Last updated 2026-10-13.
Who is responsible
Waveroom is run on a non-profit basis by Martin Antonsson, who is the data controller for the processing of personal data in the service. You can reach me at info@martinantonsson.com.
What data is processed
- Your account: name, email address, password (stored only as an encrypted hash – nobody can read it), language and theme settings, and when you last logged in.
- What you add: artist and band profiles, images, releases, campaign plans, artist plans, content plans, contacts and pitches.
- Sending: recipients, subject, text, time and delivery status. When email is sent via Resend, whether it was delivered, bounced or reported as spam is also recorded.
- Tracking links: when a recipient clicks a link in a pitch, the type of link and the time are recorded. The recipient's IP address and device are not stored for the click. Automated security scans of links are not counted.
- Logging in: while you're logged in, your IP address and browser are stored to protect your account.
- Reminders: the channels you choose and their targets, such as a webhook address or phone number. Targets are stored encrypted.
- Technical logs: error messages can contain your user ID. The web host keeps its own logs of visits to the site.
Why the data is processed
| Purpose | Legal basis |
|---|---|
| Providing the service: account, plans, sending, reminders, calendar | Contract (the terms of use) |
| Security and operations: sign-in, logs, backups, health checks | Legitimate interest |
| Improving the service: number of users and activity per account – never the content of pitches or contacts | Legitimate interest |
| The contact library (see below) | Legitimate interest |
When several people work on the same artist
If you invite others to an artist, or are invited, everyone with access to the artist can see each other's name and email address, and who has sent which pitch for the artist's releases. Contacts and reminders remain personal. The invitation email is sent to the address entered, and the invitation link is only stored as an encrypted checksum. Unanswered invitations expire after 14 days.
Contacts and recipients you add
When you add contacts and send pitches, you decide what data is processed and why. You are the controller for that data, and Waveroom processes it on your behalf as a processor under the terms of use.
Fans who sign up to an artist's newsletter
Artists can have an artist page and campaign pages on Waveroom where fans sign up to the artist's newsletter. This stores your email address, first name if you give it, which page you signed up through, exactly what you agreed to and when. Sign-ups are confirmed by email – without confirmation the sign-up is kept only as unconfirmed and is not used.
The artist is the controller for their fan list, and Waveroom stores it on the artist's behalf. The list is not shared with others and is not used by Waveroom for its own mailings. The artist can export the list to their newsletter tool. To unsubscribe or have your data removed, contact the artist or info@martinantonsson.com. The list is deleted if the artist is deleted.
The contact library
Waveroom has compiled a library of contact routes to media, radio, blogs, festivals and other recipients. The information comes from the recipients' own websites and public profiles, and is mainly editorial addresses and forms. The purpose is to help artists reach the right recipients with relevant pitches.
Are you in the library and want to be removed or correct something? Email info@martinantonsson.com and the information will be removed.
Services that receive data
| Service | Used for | Where |
|---|---|---|
| Simply.com | Web hosting and database | EU |
| Google (Gmail) | Sending email when Resend isn't used | Global |
| Resend | Sending email and delivery status | USA |
| OpenAI | AI suggestions for pitches and texts – only when AI is used. The profile, recipient type and draft are sent. | USA |
| Discord, Slack, Telegram, 46elks (SMS), Meta (WhatsApp) | Reminders – only the channels you choose | Varies |
| PayPal | Donations – only if you donate. Payment takes place at PayPal under their terms. | Global |
When data is transferred to the USA or other countries outside the EU, this is done with the safeguards the providers offer under the GDPR, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.
How long data is kept
- Account and content: until you delete your account. Everything is then deleted immediately, including uploaded images.
- Backups: 14 days, after which deleted data is gone from them too.
- Sign-ins: removed when you log out or after a period of inactivity.
- Logs: kept for a limited time for troubleshooting and cleared regularly.
Cookies
Waveroom only uses necessary and functional cookies: for signing in and protection against forged forms, for "Remember me" if you choose it, and for your language. No cookies are used for tracking or advertising, which is why there's no consent banner.
Your rights
- Get your data: My account → Download my data gives you everything in one file.
- Correct: edit directly in Waveroom.
- Delete: My account → Delete account.
- Object and restrict: processing based on legitimate interest – email info@martinantonsson.com.
You can also complain to the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), imy.se.
Security
The site uses an encrypted connection (HTTPS), passwords and reminder targets are stored encrypted, press kits can only be reached through secret links and each account can only see its own content.
Changes
The date at the top shows when the policy was last changed. Significant changes are announced in Waveroom.