Privacy notice

Effective 12 November 2026

This notice covers LabelKit: labelkit.co, the label workspaces on it, and branded workspaces such as erms.epsilonrecords.com. It says what personal data LabelKit processes, why, and who helps us process it.

1. Who is responsible

LabelKit is run by Epsilon Records, Nieuwe Uilenburgerstraat 21C, 1011LM Amsterdam, the Netherlands. For anything about your personal data, write to hello@epsilonrecords.com.

We have two roles:

Controller for your account, your label's subscription and billing, and the security and support of the service.
Processor for the catalogue a label keeps in LabelKit: artists, writers, credits, splits, agreements, consents and masters. The label decides what goes in and why, so the label is the controller of that data. If your details are in a label's catalogue, the label is the one to ask first. We act only on the label's instructions and help it answer you.

2. What we process

Account: your email address, the labels you belong to and your role in each, and when you signed in. There are no passwords: we email you a sign-in link.
Activity: an audit log of changes made in a label (who, what, when). It is append-only and does not store email addresses.
Catalogue: what a label enters or imports, including names of the people it works with, their roles and shares, agreements and consents, and uploaded master files with their analysis (loudness, key, tempo).
Billing: for a paid plan, the label's billing name, address, VAT number and payment details, handled by Stripe. We never see full card numbers.
Technical: IP address, browser details and error reports, to deliver pages and fix problems.
Usage events: a fixed list of product events, such as "release draft created", with the time and random identifiers for your account and label. They never contain names, email addresses, catalogue content, agreements, royalty figures, files or anything you type. We use them to see which features are used and to switch features on per label.

We do not use any catalogue data or masters to train AI, and we do not sell personal data.

3. Who helps us

Supabase: database and sign-in. The database is hosted in Frankfurt, Germany.
Netlify: hosting. Pages are served from its global network.
Cloudflare R2: private storage for master files.
AudioKit: audio analysis of masters. It is our own service, hosted on Railway.
Stripe: payments and invoices for paid plans.
Resend: sign-in and invitation emails.
Sentry: error reports.
PostHog: usage events and feature switches, hosted in the EU (Frankfurt). Our servers send it the usage events described above. Nothing from PostHog runs in your browser, and it sets no cookies.
Google Fonts: the typefaces. Your browser fetches them from Google.
Cloudflare Web Analytics, when enabled: aggregate page traffic and performance for LabelKit's public pages on labelkit.co (the home page, log in, sign up, this notice and the terms). Its beacon receives page and referring URL information and browser performance measurements. Cloudflare states that the beacon does not use cookies or browser storage or track people across customer sites. It is never loaded once you are signed in, nor on label workspaces or branded domains, and it skips pages whose address or referrer has a query or fragment. We only see aggregate reports. See Cloudflare's explanation of its beacon.

Several of these are based in the United States or may process data there. They do so under the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

4. Cookies

LabelKit sets only the cookies it needs to work: your sign-in session and which label you have open. There are no advertising or tracking cookies.

5. Legal bases

Providing the service you or your label signed up for: performance of a contract (Article 6(1)(b) GDPR).
Keeping invoices and tax records: legal obligation (Article 6(1)(c)).
Security, abuse prevention, error reports, support, aggregate analytics of the public pages and usage events: our legitimate interests (Article 6(1)(f)). You can object to these at any time.

6. How long data is kept

Account: until you or your label's owner removes it.
Catalogue and masters: until the label deletes them or closes its account. They are then deleted within 30 days, and from backups when those expire.
Audit log: for as long as the label exists.
Usage events: 1 year, then deleted by PostHog.
Invoices and payment records: 7 years, as Dutch tax law requires.

7. Your rights

You can ask for access to your personal data, or to correct, erase, restrict, or receive it in a portable form, or object to its processing. Write to the address above. For data in a label's catalogue, we pass your request to that label. You can also complain to the Autoriteit Persoonsgegevens in the Netherlands, or the authority where you live or work.

8. Changes

If what LabelKit processes changes, we update this page and its date. We tell label owners about significant changes by email.