Privacy Policy

Annisse Music LLC · Last updated October 14, 2026

This policy covers annisse.com and all of its subdomains, including the Come to My City campaign at annisse.com, the Fan Hub at fan.annisse.com, and the services behind them. They are run by Annisse Music LLC (“we”, “us”) for the artist Annisse, and let fans count their city for a show, support the music, engage in interactive digital experiences, and earn points and rewards. One account covers all of them. This policy explains what we collect, why, who we share it with, and the choices you have. Questions: privacy@annisse.com.

What we collect

Information you give us

• Phone number (or WhatsApp number) and the one-time code we text you to verify it. This is how you sign up and sign in.
• City, state and country you want a show in, and the channel (SMS or WhatsApp) you chose for updates.
• Email address if you add one for release and show updates.
• Name or social handle and a short note if you add them to your supporter card. These are shown publicly on the site.
• Choices you make in interactive experiences, such as what you plant, collect or customize, and a display name shown on pages you share and on leaderboards.
• Fan Hub profile: a display name, your birthday month and day if you add it for points, an Instagram handle if you link your account (through Instagram login or a ManyChat flow), the in-app actions that earn points, and the rewards you redeem. Leaderboards show your display name and points.

Information collected automatically

• A random visitor ID stored in your browser so we can count signups, shares and referrals without a cookie login.
• Page events such as pages viewed, links tapped and signup steps, with the link or campaign you arrived from.
• Technical data: browser type, device type, approximate location from your IP address, and error reports when something breaks.
• Listening activity in interactive experiences: how long an embedded song played, and, if you connect Spotify or Apple Music, the recent plays of Annisse’s songs needed to verify a listen. We store the connection token so we can check again later; you can disconnect at any time from the experience's settings.

Information from other services

• If you reach us through Instagram DMs or a ManyChat flow, we receive the subscriber ID, name and username from that service so we can link it to your signup.
• If you support the music on Bandcamp or Buy Me a Coffee, those services tell us about the purchase so we can credit your city. Payments happen on their sites, not ours, and we never see card details.

How we use it

• To count your city and plan shows.
• To send the SMS or WhatsApp updates you agreed to (see “Messages” below).
• To run the interactive experiences, points, rewards and leaderboards.
• To show supporter cards and the shareable pages you created.
• To measure which links and ads bring people here and to fix bugs.
• To prevent abuse (rate limits, duplicate signups, spam).

Cookies, pixels and your choices

We use browser storage (not third-party cookies) for your sign-in token, visitor ID and your privacy choice. Those are needed for the site to work.

We also use two optional tools:

• Meta Pixel (Meta Platforms, Inc.) measures whether ads on Instagram and Facebook led to a signup. It receives your visitor ID and the actions you take on the site, and we run it with Meta’s Limited Data Use setting, which restricts how Meta processes data from California. When you sign up we also send Meta a hashed (unreadable) version of your email, city and country so the ad report can be matched. We never send Meta your phone number. Meta’s own policy is at facebook.com/privacy/policy.
• Sentry Session Replay (Functional Software, Inc.) records how a page looked and what you tapped when an error happens, with all text you type masked, so we can fix the bug. It only runs if you choose “Allow” below.

Outside Europe, the pixel runs unless you opt out. Tap “Do Not Share My Info” below (or in any page footer) and it stops in this browser. We also honor the Global Privacy Control signal from your browser as an opt-out. In the EU, EEA and UK, neither tool runs until you choose “Allow”.

Error monitoring without replay (Sentry) always runs; it does not receive your IP address or what you type.

Who we share it with

We don’t sell your personal information. We share it only with services that run the site for us:

• Supabase and Google Firebase (hosting, database and the API).
• Stytch (sends the one-time verification codes).
• ManyChat and Twilio (deliver SMS, WhatsApp and Instagram messages).
• Resend (sends the email updates you asked for, with an unsubscribe link in each one).
• Mapbox (the city map and the city search box, which receives what you type).
• YouTube, Apple Music and Spotify (song playback and verified listens).
• Meta (unless you opt out) and Sentry replay (only if you allow it), see above.

Sharing visitor activity with Meta for ad measurement may count as “sharing” under California law. “Do Not Share My Info” above is your opt-out, and we honor Global Privacy Control. We may also disclose information when the law requires it or to protect the site and its users.

Messages

You only get texts or WhatsApp messages after you check the consent box at signup, and the box is optional: you can count your city without it. Message frequency varies and message and data rates may apply. Reply STOP to any message to unsubscribe, or HELP for help. Opt-outs are honored right away by the messaging service and mirrored to our records within a day.

Mobile phone numbers and SMS opt-in data and consent are not shared with or sold to third parties or affiliates for marketing or promotional purposes.

How long we keep it

Your signup, supporter card and progress in interactive experiences stay until you delete your account. Page events and error reports are kept for up to 90 days for reporting and debugging. Verification codes expire within minutes. Backups roll off on a schedule after deletion.

Your rights

Wherever you live, you can ask us what we hold about you, correct it, get a copy, or delete it. People in California, the EU/UK and similar places have these rights by law; we extend them to everyone and won’t treat you differently for using them.

Delete your account and data yourself: if you’re signed in on this device, the button below removes your signup, city, email, supporter card, progress, points and rewards, and signs you out everywhere.

For anything else, email privacy@annisse.comfrom the address or phone you signed up with. We answer within 30 days (45 for California requests).

Children

The site is not for children under 13 and we don’t knowingly collect their information. If you believe a child under 13 signed up, email us and we’ll delete the account.

Where your data lives

We’re based in the United States and store data there. If you use the site from elsewhere, your information is transferred to and processed in the US.

Security

Sign-in uses one-time codes instead of passwords, the API only accepts requests with a valid session, and the database is closed to the public. No system is perfectly secure, so if you think your account was misused, tell us.

Changes

We’ll post updates here and change the date at the top. For significant changes we’ll also tell you by the channel you signed up with.