artistbrain

Privacy Policy

Last updated: 18 October 2026

This policy explains which personal data Artist Brain processes, why, and what rights you have. Artist Brain is a platform for artist management teams. It is currently in alpha.

1. Who is responsible

Harbour Intelligence GmbH, Moltkestraße 97, 40479 Düsseldorf, Germany. Email: kontakt@harbour.de. Further details are in the Imprint.

For your account and for this website we are the controller. For the content a team stores in Artist Brain (for example contacts, shows, travel, contracts and documents) the organisation that runs the team is the controller, and we process that content on its behalf as a processor under Art. 28 GDPR. Questions about such content are best directed to that organisation first.

2. What we process

Your account

  • Your email address, which is also how you sign in.
  • Your name as it appears in a team, and optionally a profile photo and the role you chose during setup.
  • Which teams you belong to and which roles and permissions you have there.
  • Whether and when you agreed to the AI features.

What you and your team enter

Depending on what a team uses: shows and their deals, schedules, travel bookings and guest lists; contacts with names, email addresses, phone numbers, companies and, where entered, billing and bank details; contracts, releases, invoices, content plans, an electronic press kit (EPK); uploaded files and photos. This can include data about people who do not have an account themselves.

Activity in a team

To keep a team traceable, Artist Brain logs who changed what and when (for example a show, a role or an invitation). These logs are visible to the team.

Technical data

When you visit the website, our hosting provider processes technical data such as your IP address, the time of the request and your browser's user agent in order to deliver the page and keep it secure.

3. Purposes and legal bases

  • Providing the account and the platform: Art. 6(1)(b) GDPR (performance of the contract or steps prior to it).
  • Security, abuse prevention, error analysis and the activity log: Art. 6(1)(f) GDPR (our legitimate interest in a secure and traceable service).
  • AI features: Art. 6(1)(a) GDPR (your consent, see section 6).
  • Content a team stores: on behalf of and according to the instructions of the team's organisation.

4. Service providers

We use the following providers. They process data only on our behalf and under a data processing agreement.

  • Vercel Inc.(USA), hosting of the website and application. Our application runs in Vercel's Frankfurt region (Germany).
  • Supabase Inc. (USA), database, sign-in and file storage. Our project is hosted in the Frankfurt region (Germany). All account data, team content and files are stored there.
  • Resend (Plus Five Five, Inc., USA), sending emails, for example when you are added to a team. Sign-in codes are sent by Supabase.
  • Google (Google Places API), suggestions and addresses when you type a venue or place. Only the typed text (at most 120 characters), a random session identifier and the language are sent, from our server. Google receives no name, email address, team data or your IP address.
  • Wikipedia / Wikimedia Commons, a picture of the venue or city of an upcoming show. Only the name of the venue and city is sent, from our server. The picture is delivered through our own address.
  • Vercel AI Gateway and the provider of the AI model, for the AI features, only with your consent (section 6).

Some providers are based in the USA or may access data from there. Vercel is certified under the EU-U.S. Data Privacy Framework. For Supabase and Resend, the transfer is based on the EU Standard Contractual Clauses in their data processing agreements. The AI model providers (section 6) act as subprocessors of Vercel.

5. Sign in with Google

If you choose "Continue with Google", you are redirected to Google. Google tells us your email address and, depending on your Google account, your name and profile picture. We use this only to sign you in to the same account as with your email address. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Art. 6(1)(b) GDPR.

6. AI features

Artist Brain can read documents for you (for example a contract or an itinerary) and answer questions in a chat. Before the first use we ask for your consent. Only then are the document, your messages and the team data read for them sent via the Vercel AI Gateway to Anthropic's Claude model. The gateway may have the request processed by Anthropic or by another provider of the same model (Amazon Web Services or Google Cloud). Account numbers (IBANs) are removed before anything is sent. Chats are saved in Artist Brain and visible only to you. We log each AI request without its content: who, when, which document and how many tokens.

Your consent applies to all your teams. You can withdraw it at any time with effect for the future by writing to us. Processing before the withdrawal remains lawful.

Vercel deletes the content of a request as soon as it is completed. Anthropic deletes inputs and outputs of its API within 30 days; it keeps them longer only where required by law or to enforce its usage policy (up to two years for requests flagged as misuse). The AI providers do not use this data to train their models.

7. What becomes public

A team can share its electronic press kit (EPK) via a link, and you can share your personal contact card via a link or QR code. Everything on them can be seen by anyone who has the link, until the link is withdrawn. Nothing else in a team is visible outside it.

8. Cookies and local storage

We only use cookies and browser storage that are strictly necessary for Artist Brain to work (§ 25(2) TDDDG). There is no analytics, no advertising and no tracking. We therefore do not ask for cookie consent.

  • Sign-in session (sb-…-auth-token), and while signing in with Google a one-time verification cookie.
  • If you use several accounts in one browser: the list of these email addresses (ab-konten) and their parked sessions (ab-park-…), so that you can switch without signing in again.
  • Display preferences such as the colour scheme, sidebar and overview layout (ab-theme, ab-leiste, ab-uebersicht).
  • Where to return after changing account settings (ab-konto-ziel).
  • In local storage, the column widths you set; in session storage, the email address typed on the home page until you open the sign-in.

9. How long we keep data

We keep account data for as long as your account exists. When you ask us to delete your account, we delete it unless we are legally required to keep certain data.

  • Team content stays until someone in the team deletes it.
  • A team that is closed is deactivated: nobody can see its content any more. It is deleted permanently on request.
  • The activity log of a team is kept as long as the team exists.
  • AI chats stay until you delete them.
  • Entries sent via a contact card and not accepted by the team are deleted automatically after 30 days.
  • Technical logs at our hosting and database providers are kept for at most one day.

10. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR), and to object to processing based on our legitimate interest (Art. 21 GDPR). To exercise them, write to kontakt@harbour.de.

You also have the right to lodge a complaint with a supervisory authority, for example the authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

11. Is providing data required?

An email address is required to create an account. Everything else is optional. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

12. Changes

We update this policy when Artist Brain or the law changes. The current version is always available on this page.