Privacy Policy

1. Who we are

SudoStage (sudostage.link) is operated by SUDO Media, a trading name of Alfie Keates, a sole trader based in the United Kingdom (“SUDO Media”, “we”, “us”, “our”).

For the personal data described in this policy, SUDO Media is the controller: we decide how and why it is processed, and we are responsible for it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to everyone who uses SudoStage: artists and their representatives who create an account, visitors such as promoters, press and fans who view or download from artist pages, and people whose details artists add to their pages.

2. Summary

• We collect only what we need to run SudoStage and keep it secure.
• We don’t sell personal data, use advertising trackers or run analytics on visitors.
• Anything an artist publishes on their page is public. Everything else (account details, drafts, unpublished files) is private.
• Music and video players from other companies only load when you choose to play them.
• We only email you about your account (confirming your address, password resets, security notices), never marketing.
• Artists can edit, download or delete their data at any time from their studio.

3. What we collect

If you create an account

• Account details: your email address, a securely hashed version of your password (we never store or see your actual password), and the date you joined.
• Two-factor authentication: if you turn it on, the secret key that links your authenticator app to your account.
• Email confirmation: whether, and when, you confirmed that your email address belongs to you.
• Agreement records: which version of our Terms of Use and this policy you accepted, and when, and your confirmation that you are 18 or over and authorised to represent the artist.
• Page content: everything you add in the studio, such as your artist name, biography, links, shows, contacts, press photos, logos and documents. This includes drafts and published versions, and any earlier page addresses you’ve used.
• File details: the names, sizes and dimensions of files you upload.
• Sign-in records: active login sessions (stored as a scrambled reference, not the session key itself).

If you visit SudoStage (with or without an account)

• Technical and security data: your IP address, the pages and files you request, and your browser type. We use this to deliver the site, block attacks and abuse, and apply rate limits.
• Bot-check data: when you sign up, log in or reset a password, Cloudflare Turnstile checks that you’re human using signals from your browser and device.

If you report a page

• The page you report, the type of problem, the details you give, and your name and email address if you provide them (an email address is required for copyright, impersonation and privacy reports), plus your IP address to prevent abuse of the report form.

If you contact us

• Your name, email address and anything you include in your message, for example a privacy request or a complaint.

We don’t ask for, and you shouldn’t upload, special category data (such as health, religion or political opinions) or criminal offence data.

4. How we use it and why

UK data protection law requires a lawful basis for each use of personal data. Ours are:

Where we rely on legitimate interests, we have weighed them against your rights and kept the data to a minimum. You can object (see section 12).

We don’t use your data for advertising or marketing. If we ever want to send you marketing, we will ask first.

5. What is public

Once you press Publish, everything on your page, including any contact details and files you’ve added, is visible to anyone with the link and can be downloaded, copied or shared. Search engines may index published pages. Only publish what you’re happy to make public.

Your email address, password, drafts and unpublished files are never shown on your page. You can take your page offline or delete it at any time.

6. People named on artist pages

Artists may add other people’s details to their pages, such as an agent’s or manager’s contact details, a photographer’s name, or photos of band members. The artist who adds them is responsible for having permission and for telling those people.

If your details or image appear on an artist page and you want them removed or corrected, use Report this page at the bottom of the page (or our report form), or email contact@sudomedia.uk with the page address. We will act on valid requests promptly.

7. Who we share it with

We don’t sell or rent personal data. We share it only with the following:

• Cloudflare, Inc.: hosts SudoStage and provides our database, file storage, content delivery, firewall, bot checks (Turnstile), logs and the sending of account emails. Cloudflare acts as our processor under its Data Processing Addendum and may only use the data to provide those services.
• Have I Been Pwned (Pwned Passwords): when you choose a password, we send only the first 5 characters of a one-way scrambled form (hash) of it, to check whether it has appeared in a known data breach. Your password, email and identity are never sent.
• Music and video providers (SoundCloud, Spotify, Mixcloud, Apple Music, YouTube/Google, Vimeo): only if you press play on an embedded player. They then receive data directly from your browser under their own privacy policies.
• Our email provider: to receive and reply to messages you send to contact@sudomedia.uk.
• The artist concerned: when we act on a report, we tell the artist what was removed and why. We don’t share the reporter’s name or contact details with the artist unless they agree or the law requires it.
• Authorities and advisers: where required by law, a court order or a lawful request (including reporting child sexual exploitation and abuse to the National Crime Agency or the Internet Watch Foundation), or to protect our rights, users or the public; and our professional advisers, such as lawyers and accountants, under confidentiality.
• A future owner: if SudoStage is sold or transferred, your data may pass to the new owner, who must respect this policy. We will tell you first.

8. International transfers

Our database and file storage are located primarily in Western Europe. Cloudflare runs a global network, so some data (such as your IP address and the requests your browser makes) may be processed in other countries, including the United States, to deliver and protect the site.

Where personal data is transferred outside the UK, it is protected by Cloudflare’s Data Processing Addendum, which incorporates the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Cloudflare is also certified under the UK Extension to the EU–US Data Privacy Framework.

9. How long we keep it

Visitors who have already downloaded or copied published material keep their copies; we can’t delete those.

10. Cookies and similar technology

We use only what’s strictly necessary, so we don’t need to ask for consent and don’t show a cookie banner:

Third-party players: artist pages show a play button instead of loading SoundCloud, Spotify, Mixcloud, Apple Music, YouTube or Vimeo players automatically. Only when you press it does the player load, and that company may then set its own cookies under its own policy. Pressing the button is your consent; to avoid those cookies, use the “Open on…” link or don’t load the player.

We don’t use analytics, advertising or social media tracking cookies.

11. Security

We protect personal data with measures appropriate to the risk, including:

• encryption in transit (HTTPS only)
• salted, slow password hashing
• optional two-factor authentication
• breached-password checks
• bot protection, firewall rules and rate limiting
• strict browser security policies
• private storage for drafts
• access to admin tools limited to authorised SUDO Media staff, who must use two-factor authentication

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will report it to the Information Commissioner’s Office within 72 hours where required, and tell you without undue delay if the risk to you is high.

You can help: use a unique password, turn on two-factor authentication, and tell us at once if you think your account has been misused.

12. Your rights

Under UK data protection law you have the right to:

• Access your personal data and get a copy
• Rectification: have inaccurate data corrected
• Erasure: have your data deleted
• Restrict how we use your data
• Object to processing based on legitimate interests
• Data portability: receive your data in a machine-readable format
• Withdraw consent at any time, where we rely on it (this doesn’t affect anything done before)

Artists can do most of this themselves in the studio: edit anything on the page, use Download my data in the Account tab to get a copy of everything we hold (including original files), and Delete my account to erase it.

For anything else, email contact@sudomedia.uk. We will reply within one month (this can be extended by up to two further months for complex requests; if so, we’ll tell you why). It is free, unless a request is clearly unfounded or excessive. We may need to confirm your identity first.

13. Children

You must be 18 or over to create a SudoStage account. Artist pages are not aimed at children. If we learn that an account belongs to someone under 18, we will delete it. If you think a child has given us personal data, please contact us.

14. Automated decisions

We don’t make decisions about you that have legal or similarly significant effects based solely on automated processing. Automated security checks may temporarily block suspicious requests:

• rate limits
• bot checks
• breached-password checks
• storage limits

If you think you have been blocked in error, contact us and a person will review it.

15. Changes to this policy

We may update this policy, for example if we add features or change providers. The version and effective date at the top will change. If the changes are significant, we will tell account holders in the studio, and ask them to accept the update, before the changes apply.

16. Contact and complaints

For questions, privacy requests or concerns, email contact@sudomedia.uk, or write to SUDO Media, 4 Westmorland Drive, Bognor Regis, PO22 8LX, United Kingdom.

If you’re unhappy with how we’ve handled your data, please contact us first so we can try to put it right. You also have the right to complain to the UK regulator, the Information Commissioner’s Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF