Google Analytics or Clarity cookie is set and Clarity does not run; Google Analytics receives only cookieless signals without identifiers from your browser (Google Consent Mode), plus the cookieless copy of our visit count described above._fbp and _fbc, 90 days). They tell Meta which of our pages you viewed and whether you requested a Signal Audit, created an account, started a checkout, or paid, together with your IP address and browser details. When you give us your email address in one of our forms (for example to receive a Signal Audit) or complete a purchase, we also send that address, hashed so Meta can only match it to an account it already knows. We use this to measure our Instagram and Facebook ads and to show our ads to people who have visited our site. For the collection and transmission of this data we and Meta are joint controllers; Meta’s own processing is governed by its privacy policy. If you switch marketing off (or, in Germany, until you allow it), none of this is sent.Depending on your location, you have the right to access, correct, delete, or export your personal data; to object to or restrict certain processing; and to withdraw consent at any time. You may also lodge a complaint with your local data protection authority.
To exercise any of these rights, email us at office@otocracy.com. We will respond within the timeframe required by applicable law.
Some of our providers may process data in countries other than your own. Where personal data is transferred internationally, we rely on appropriate safeguards, such as standard contractual clauses, to ensure it remains protected.
Our services are intended for users aged 18 and over and are not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you. Your continued use of the service after an update means you accept the revised policy.
For any question about this policy, your data, or to exercise your rights, contact us at office@otocracy.com.