When it comes to personal data (anything that can identify a person, like a name, email address, or location) there are three key roles defined under data protection law:

Data controller: The person or organisation that decides why data is collected and how it's used. They are ultimately responsible for that data and for ensuring it's handled lawfully.

Data processor: A third party that handles data on the controller's behalf, following the controller's instructions.

Sub-processor A third party engaged by a processor to help carry out specific data processing tasks (still on behalf of the controller).

At Openstage, you are the data controller of your fan data. Openstage is your data processor. We provide the infrastructure that collects, stores, and processes fan data, but we do so on your behalf and under your direction.

This means your fan relationships are yours. No other platform gives artists this level of legal ownership over their fan data.

Being the data controller comes with real responsibilities. Here's what that means for you as an artist on Openstage:

You must have your own Terms of Service and Privacy Policy that your fans can read. These should explain:

Openstage auto-generates both documents for you, pre-filled with your information, and automatically applies them across your fan-facing surfaces. You can review, edit, or replace them any time in Artist Settings → Compliance.

You are responsible for making sure fans have agreed to their data being collected; typically by accepting your terms and privacy policy when they sign up. Openstage handles the consent mechanism on your fan-facing surfaces, but the legal basis for that consent sits with you as the controller.

Fans have the right to ask:

As the data controller, you are responsible for responding to these requests. Openstage cannot do this on your behalf.

We've built a tool directly into the platform to make this straightforward.

As the controller, you're responsible for ensuring fan data is handled securely. Openstage maintains robust security infrastructure on your behalf as your processor, but you should also take care with how you access, export, or share fan data outside the platform.

While the legal responsibility sits with you, Openstage has built the tools to make compliance as easy as possible.

Auto-generated Terms and Privacy Policy

When you join Openstage, we generate a Terms of Service and Privacy Policy for you, pre-filled with your artist information. These are live across your fan-facing surfaces from day one. You can edit key fields, rewrite them entirely, or replace them with your own documents.

Compliance section in Artist Settings

Everything you need to manage your compliance obligations lives in one place: your terms, your privacy policy, and the tools to handle fan data requests.

Fan data request tools

When a fan contacts you about their data, you can action the request directly inside Openstage without needing to handle raw data exports or contact our support team.

Data Processing Addendum (DPA)

Openstage operates under a formal DPA with all artists, which defines exactly how we handle your fan data as your processor. This gives you a clear legal record of our obligations to you.

Our current sub-processors are Amazon Web Services (EU) and Google, both used for cloud hosting, storage, and data processing. These are listed in the DPA. If we ever engage a new sub-processor, we'll notify you in advance. You'll have 5 business days to raise any objection on data protection grounds before the engagement proceeds. We ensure all sub-processors are bound to data protection obligations equivalent to those we hold ourselves to.

To be clear about the boundaries:

GDPR (General Data Protection Regulation) is a data protection law that applies to anyone collecting personal data from people in the European Union or United Kingdom, regardless of where you're based. If any of your fans are in the EU or UK, GDPR applies to you. Other regions have similar laws (CCPA in California, for example). As the data controller, you are responsible for compliance with applicable laws in the territories where your fans are based.

This is called a deletion request (or "right to erasure" under GDPR). You're required to action it. Use the fan data request tool in Artist Settings → Compliance to process it directly inside Openstage. → [See here for how to handle fan data requests]

Under GDPR, you must respond within 30 days. We recommend acknowledging the request promptly and using the in-platform tool to action it as quickly as possible.

You can replace the auto-generated versions at any time in Artist Settings → Compliance — either by uploading a document to be hosted on your Openstage link, or by providing a URL to your own hosted terms.

Do I need a lawyer to review my terms? Openstage is not providing legal advice. The auto-generated policies cover the essentials, but if you have specific requirements or operate in regulated markets, a legal review is a good idea.

A Data Processing Addendum is a formal agreement between you (the controller) and Openstage (the processor) that defines how we handle your fan data.

Our current sub-processors are Amazon Web Services (EU) and Google, used for cloud hosting, storage, and data processing. If we add a new sub-processor, we'll notify you in advance and give you 5 business days to raise any objection.

Any third-party tool you connect to your fan data is a sub-processor under your controllership. You are responsible for making sure those tools handle fan data compliantly. Openstage's DPA covers our role only, not tools you bring in independently.

Openstage acts as an independent controller only for its own administrative data — your account details and your team members' platform accounts. This is separate from your fan data and is not part of your controllership.

As the data controller, your fan data belongs to you. [See here for more information on closing an Openstage account.]

Have a question that isn't covered here? Reach out to us at support@openstage.live.