Privacy
Privacy Policy
Last updated: October 2026
This policy explains what personal data SessionLeads processes, why, and what rights you have. It covers the website sessionleads.com and our service. If you are a musician and want to know why your artist profile may appear in a SessionLeads sheet, please read our separate notice for artists at sessionleads.com/artists.
1. Who is responsible
Julian Höninger, sole trader, trading as SessionLeads
Kalvarienbergstraße 5, Tür 1, 4310 Mauthausen, Austria
Email for privacy questions: julian@sessionleads.com
We are not required to appoint a data protection officer.
2. Visiting the website
Hosting and server logs. The website is hosted by Netlify, Inc., USA. When you open a page, Netlify processes technical access data (IP address, date and time, page requested, browser type) to deliver the site and to protect it against abuse. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). According to Netlify, these access logs are kept for up to 30 days. For transfers to the USA, see section 9.
No cookies, no tracking. This website sets no cookies and uses no analytics, tracking or advertising tools. That is why there is no cookie banner.
Fonts. Our fonts are stored on our own server. Your browser does not connect to Google Fonts or any other font provider.
Links to payment pages. Buttons for plans and purchases lead to pages run by Stripe (section 4). No data is sent to Stripe until you click.
3. Free test request
When you request a free test, we process the details you enter: name, email address, studio or project name, Instagram handle (optional), the genres, artist level, region and reference artists you want, whether you are taking on new artists, how you heard about us (optional), and your confirmation that you are signing up as a business. If you came through a link with a channel tag (for example sessionleads.com/start?ref=ig), the form also sends that tag. It names only the channel, such as Instagram, TikTok or Facebook, and is the same for everyone who uses that link.
Purpose: to prepare and deliver your free test, to contact you about it, and to ask you once how it went. We use the channel tag and your answer to “how did you hear about us” only to see which channels bring test requests.
Legal basis: steps taken at your request before a possible contract (Art. 6(1)(b) GDPR); for the channel tag and how you heard about us, our legitimate interest in knowing which channels work (Art. 6(1)(f) GDPR).
Required fields: fields marked as required are needed to prepare a test. Without them we cannot deliver one.
Processor: the form is processed by Netlify Forms (Netlify, Inc., USA). We copy the details into our customer records.
Storage: 24 months after your test, unless you become a customer. We delete the entry in Netlify Forms within 30 days after we have copied it into our customer records.
4. Customers
Checkout and payments. Purchases and subscriptions run through Stripe Payments Europe, Ltd., Dublin, Ireland. Stripe processes the data needed for payment: name, email address, billing address, tax ID (if you enter one) and payment details. We never see your full card number. For a subscription with a free trial, Stripe stores your card at the start and charges it only after the trial unless you cancel. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations for invoicing and bookkeeping (Art. 6(1)(c) GDPR). Stripe processes part of this data as an independent controller, for example for fraud prevention and its own legal duties. Details: stripe.com/privacy.
Onboarding. After a purchase you fill in an onboarding form with your profile (the same kind of details as for the free test). It is processed by Netlify Forms. Legal basis: Art. 6(1)(b) GDPR.
Delivery. We deliver your artist lists as Google Sheets shared with you, and we write to you from our Google Workspace account (Google Ireland Limited, Dublin, Ireland).
Tracker. The SessionLeads Tracker shows your sheet in your browser. Your progress (for example “messaged” or “replied”) is stored only in your browser (local storage) and is not sent to us. To load your sheet, your browser connects directly to Google, which receives your IP address. You can delete the stored progress in your browser settings.
Contract records. We keep invoices and accounting records for seven years, as Austrian tax law requires (§ 132 Federal Fiscal Code, BAO). Legal basis: Art. 6(1)(c) GDPR.
5. Contacting us
If you write to us by email or direct message, we process your message and contact details to reply. Legal basis: Art. 6(1)(b) GDPR if it concerns a contract or a test, otherwise our legitimate interest in answering (Art. 6(1)(f) GDPR). We delete correspondence that is not needed for a contract or for tax purposes 24 months after the last message.
6. Artist data (our service)
To provide our service we process publicly available information about musicians, for example artist name, public profile links, public numbers, latest release and the contact channel the artist publishes for their music. Each artist goes to one customer at a time, exclusively for three months. Legal basis: legitimate interests (Art. 6(1)(f) GDPR); we have documented the balancing of interests in writing. Customers are controllers for their own contact with the artist. Some customers are based outside the European Economic Area (section 9). Julian Höninger also runs a recording studio, Tracklinking Studios, and may contact artists personally about working together, but never an artist whose profile is with a paying SessionLeads customer during the exclusive period. All details, including how to opt out, are in our notice for artists: sessionleads.com/artists.
7. Artist opt-out form
If an artist uses the opt-out form, we process artist name, profile link and, if given, email address and message, to carry out the objection and confirm it. We keep name and profile link on a block list so that the artist is not suggested again. Legal basis: our legal obligation to handle objections (Art. 6(1)(c) GDPR together with Art. 21 GDPR). The form is processed by Netlify Forms.
8. AI tools
We use software and AI tools to research and check artists and to draft first messages. Every artist is checked against the customer’s profile before delivery. First messages are drafts that customers complete and edit before sending. No decision with legal or similarly significant effect is made solely by automated means (Art. 22 GDPR). Anthropic receives data as an independent controller; the other providers process data on our behalf (section 9).
9. Service providers, other recipients and transfers outside the EU
These providers process data on our behalf under a data processing agreement (Art. 28 GDPR):
| Provider | Purpose | Location | Safeguard for transfers |
|---|---|---|---|
| Netlify, Inc. | website hosting, forms | USA | EU–US Data Privacy Framework (Netlify is certified) |
| Google Ireland Limited | email, spreadsheets, files | EU, with possible transfers to Google LLC, USA | EU–US Data Privacy Framework / EU Standard Contractual Clauses |
| Sampark, Inc. (Composio) | software tools and automation for research | USA | EU Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | payments (partly as independent controller) | EU, with possible transfers to the USA | as described in Stripe’s privacy policy |
AI assistant (Anthropic). We use Claude, an AI assistant made by Anthropic, to research and check artists and to draft texts. We use it under Anthropic’s terms for individual subscribers, not under a data processing agreement. For the data we enter, Anthropic Ireland, Limited (Dublin, Ireland) is therefore an independent controller and processes it under its own privacy policy (anthropic.com/legal/privacy). That policy also covers Anthropic’s transfers outside the EU and its own use of inputs, for example for safety and, depending on the account setting, to improve its models. We enter only what a task needs: mainly publicly available artist information, and customer details only where we need them to prepare or deliver an order. Legal basis: our legitimate interest in researching and working efficiently (Art. 6(1)(f) GDPR). You can object to this (section 11).
Customers outside the EU. Some of our customers are based outside the European Economic Area, for example in the United Kingdom, the USA or Australia. When we deliver artist data to them, we rely on the European Commission’s adequacy decision for the United Kingdom, and for all other countries on the EU Standard Contractual Clauses for transfers between controllers (Module One), which these customers accept with our Terms (Annex 1). You can ask us for a copy.
The EU–US Data Privacy Framework is the European Commission’s adequacy decision of 10 July 2023 for certified US companies. Where a provider is not certified, we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
10. Our social media profiles
We run profiles on Instagram, Facebook and TikTok. If you visit or contact us there, the platform processes your data under its own privacy policy. For page statistics (“Insights”) on Instagram and Facebook, we are jointly responsible with Meta Platforms Ireland Limited (Art. 26 GDPR); Meta has taken on the main responsibility for informing you and for handling your rights. We only see aggregated statistics and the messages you send us. Legal basis: our legitimate interest in presenting our service (Art. 6(1)(f) GDPR).
11. Your rights
You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR), and to withdraw any consent at any time with effect for the future. Write to julian@sessionleads.com. We answer within one month.
You can lodge a complaint with a supervisory authority, in Austria the Datenschutzbehörde (dsb.gv.at), or with the authority where you live or work.
Your right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interests, you can object at any time for reasons arising from your particular situation. You can object to direct marketing at any time without giving reasons; we then stop using your data for it.
12. Changes
We update this policy when our service or the law changes. The date at the top shows the current version.