A register only works if you can see how it moves. This page lists every party that receives data from The Artist Passport, what they get, and who is responsible for it once they have it.
It is referenced by our Privacy for contacts notice and by the API conditions of use.
Where the data comes from
We do not scrape. Everything in the register reaches us in one of nine ways:
- The artist. An owner of the artist enters it themselves.
- A team member. Someone the artist has given access to their profile.
- The holder. A person enters their own name and avatar photo, and asks us for a passport.
- A connected app. A booking system or similar tool an artist already uses, acting on that artist's instruction.
- Our own review. The verification status, the artist's number, and the decision on a passport request are set by us, not by the artist.
- A platform. Spotify for Artists sends a team invite to an address we publish, when an artist invites TAP as a Reader.
- A store the artist connects. When an owner connects a Shopify store, we read the products the store publishes to TAP, or, for a store connected by its address, the products it shows the public: names, prices, one image and their product pages. We read no customer or order data. For a store that added TAP, we keep the access Shopify grants TAP, encrypted, until the store removes TAP, and we add a code to the checkout links on the artist's pages so an order shows in the store as coming through TAP. Shopify tells us when a product changes or the store removes TAP.
- Spotify's catalogue. We read an artist's releases and their public details from Spotify, to fill release pages the artist has not entered by hand.
- Public catalogue lookups. By a release's barcode, we look up its public details at Apple Music, Deezer, TIDAL and MusicBrainz, read only, to fill in what Spotify does not have.
Where we hold details about someone who did not enter them, the artist's page names the artist that did, and we will tell that person on request exactly which account entered them and when.
Who receives register data
| Recipient | What they receive | Who is responsible for it |
|---|---|---|
| The public | The published website, links page, music page, release pages and EPK of any artist, as far as the artist opens them: the website, the links page and the music page are on or off, the EPK is public, unlisted or open only to someone holding a link the artist handed out, and riders sit on the EPK with everything else on it. Search-engine indexing and listed AI crawlers can be refused in the artist's settings. The pages carry the artist's contacts as the artist listed them, with the name, the organisation, the role, the email address and the phone number of each, and the EPK offers each one as a card to save | We are, as the publisher of the register |
| Approved applications | Artist data over the API, for any published artist, bound to the purposes in the API conditions of use; and a holder's passport, with that holder's name, photo, artists and roles, where the holder has authorised the application | We are responsible for the disclosure. Once an application holds the data it decides its own purposes, and is responsible for what it does with it |
| An assistant you connect to your account, such as Claude or ChatGPT | What you can see in the editor for the artists you run, each time you ask it something, for as long as you keep it connected: the profile and its files, the contacts and the team with their email addresses and phone numbers, and the rest of what the editor shows you. It changes an artist only where you could yourself, and every change it makes is recorded as yours. You remove it under Sign in with TAP on your account | You are responsible for choosing it and for what you ask it to do; its provider's terms govern what it keeps. For the contacts and team members whose details you hold on TAP, we remain joint controllers with you under Shared responsibility with artists, as for everything else you publish about them. We are responsible for the disclosure to you |
| An artist you ask for access | Your name, email address and the note you write on their locked page | We are, for passing it on. The artist decides on the request and is responsible for what it does with it |
| The contacts of an artist you write to | Your name, your email address and your message, when you use the message form on an artist's website or EPK. It reaches the contacts the artist listed for the subject you picked, and nobody else. We pass it on and keep no copy of what you wrote | The recipient is, once it arrives. We are responsible for the relay alone |
| An address an owner of an artist, or someone working on it through an app the artist connected, adds for its activity by email, such as an agency's bookings inbox, or that an agency working on the artist through such an app asks us to add | The changes to a published artist, its pages and its verification, as one mail after each round of changes, without the team's own requests and our decisions on them. Each change is signed as the team, as the app that made it or as TAP, never signed with a person's name. Nothing arrives until someone at the address confirms or the agency asked us itself, and the link at the foot of every mail stops it | Whoever asked for the address answers for it: the owner, the person working through an app, or the agency that asked us. We are responsible for the mail itself |
| The owners of each artist whose pages you visit, and the people the artist lets work on it through an app it connected, unless you turned analytics off | Daily totals of views of that artist's own pages, of clicks on its links, channels, release buttons and shop, of what was taken from its EPK, of clicks on its contacts and of messages sent through its form, with separate totals of the views by source category, country and device type, as they grow. Each of them receives only that artist's figures. Never your IP address, your name or an identifier; because the totals change as visits happen, someone watching them can tell what one visit added, so these counts are treated as personal data | We are responsible for collecting the counts and disclosing them to the artist. The visitor notice explains the basis, retention and your rights |
| OpenAI, through its advertising measurement pixel | When you look about to claim a handle, when you sign up, or when you claim one, and which advert brought you here if one did, while you allow it on the cookie policy. Also your IP address, browser details and the page's origin. TAP supplies no name or email in its conversion events; the cookie policy explains the pixel's separate automatic matching feature | We are responsible for the disclosure. Unlike our processors below, OpenAI may use what it receives to personalise its own advertising, unless you opt out with OpenAI directly |
| Courts, regulators and law enforcement | Whatever we are legally required to hand over | We are, for the disclosure itself |
| A buyer of our business | The register, if we are ever acquired | The buyer takes on this notice with it |
Approved applications are bound by the API conditions of use and, where they are registered with us, a Developer Agreement. Those limit them to a closed list of purposes, forbid resale and forbid building a copy of the register. A correction or a withdrawal here takes effect for them on their next read, within the cache limit the API conditions set. We cannot reach into anyone else's systems, so we do not promise every copy disappears. We promise the limit is short, and that we require it.
A passport is not one of the public pages. Only the person we issued it to, and the applications that person has authorised, can read it.
Stagent is not a third party
The Artist Passport is operated by Stagent B.V., the same company that runs the Stagent booking platform. They are one legal entity, not two, so data moving between them is not a transfer to an outside party.
We are saying so plainly because it matters in both directions. It means no third-party contract stands between the two products. It also means we hold ourselves to the same purpose limits internally that we impose on outside applications: data an artist gave to Stagent for booking administration is not published here unless publishing it is a purpose that artist would expect.
The services we run on
These providers process data on our instruction, under a data processing agreement. They are processors, not recipients in their own right, and none of them may use what they hold for their own purposes.
| Provider | What we use it for | Where |
|---|---|---|
| Laravel Cloud | Hosting for the application, the database, backups, background jobs, and storage for photos, avatars, press photos, logos and riders | European Union |
| Resend | Sign-in links and the notices we send you by email, reporting back whether each mail arrived, was opened or was clicked, and receiving mail sent to verify.tap.fm. A message relayed from an artist's page goes out through it too | European Union |
| Prelude, operated by Ding Negoce SAS | Delivering and checking the one-time code when a holder verifies a phone number. The code never exists on our side | European Union (Paris, France) |
| Laravel Nightwatch | Application monitoring and error reports | European Union |
| Visitors, operated by Visitors Now, LLC | Counting page views on our pages and on public artist pages, unless the visitor turned analytics off | European Union, by a company registered in the United States |
| Help Scout, operated by Help Scout PBC | Running the support window behind Contact and Write to us: your name, your email address, your IP address and what you type to us. It loads on the first press, never with the page | United States |
Where a provider is outside the European Economic Area, the transfer rests on the European Commission's adequacy decision for that country or on Standard Contractual Clauses.
One thing worth saying plainly about text messages: a verification code has to reach your handset, so it passes through your own mobile operator wherever you are. No provider can change that, and it is true of every service that sends you a code.
Changes to this page
When we add a recipient or a provider, it appears here before it starts processing. If a change materially affects people named by an artist, we tell them.