Privacy Policy — Pibox Launchpad

Effective Date: 10.06.2026 Last Updated: 16.06.2026

This Privacy Policy describes how Pibox Oy(“Pibox”, “we”, “us”, or “our”), a company incorporated in Finland with its registered address at Itälahdenkatu 22 A, 00210 Helsinki, Finland (Business ID / VAT: FI29215072), collects, uses, shares, and protects personal data in connection with Pibox Launchpad(the “Service”).

The Service includes:

the Pibox Launchpad website and any subdomains on which it is made available (the “Site”);
artist and label fan-engagement pages operated through the Service (“Launchpad Pages”);
the Pibox Launchpad application for Shopify (the “Shopify App”), which connects an artist’s or label’s Shopify store to their Launchpad Page.

Pibox Oy is the data controller of personal data processed through the Service within the meaning of the EU General Data Protection Regulation (“GDPR”), except where this Policy states otherwise.

If you do not agree with this Policy, please do not use the Service.

1. Who This Policy Applies To

This Policy applies to two groups of users:

Fans — individuals who visit Launchpad Pages, create an account, participate in the loyalty and rewards program, or purchase merchandise and other products offered by artists and labels.
Merchants — artists, labels, and their authorized representatives who install the Shopify App or otherwise use the Service to operate a Launchpad Page.

Sections 2–11 apply to all users. Section 12 contains additional terms specific to Merchants and the Shopify App.

2. Personal Data We Collect

We apply the principle of data minimization and collect only the data necessary to operate the Service.

2.1 Data you provide to us

Account data: name or display name, email address, password (stored in hashed form), profile photo, country, and date of birth or age confirmation (used to verify eligibility — see Section 9).
Social profile information: if you choose to connect a social or streaming account (for example Spotify, Apple Music, YouTube and YouTube Music, Instagram, TikTok, Kick, or Telegram), we receive the information you authorize that platform to share with us, such as your public profile handle, profile identifier, and confirmation of actions relevant to the loyalty program (for example, that you follow a particular artist). Connecting social accounts is always voluntary and is never required to create an account or to make a purchase.
Self-reported activity: where a loyalty task is not verified through a platform integration, we record your confirmation that you completed the task.
Shipping and contact details: postal address, recipient name, and phone number, collected when you redeem a physical reward or when a merchandise order requires delivery.
Application data: if you apply for early access as an artist or label, we collect your name or act name, email address, and any information you include in your application, which we use to assess and respond to your application.
Communications: messages you send to our support channels.

2.2 Data we collect automatically

Engagement data: quests and tasks completed, loyalty points earned and redeemed, leaderboard position, rewards claimed, referral activity, and interactions with Launchpad Page content.
Purchase data:when you buy merchandise or other products on a Launchpad Page connected to a Merchant’s Shopify store, we receive order information from Shopify (items purchased, order value, order status) in order to credit loyalty points and display your order-related rewards. Payment processing is performed by Shopify and the Merchant’s payment providers, including card and cryptocurrency payment processors. Pibox does not collect or store your full payment card details.
Device and usage data: IP address, browser type, device identifiers, operating system, language, referring pages, pages viewed, and timestamps.
Cookies and similar technologies: see Section 8.

2.3 Data we do not collect

We do not knowingly collect special categories of personal data (such as health data, political opinions, or biometric data), and we ask that you do not submit such data through the Service.

3. The Loyalty & Rewards Program

The core of the Service is a free promotional loyalty program. To ensure full transparency about how it works and how data is processed in connection with it:

Loyalty points are promotional credits only. They have no monetary value, cannot be purchased with money, cannot be exchanged for cash, and are non-transferable.
Points are earned through free, voluntary engagement — for example following an artist on social platforms, watching content, sharing, inviting friends — and may also be granted as a promotional benefit accompanying merchandise purchasesmade from the Merchant’s store. Any such points are an optional promotional bonus: they are not a price, fee, or condition of the purchase, the purchase price is the same whether or not points are granted, and the grant of points does not increase a participant’s chance of winning, or improve a participant’s position in, any prize competition.
Points can be redeemed for digital and physical rewards made available by the artist or label, including reward boxes containing one of several disclosed reward items. Redemption of rewards is a use of promotional credits, not a purchase, and opening a reward box never requires any payment. The promotional credits used to open a reward box can always be obtained through free participation, and no money is required at any stage.
Promotional prize competitions. Artists and labels may from time to time run promotional prize competitions through the Service. Each competition is governed by its own Official Rules published on the relevant Launchpad Page, which include eligibility requirements, the entry period, prize descriptions, and a free method of entry that is always available without any purchase, payment, or other consideration (no purchase necessary). We process entrants’ personal data (account data, points activity, and contact details of winners) to administer such competitions, verify eligibility, contact winners, and deliver prizes, and to comply with applicable promotional-marketing laws.
Fairness and eligibility records. We process engagement and account data to detect fraud, duplicate accounts, automated activity, and other conduct that would compromise the fairness of the program.

The Service is a fan-engagement and loyalty platform. It is not a gambling, betting, or lottery service within the meaning of the Finnish Lotteries Act (arpajaislaki 1047/2001) or comparable law, and no feature of the Service permits staking money on an outcome of chance. No payment or purchase is ever required to earn points, redeem a reward box, or enter a prize competition. Under the Lotteries Act, an activity is a lottery only where three elements are present together: a charge for participation (consideration), a prize of monetary value, and an outcome determined wholly or partly by chance. Because participation in the loyalty program and prize competitions is always available free of charge and never requires consideration, this cumulative test is not met, and the Service does not constitute a lottery, a marketing lottery, or other gambling under Finnish law.

4. Purposes and Legal Bases for Processing

Under the GDPR, we process personal data on the following legal bases:

Purpose	Data	Legal basis
Creating and maintaining your account; operating the loyalty program; crediting and redeeming points; displaying leaderboards	Account, engagement, purchase data	Performance of a contract (Art. 6(1)(b))
Verifying completion of social engagement tasks you choose to connect	Social profile information	Consent (Art. 6(1)(a))
Administering promotional prize competitions; verifying eligibility; delivering prizes	Account, engagement data; winners' contact and shipping details	Performance of a contract; legal obligation (Art. 6(1)(b), (c))
Delivering physical rewards and merchandise-related rewards	Shipping and contact details	Performance of a contract (Art. 6(1)(b))
Assessing and responding to artist/label early-access applications	Application data	Steps prior to entering into a contract (Art. 6(1)(b))
Service communications (account, rewards, order-related notices)	Email address	Performance of a contract (Art. 6(1)(b))
Marketing communications from Pibox about the Service and participating artists	Email address	Consent (Art. 6(1)(a)); you may withdraw at any time
Analytics, Service improvement, and aggregated reporting to Merchants	Usage and engagement data	Consent (Art. 6(1)(a)) for non-essential analytics cookies; legitimate interests (Art. 6(1)(f)) for aggregated reporting
Advertising, audience matching, and artist-pixel measurement (see Section 6.3)	Cookie and usage data, hashed identifiers	Consent (Art. 6(1)(a))
Fraud prevention, security, enforcement of our terms	Account, device, engagement data	Legitimate interests (Art. 6(1)(f))
Compliance with legal obligations (accounting, tax, lawful requests)	As required	Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may object at any time (Section 10).

5. How We Use Aggregated Data

We provide Merchants with aggregated, de-identified analytics about their Launchpad Page — for example audience size, engagement rates, conversion metrics, and campaign performance. These reports do not contain information that identifies individual fans. We may also use aggregated or de-identified data for our own product development and industry research.

6. How We Share Personal Data

We do not sell your personal data. We share personal data only as described below.

6.1 Service providers (processors)

We use third-party providers who process data on our behalf under data processing agreements, including:

Shopify (e-commerce platform powering Merchant stores and order data);
Printify (merchandise production and fulfillment — receives recipient name and shipping address for physical orders and rewards);
PostHog (product analytics, where consent is given);
cloud hosting and infrastructure providers;
email delivery providers.

6.2 Merchants (artists and labels)

Merchants receive aggregated analytics as described in Section 5. Merchants involved in fulfilling your order or delivering a prize may receive the data necessary for that fulfillment. We do not provide Merchants with your contact details for their own independent marketing unless you separately and explicitly consent to that sharing, in which case the Merchant acts as an independent controller of the shared data.

6.3 Advertising and audience partners

With your consent, we use advertising tools such as Meta (Facebook/Instagram) advertising services, including pixels and hashed-identifier audience matching, to measure campaigns and to enable relevant advertising about artists you follow. Identifiers shared for audience matching are hashed before transmission. For the collection and transmission of data through the Meta Pixel and similar tools, Pibox and Meta Platforms Ireland Limited act as joint controllers within the meaning of Article 26 GDPR. A summary of the respective responsibilities is set out in Meta’s Controller Addendum; in essence, Pibox is responsible for the lawful basis (your consent) for collecting and transmitting the data, and Meta is responsible for its subsequent processing. You may exercise your data-protection rights against either party. You can withdraw consent at any time via cookie settings or by contacting us, and you can manage ad preferences directly in your Meta account settings.

Artist advertising pixels.A Launchpad Page may contain an advertising or analytics pixel placed by, or on behalf of, the artist or label operating that page (for example a Meta Pixel or Google tag tied to the artist’s own advertising account). Where such a pixel is active, the artist or label receives event data about your visit and acts as an independent controller of that data for its own advertising and measurement, under its own privacy policy. These pixels load only with your consent, and you can decline or withdraw consent at any time via the cookie banner.

6.4 Social and streaming platforms

When you choose to connect a social or streaming account, you are interacting with that platform, which collects and processes data under its own privacy policy and acts as an independent controller. We receive only the data you authorize the platform to share with us, and we use it solely to verify loyalty tasks and operate your account. You can disconnect a linked account at any time in your account settings, and you can also revoke our access directly in the settings of the relevant platform. When you disconnect an account, we stop requesting data from that platform and delete the data obtained from it, except for the record of loyalty points already credited.

Where you connect a Google or YouTube account, the Service uses YouTube API Services. By connecting such an account you agree to be bound by the YouTube Terms of Service. Google’s handling of your data is described in the Google Privacy Policy. You can revoke the Service’s access to your Google account data at any time via the Google security settings page.

6.5 Legal and corporate

We may disclose personal data where reasonably necessary to (a) comply with law or a valid legal request, (b) protect any person’s safety, (c) prevent fraud or abuse of the Service, (d) protect our legal rights, or (e) in connection with a merger, acquisition, or sale of assets, in which case this Policy will continue to apply to your data.

7. International Data Transfers

We are based in Finland and primarily process data within the European Economic Area. Where data is transferred outside the EEA (for example to service providers in the United States), we rely on appropriate safeguards under GDPR Chapter V, including the European Commission’s Standard Contractual Clauses and, where applicable, adequacy decisions such as the EU–U.S. Data Privacy Framework. An up-to-date list of our sub-processors, the categories of data they receive, and the transfer mechanism relied on for each is available on request via the contact details in Section 14. Where a U.S. recipient is self-certified under the EU–U.S. Data Privacy Framework, we rely on that adequacy decision; otherwise we rely on Standard Contractual Clauses together with any supplementary measures required following a transfer impact assessment.

8. Cookies and Analytics

We use:

Essential cookies — required for sign-in, security, and core functionality (no consent required);
Analytics cookies — PostHog (privacy-focused product analytics) and Google Analytics, set only with your consent, to understand how the Service is used and to improve it. You can additionally opt out of Google Analytics via the opt-out browser add-on at https://tools.google.com/dlpage/gaoptout;
Advertising and audience-measurement cookies and pixels — including the Meta Pixel and advertising pixels operated by or on behalf of the artist or label whose Launchpad Page you visit, used only with your consent (see Section 6.3).

On your first visit you will be presented with a consent banner allowing you to accept or decline non-essential cookies. Until you accept, no analytics or advertising cookies are set and no analytics or advertising scripts are loaded. You can withdraw your consent at any time by clearing the consent cookie in your browser or by contacting us.

9. Age Requirements

The Service is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16; if we learn that we have done so, we will delete it. Participation in promotional prize competitions is limited to users aged 18 and over(or the age of majority in their jurisdiction), as set out in each competition’s Official Rules. We may use account information to verify eligibility. We set the threshold at 16, which is higher than the minimum age for a child’s own consent to information-society services under Finnish law (13 years), so that consent obtained through the Service is valid without parental authorisation.

10. Your Rights

10.1 If you are in the EEA or UK (GDPR)

You have the right to: access your personal data; rectify inaccurate data; erase your data; restrict processing; data portability; object to processing based on legitimate interests; withdraw consent at any time (without affecting prior processing); and not be subject to solely automated decisions producing legal or similarly significant effects (Art. 22 GDPR). Reward and points outcomes in the Service are determined by pre-defined program rules, not by automated profiling producing legal effects.

To exercise these rights, contact us at the address in Section 14. We will respond within one month. You also have the right to lodge a complaint with a supervisory authority — in Finland, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, www.tietosuoja.fi) — or with your local authority.

10.2 If you are a California resident (CCPA/CPRA)

You have the right to know what personal information we collect, to request deletion or correction, to opt out of “sale” or “sharing” of personal information, and to non-discrimination for exercising your rights. We do not sell personal information for money. The use of advertising cookies described in Section 6.3 may constitute “sharing” under the CPRA; you can opt out via the cookie banner or the “Do Not Sell or Share My Personal Information” link on the Site. We honor Global Privacy Control signals.

10.3 Other jurisdictions

Residents of other regions may have similar rights under local law. Contact us and we will apply the rights available to you.

11. Data Security and Retention

We apply technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and staff confidentiality obligations. No method of transmission or storage is completely secure, and we encourage you to use a strong, unique password.

We retain personal data only as long as necessary for the purposes described in this Policy:

account and loyalty program data — for the life of your account and deleted or anonymized after account deletion, subject to short backup-cycle latency;
order and prize-fulfillment records — as required by accounting and tax law (in Finland, generally 6 years);
competition winner records — as required by applicable promotional-marketing law;
early-access application data — for up to 24 months from the date of application, unless you become a Merchant or ask us to delete it sooner;
marketing consents — until withdrawn.

12. Merchants and the Shopify App

This section applies to artists, labels, and their representatives who install the Shopify App.

What the App does.The Shopify App connects a Merchant’s Shopify store to their Launchpad Page so that the Merchant’s products can be displayed and sold through the Launchpad Page and so that loyalty points can be credited for qualifying purchases.

Merchant Data we access. To provide this functionality, the App accesses only the store data necessary for its operation: store name and contact details, product catalog (titles, descriptions, images, prices, inventory), and order data for orders attributable to the Launchpad Page (order contents, value, status, and associated customer details needed to credit points and support fulfillment). We do not access store data unrelated to these functions.

How Merchant Data is used.Merchant Data is used solely to operate the Merchant’s Launchpad Page, credit loyalty points, generate the Merchant’s analytics, and provide support. It is shared only with the service providers listed in Section 6.1 as needed to deliver the Service, and is not sold or used for any other party’s advertising.

Customer data within orders.For personal data of the Merchant’s customers contained in Shopify order records, the Merchant and Pibox each process such data as separate and independent controllers, each for their respective purposes and not as joint controllers, and neither acts as a processor for the other; Pibox processes it as described in this Policy to operate the loyalty program for fans who hold a Launchpad account, while the Merchant remains responsible, as controller, for its own use of order data (for example order fulfilment, accounting, and its own customer communications).

Privacy compliance webhooks.The App subscribes to Shopify’s mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact) and acts on them within the required timeframes: we provide the requested data to the Merchant, and we delete customer or shop data upon receiving a redaction request, except where retention is required by law.

Uninstalling the App.Upon uninstallation, we cease accessing the Merchant’s store and delete stored Merchant Data in accordance with the shop/redact webhook schedule, subject to legal retention obligations.

Questions about our privacy practices may be directed to the contact in Section 14; we respond promptly to Merchant inquiries.

13. Changes to This Policy

We may update this Policy from time to time. The updated version will be posted on the Site with a revised “Last Updated” date, and material changes will be notified to registered users by email or in-Service notice before they take effect. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

14. Contact Us

Pibox Oy
Itälahdenkatu 22 A
00210 Helsinki, Finland

Privacy requests: privacy@pibox.com
General support: support@pibox.com

For data access or deletion requests, please use the subject line “DATA ACCESS REQUEST” or “DATA DELETION REQUEST”. We may need to verify your identity before fulfilling a request.