Privacy Policy

What we collect

We only collect information you provide directly through the artist application form:

• —Identity & contact — artist name and email address.
• —Location — country of residence.
• —Music profiles — optional links to your Spotify, Apple Music, YouTube, and Instagram profiles.
• —Your message — an optional free-text description of your work.
• —Technical data — a one-way hash (SHA-256) of your IP address and your browser user-agent string, collected at the time of submission for abuse prevention. We do not store your IP address in plaintext.

If you only browse the site without submitting a form, we do not collect or store any personal information about you unless you have consented to analytics (see below).

How we use it

• —To review your application and decide whether to extend an invitation.
• —To send a confirmation email acknowledging receipt of your application.
• —To prevent spam and automated abuse of the submission form.
• —To contact you with our decision, or with questions about your application.

We do not sell your data. We do not share it with third parties for marketing purposes.

Third-party services

• —Supabase — application data is stored in a Supabase PostgreSQL database hosted in the EU. Supabase acts as a data processor under our instructions.
• —Resend — confirmation and notification emails are sent via Resend, a transactional email service. Only the recipient address and the email content are shared.
• —Cloudflare Turnstile — we use Turnstile as a bot-detection challenge on the application form. Cloudflare may set a cookie and process limited browser signals to distinguish humans from bots. This is a security-essential service and operates regardless of your analytics preference.
• —Analytics — we optionally use Vercel Analytics, Google Analytics, and/or Plausible to understand site usage. These are only activated with your explicit consent. See our Cookie Policy for details.

Data retention

Application data is retained for as long as necessary to manage our roster and review future applications. IP hashes are retained for a limited period for abuse-prevention purposes. You may request deletion at any time (see below).

Your rights

Depending on where you are located, you may have the right to:

• —Access the personal data we hold about you.
• —Correct inaccurate information.
• —Request deletion of your data.
• —Object to or restrict certain types of processing.
• —Withdraw consent for analytics at any time via our cookie preferences.

To exercise any of these rights, email us at hey@kotha.team. We will respond within 30 days.

Cookies

For a full description of the cookies this site uses, see our Cookie Policy.

Changes to this policy

We may update this policy from time to time. The effective date at the top of the page will always reflect the most recent revision. Continued use of the site after a change constitutes acceptance of the updated policy.