Privacy Policy

1. Who is responsible

Kaweya, 8903 Glades Rd, Ste A8 #2232, Boca Raton, FL 33434, United States, is responsible for this website and decides how your information is used (the "controller").

Privacy contact: artists@kaweya.com. We have not appointed a data protection officer or an EU/UK representative; see section 14.

2. Information we collect and where it comes from

• Contact form (from you): name, email address, inquiry type, subject and message.
• Newsletter sign-up (from you): email address, the consent wording you accepted, the date and time, the form used and the site language.
• Privacy requests (from you): name, email, request type, optional country/state and details, the date, and the country your connection comes from.
• Cookie choices (from your browser): a random visitor ID, the categories you allowed, whether your browser sent a Global Privacy Control signal, the policy version, the date, the site language and the country your connection comes from. We do not store your IP address with this record.
• Security and technical data (from your browser and device, collected by our hosting and anti-spam providers): IP address, browser and device type, request times and a bot-detection score. Our anti-spam check sends your IP address to Cloudflare to confirm you are human.
• Administrator account: only the site owner has an account (email and password, handled by Supabase). Visitors cannot create accounts.
• Optional tools, only with your consent: YouTube, Spotify, Apple Music, Audiomack and SoundCloud players, Google Analytics and advertising tools such as the Meta Pixel can collect device identifiers, IP address, pages viewed and interactions. These are switched off until you allow them.

3. Why we use it and our legal basis

• Replying to your inquiry and managing bookings — steps you ask us to take before a contract, and our legitimate interest in answering messages (GDPR Art. 6(1)(b) and (f)).
• Sending the newsletter — your consent (Art. 6(1)(a)). You can withdraw it at any time.
• Handling privacy requests and keeping proof of consent — legal obligation (Art. 6(1)(c)).
• Protecting the website and forms from spam and abuse — legitimate interest (Art. 6(1)(f)).
• Embedded players, analytics and advertising — your consent (Art. 6(1)(a) and the ePrivacy rules).

4. Who receives your information

We do not sell your information for money. If you allow Advertising, information about your visit is shared with advertising platforms, which some US state laws treat as a "sale" or "sharing". You can stop this with the "Do Not Sell or Share" link in the footer.

• Cloudflare, Inc. (USA) — website hosting, network security and the Turnstile anti-spam check.
• Supabase, Inc. (USA) — database, file storage and administrator sign-in.
• Lovable (Sweden) and its email delivery partners — sends the site owner an email alert for each contact message or privacy request.
• Kaweya's email provider — receives the alerts at artists@kaweya.com.
• Google LLC / Google Ireland — YouTube player and, if enabled and allowed, Google Analytics.
• Spotify AB (Sweden) — the Spotify player, if allowed.
• Apple Inc. (United States) — the Apple Music player, if allowed.
• Audiomack Inc. (United States) — the Audiomack player, if allowed.
• SoundCloud Global Limited & Co. KG (Germany) — the SoundCloud player, if allowed.
• Meta Platforms — the Meta Pixel, if enabled and allowed.
• Professional advisers and authorities when the law requires it.

No artificial intelligence service receives the information you submit.

5. International transfers

Our main providers are based in, or process data in, the United States. Where personal information from the EU, UK or Switzerland is transferred, we rely on the provider's certification under the EU-US Data Privacy Framework (and its UK and Swiss extensions) where available, or on the European Commission's Standard Contractual Clauses included in the provider's data processing terms.

6. How long we keep it

• Contact messages: 24 months after the last exchange, unless needed for an ongoing booking or contract.
• Newsletter: until you unsubscribe. We then keep your email address and the date only as a "do not email" record, unless you ask us to delete it.
• Privacy requests: 3 years after they are closed, to show how we handled them.
• Cookie choice records: 3 years. Your choice in your browser expires after 12 months, and we ask again.
• Hosting and security logs: as set by Cloudflare and Supabase, usually days to weeks.

7. Security

All traffic uses HTTPS. Forms are protected by Cloudflare Turnstile and input checks. The database uses row-level security so visitors cannot read submissions. Only the administrator can see them, after signing in, and repeated failed sign-ins are locked. Secret keys are stored only on the server. Our providers encrypt data at rest. No system is perfectly secure; if a breach affects you, we will tell you and the authorities where the law requires.

8. Your rights

Depending on where you live, you can ask to: access your information; correct it; delete it; restrict how it is used; object to its use, including for direct marketing (always honored); receive a copy in a portable format; withdraw consent at any time (this does not affect earlier use); and opt out of the sale or sharing of your information and of targeted advertising.

To change cookie choices, use Cookie settings. To unsubscribe from the newsletter, use the link in any newsletter email or the privacy request form.

9. How to make a request

Use the privacy request form or email artists@kaweya.com. We reply within 30 days (45 days where US state laws allow, with notice if we need more time). To protect you, we may ask you to confirm the request from the email address we hold, or for a few details we already have. We do not ask for ID documents unless strictly needed. An authorized agent must show written permission. We will not treat you differently for using your rights.

10. Complaints

Please contact us first. You can also complain to your local data protection authority — in the EU, see the list at edpb.europa.eu; in the UK, the ICO (ico.org.uk); in France, the CNIL (cnil.fr); in California, the California Privacy Protection Agency (cppa.ca.gov); or your state Attorney General.

11. Automated decisions and profiling

We make no decisions about you by automated means alone. If you allow Advertising, advertising platforms may use your visit to build ad audiences (profiling for advertising).

12. Children

This website is not directed to children under 16, and we do not knowingly collect their information. If you believe a child has sent us information, contact us and we will delete it.

13. California and other US states

See our privacy request page for the Notice at Collection. In the last 12 months we collected: identifiers (name, email, IP address), internet activity (pages, interactions, only with consent), approximate location (country) and inferences used for advertising (only with consent). We do not collect sensitive personal information as defined by California law. We honor Global Privacy Control signals as an opt-out of sale and sharing.

14. Changes

We will update this page and the dates above when our practices change, and ask for your cookie consent again when the cookie policy changes (current version 2026-10-14).