How ShiftedLabz handles data.

Who we are and what this policy covers

ShiftedLabz is a music marketing and lead-generation services company based in Chandigarh, India. We run advertising campaigns, fan-facing landing pages, and lead-management/messaging services on behalf of independent artists, artist management companies, and brand clients.

This policy covers every ShiftedLabz/NOSKP product and page, including: this website (shiftedlabz.com), our fanlink pages (fan.noskp.com), our pre-release pages (hype.noskp.com), our lead-management and messaging services (including leadgen.shiftedlabz.com and the WhatsApp numbers/Instagram accounts we operate on behalf of clients), and event/ticketing pages we build and operate for artists (such as live.semwal.xyz). Our internal admin tools (used only by our own team to manage clients and campaigns) are not directly accessible to the public and are covered only insofar as they store data described below.

What data we collect

Depending on which of our pages or services you interact with, we may collect:

• Messaging data — when you message a client's WhatsApp number or Instagram account in response to an ad we manage, we receive and store that conversation (contact identifiers, message content, timestamps) in order to respond to your inquiry and route it to the relevant artist or brand's team.
• Advertising and tracking data — when you visit a fanlink, pre-release, or event page, or click one of our ads, we (and Meta, as our advertising partner) collect standard ad-tracking signals: click identifiers (such as fbclid, fbc, fbp), campaign/ad identifiers, UTM parameters, referrer, device type, operating system, browser, and whether the page was opened inside an app's in-app browser. This is sent to Meta both from your browser (via the Meta Pixel) and from our servers (via Meta's Conversions API), using a shared event identifier so the same visit isn't double-counted.
• Location (approximate) — we derive an approximate country/city from your IP address using an offline lookup. Your IP address itself is hashed (irreversibly scrambled) with a key that rotates daily before we store anything derived from it; we do not store your raw IP address.
• Contact information you provide directly — name, phone number, or email address you share with us or a client's team when making a business or booking inquiry.
• Payment information (event ticketing only) — if you purchase a ticket through one of our event pages, payment is processed entirely by our payment processor (Razorpay). We receive and store confirmation of the transaction (order status, amount, ticket details) but never see or store your full card, UPI, or bank details — those are handled directly by the payment processor under its own security and privacy practices.

Cookies and similar technologies

Our pages use the Meta Pixel, which sets first-party cookies (such as _fbp and _fbc) in your browser to help Meta and us measure ad performance and attribute a later action back to the ad that led you here. We don't set additional custom tracking or advertising cookies of our own beyond what the Meta Pixel requires. You can control or block cookies through your browser's settings, and control how Meta uses your data for ads through your Meta ad preferences.

How we use your data

• To respond to and manage business/booking inquiries on behalf of our artist and brand clients.
• To measure and optimize advertising performance, including reporting aggregated outcomes back to Meta so ad delivery can be improved and directed toward genuinely interested people rather than random reach.
• To filter spam and low-quality inbound messages before they reach a client's team.
• To process event ticket purchases and send related confirmations.
• Internal record-keeping for the client relationship an inquiry or purchase relates to.

Our legal basis for this processing is our legitimate interest in operating and improving our advertising and client services, your consent where we ask for it (for example, cookie-based ad measurement, where required by your local law), and, for ticket purchases, the need to perform a contract with you.

Who we share it with

We share data with Meta Platforms, Inc. (Facebook/Instagram/WhatsApp) as required to operate the advertising and messaging services described above, with our payment processor (Razorpay) for ticketed events, and with the specific artist or brand client whose campaign, account, or event an inquiry or purchase relates to. We do not sell personal data to third parties, and we do not share your data across unrelated clients.

Meta may process data outside your country of residence, including in the United States, under its own privacy policy and applicable safeguards (such as standard contractual clauses, where required). Our own infrastructure is hosted on Google Cloud/Supabase, which may also involve data processing outside India.

Storage, retention, and security

Data is stored in access-controlled infrastructure, restricted to authorized ShiftedLabz team members and, for the relevant records, the client the inquiry or purchase belongs to. We retain conversation, inquiry, and order records for as long as reasonably needed for the business relationship and applicable legal/record-keeping requirements, and delete or anonymize data on request where we're not otherwise required to keep it.

Your rights

Wherever you're located, you can ask us to:

• Confirm what personal data we hold about you and give you a copy of it (access).
• Correct inaccurate or incomplete data (rectification).
• Delete your data (erasure), subject to any legal or record-keeping obligations we have.
• Restrict or object to certain processing, including for direct marketing.
• Receive your data in a portable format, where technically feasible.
• Withdraw consent at any time where processing is based on consent, without affecting processing already carried out.

To exercise any of these, email hi@shiftedlabz.com — this is also our grievance/contact address for the purposes of India's Digital Personal Data Protection Act, 2023. If you're in the European Economic Area or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

California and other US state residents

If you're a California resident, you have rights under the CCPA/CPRA to know what personal information we collect, to request its deletion, and to opt out of its "sale" or "sharing." We do not sell personal information for money, and any sharing for advertising purposes (such as with Meta, described above) can be limited by adjusting your Meta ad preferences or browser cookie settings. Residents of other US states with similar privacy laws have equivalent rights, which we'll honor on request via the contact below.

Children's privacy

Our services are directed at businesses, artists, and the general public for advertising/booking purposes, not specifically at children. We don't knowingly collect personal data from children under 18. If you believe a child has provided us data, contact us and we'll remove it.

Third-party links

Our pages may link to third-party sites (Instagram, WhatsApp, Spotify, ticketing/payment providers, and similar). This policy doesn't cover those sites — please check their own privacy policies.

Changes to this policy

We may update this policy as our services change. We'll update the "Last updated" date above when we do; material changes will be reflected here directly since we don't currently collect enough contact information from casual site visitors to notify everyone individually.

Contact

Questions about this policy, or to exercise any of the rights above: hi@shiftedlabz.com.