Privacy policy

sym.presar.io is a platform where artists submit their work to a call from a presenter, such as a festival. It is operated by 18131643 Canada Inc., which does business as sym.presar.io.

The person in charge of the protection of personal information is the president of 18131643 Canada Inc. Write to holla@presar.io for anything about your information: to see it, correct it, withdraw a consent, delete your account or ask a question.

We ask for what the submission needs. Here is what each screen collects.

• Sign-in: your email address, and a password if you choose to set one. Otherwise we send a sign-in link to your address.
• Account: the language you use the site in, and the version and date of this notice when you acknowledge it. We also store a keyed hash of your email address, a scrambled form that serves one rule: when you submit, it is copied onto your submission so that in the public listening, in January, the draw excludes your own act from the ones played to you. You can vote in a call you have entered.
• Your act: the stage name, whether it is a solo project or a group, the number of performers, the home base and the place of residence picked from a list or typed, a bio in either language, aliases and links. For a group, each member is recorded by stage name, role and ISNI. We check the links you give from time to time, by calling each address from our own server, and keep the date and the result of the last check beside the link. A link we could not reach is shown to you as such, and your entry stays as it is.
• Identifiers: the ISNI, IPI and IPN numbers you type.
• MetaMusique link: the link you paste and the release record we read from it: titles, codes such as ISRC and ISWC, dates, the names of labels, distributors, publishers and other organisations, and credits by role, with the public ISNI of the person credited where MetaMusique carries it. Before anything is stored, the read keeps only those fields; a person's legal name, contact details, place of residence, status, birth year and IPN are dropped, and the preview lists what was dropped by category.
• Catalogue you type yourself: releases, recordings and works, with their titles and their ISRC, ISWC and UPC codes.
• Media: the audio files and images you upload, a credit and a description for each image, and the technical facts we read from the file itself: format, duration, size.
• Genres: the genres you pick and the free tags you type.
• Call questions: your answers. An answer to a sensitive question, such as a self-identification or your first language, is kept in its own table, apart from the rest.
• Submission fee: when a call charges one, the amount, the currency, the date, the status of the payment, the refund policy you were shown and its version, and Stripe's own references for the payment, as opaque identifiers. Your card details are entered on Stripe's page and stay with Stripe.
• Contact form: your message, the email address you give and, if you give it, your name. They are used to answer you and are kept in our mailbox. A scrambled form of your address (a keyed hash, which reverses to nothing) is kept with our audit records to limit messages to five an hour per address.
• Deletion request: the date you asked.

Those are the fields we ask for. A member of a group is a stage name, a role and an ISNI. Your session is identified by its cookie alone.

Every consent you give or decline is kept as a record: which consent, the exact wording you saw and its version, the language and the time. Consents are given on the consent screen when you submit.

We also keep a log of actions on your account: what happened and when, as a code. For example a deletion request, or an import replaced or abandoned.

Presenters may record pitches that agents send them through their own form: the artist's name as the agent typed it, where the artist is based, links, the agent's note about the work, availabilities, the agency's name and the agent's email as business contact, and the agent's attestation of a mandate to represent the artist. These records come from the agent. A presenter keeps them for its programming cycle and until the date it set at import, 12 months after its festival for POP Montreal 2027, extended one record at a time with a reason, then deletes them. To see, correct or delete a pitch about you, write to holla@presar.io.

• To sign you in and to write to you about the call you enter.
• To keep your profile for future calls, unless you ask us to remove it.
• To show your submission to the presenter of the call you entered, once you submit it.
• For a sensitive answer: the presenter's reporting to its funders, in aggregate only.
• For a message sent through the contact form: to answer you.

These are the purposes. What we collect serves the submission and the answer to your message.

• You see everything about your own account, acts and submissions.
• The presenter of a call you enter receives your submission once it is submitted and your consent record exists, and its staff may consult it. That moment is when it first reaches the presenter.
• A sensitive answer reaches the sensitive-view role only, for aggregate reporting to funders, and only while your consent for it stands. The jury reads the rest of your entry.
• Public listening, in January: the tracks you chose for a call, with your images and your stage name, are played to listeners once you agreed to it for that call on the consent screen. Listeners hear them in the player, in random sets.
• In this first version, the developer operating sym can read the database for support, for an access request and to run the service.
• Stripe, when a call charges a submission fee: you pay on a page run by Stripe, to which we pass your email address to fill it in and a reference to your submission. The charge goes to the presenter's own Stripe account, in full. Stripe processes your information in the United States under its own privacy policy.
• The companies that host sym for us, named under Where your information is kept, process it on our behalf under their terms of service.

These are the recipients of your information.

If you paste a link to one of your releases on the MetaMusique portal, we read that release page server-side, through sym's own MetaMusique account, once per import, and only when you ask. The read fetches the release, its recordings, works and products.

On the production site this read is switched off until MetaMusique's written agreement. Until then your link is kept as a reference link on your act.

Your information is stored in Canada, with these companies, which process it on our behalf under their terms of service:

• The database: Supabase, in the Canada (Central) region, Montréal, Québec.
• The servers that run the site: Vercel, pinned to its Montréal region.
• Mail: Amazon Web Services (Amazon SES), Canada (Central) region, Montréal.
• Your audio files and images: Backblaze, in its CA East region, Toronto, Ontario. This is outside Québec. The files are in a private bucket, and each one is reached through a link signed by sym that lasts 15 minutes.

The encrypted connection to this site ends at Vercel's network edge nearest to you, which may be outside Québec, and outside Canada if you connect from abroad. From there your request travels inside Vercel's network to Montréal. Vercel sees your IP address to deliver each page.

Each of these companies may be reached by its own staff from outside Québec. In the words of the law, your information may be communicated outside Québec in these cases, and we have assessed each of them.

When a call charges a submission fee, the payment is made on a page run by Stripe, Inc., which processes your email address, the payment and your card details in the United States. We keep the amount, the date, the status, the refund policy shown and Stripe's references. This is a communication outside Québec, and we have assessed it.

A message you send through the contact form travels by email to our mailbox, which our email provider hosts in its own data centres, outside Québec, and is kept there.

• One session cookie, set when you sign in. It tells sym's server that your browser is yours, and only the server can read it. It lasts seven days or until you sign out. This is the one function on the site that identifies you, and it works while you are signed in.
• One language cookie, named NEXT_LOCALE, set when the language of the page you open differs from your browser's language or when you switch language. It holds en or fr.

Those are the two cookies. Every script and font on the site is served by sym itself.

Vercel keeps a log of each request, the address of the page and the time, for one day. We read your IP address to limit repeated sign-in attempts, in memory, and that is where it stays. Page addresses carry no personal information.

• Your account and profile: while your account exists.
• After a deletion request: everything is removed within 30 days. An entry in a call still open is withdrawn. A closed entry is reduced to its stable id, its outcome, its consent records and the call it was in.
• A submission: for the retention period the presenter set for the call, 24 months by default, shown on the call page. It is then reduced the same way.
• A payment record: as long as the submission it belongs to, then reduced to the amount, the currency, the status and the dates, with Stripe's references removed.
• A draft still unsubmitted when the call closes: removed 30 days after the close.
• A MetaMusique import that failed: removed after 30 days. A preview you did not confirm is discarded the next time you import, and by the purge after one day.
• Consent records: kept for the retention period of the submission they belong to, and kept after the rest of the document is deleted. They are the record of what you agreed to.
• A message sent through the contact form: kept in our mailbox for as long as the exchange needs it. The scrambled form of the address stays with the audit records.

You can ask to see the information we hold about you, have it corrected, withdraw a consent you gave, or delete your account, at any time. Deletion and the interface language are on your account screen. For everything else, write to holla@presar.io.

Your information can be given to you as a structured file in a common format.

If sym publishes information about you and you believe the publication contravenes the law or a court order, or causes you serious injury, you may ask us to stop or to de-index the link, as article 28.1 of the Act provides. In this version, what sym publishes is the public call pages, which name presenters.

Every decision about your entry, including its outcome, is recorded by a person at the presenter. An identifier that fails its check is flagged for you to look at.

If you are dissatisfied with our answer, you may complain to the Commission d'accès à l'information du Québec, cai.gouv.qc.ca.

If we learn of an access, use or communication of your information outside what the law allows, or of a loss, we act to reduce the harm and to keep it from happening again, record the incident in our register and, where there is a risk of serious injury, notify you and the Commission d'accès à l'information.

A change to this policy appears on this page as a new version with its date. Account holders see the new notice at their next sign-in and acknowledge it before continuing. The date of the last change is the version date shown at the top of this page.