1. Who we are
This website, sushmitasrivastava.com, is operated by Sushmita Srivastava, an independent singer based in India. It exists to present her music and link to the streaming platforms that host it.
For any question about this policy, or about data held about you, write to sri@sushmitasrivastava.com.
2. What data we collect
From visitors to this website
This site has no contact form, no account system, no newsletter sign-up and no advertising. It does use Google Analytics to count visits and see which songs people open — nothing more. We do not ask you for your name, email address or any other personal detail, and we do not build a profile of you.
Like almost every website, the web server records a standard access log for each request. Those entries contain:
- your IP address
- the date and time of the request
- the page or file requested
- your browser and operating system, as reported by your browser
- the page that referred you, when your browser sends one
These logs exist to keep the site running and secure — diagnosing errors, and identifying abuse such as automated attacks. They are not used to identify individual visitors, are not combined with any other data, and are not sold or shared.
From the Listen pages
Each song has a page at sushmitasrivastava.com/listen/<song> with buttons for Apple Music, Spotify, YouTube Music and JioSaavn. A button goes through our own server first (/go/<song>/<platform>) so we can count which platforms people choose. That request is written to a separate server log with the same fields as above: IP address, time, page, browser and referring page. Once a day the log is counted into a table that keeps only the day, the song, the platform and the number of clicks — no IP address and nothing about the person. The log itself is deleted after 14 days. No cookie is set and no third party is involved.
From embedded content
The home page embeds one video player from YouTube. We use the youtube-nocookie.com domain, which does not set advertising cookies until you actually start playing the video. Once you press play, YouTube receives your request directly and its own privacy policy applies to that interaction. We receive nothing from it.
Fonts and icons are served from this site itself, so no third party sees your request for them. The only external request an ordinary visit makes is to Google Analytics. A request to YouTube happens only if you press play on a video.
From Sushmita's own social media accounts
This is the part that matters for platform reviewers.
Sushmita uses a private, self-hosted dashboard to manage her own accounts on YouTube and — where enabled — Instagram, Facebook, Threads and WhatsApp. It is used by two people: Sushmita and her manager. It is not offered to anyone else.
YouTube API Services. The dashboard uses YouTube API Services to manage Sushmita's own YouTube channel. By using it, its users agree to be bound by the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy.
Through an access token Sushmita granted with Google's own sign-in, the dashboard:
- reads her channel's analytics and statistics (views, watch time, subscribers, traffic sources, countries, per-video daily figures), her videos' titles, descriptions and tags, and the comments people leave on her videos (a public display name and the comment text);
- stores these in a private database on a server she controls;
- computes internal metrics from them for her own planning — for example week-over-week change, how a video moved compared with the rest of her channel, and the cost per subscriber of her own ads. These are calculated by the dashboard, not by YouTube, and are labelled that way;
- writes only to her own channel: uploads of her own recordings, title, description and caption changes, replies to comments, and playlist additions. It cannot delete anything on YouTube.
Service providers that process it. These companies process some of this data for us, only to do the work described here:
- Anthropic (the Claude AI models) receives the text and public display name of a comment on her videos, so the dashboard can write a reply in her voice, which is posted automatically within set rules and limits (a professional tone checked before posting, at most 50 replies a day, and no reply to suspected spam); her own video titles and descriptions when drafting new ones; and the text, name and email address of messages sent to music@sushmitasrivastava.com, so it can suggest a reply for Sri to send. Anthropic does not use data sent through its API to train its models by default.
- DataForSEO receives search phrases and the names of her songs and channel, to check where her videos appear in search. It receives no personal data about anyone.
- Google provides YouTube, the YouTube API Services, Google Analytics for this website, and Gemini, which is asked public questions about her music each week to see whether AI assistants mention her. No personal data is sent in those questions.
- Perplexity is asked the same public questions each week, and receives no personal data.
- OpenAI (ChatGPT) is asked the same public questions, and receives no personal data.
- Titan (email hosting) hosts the music@sushmitasrivastava.com mailbox, so it processes the emails sent to and from it.
- Meta (Instagram) provides the Instagram API. Through an access token Sushmita granted with Instagram's own sign-in, the dashboard reads her account's followers, reach and the insights of her own posts, and publishes posts approved by Sushmita or her team. Instagram's own privacy policy covers how Meta handles that data. We do not read anyone else's account, messages or followers list.
None of this data is sold, used for advertising, or used to profile the people who watch or comment. We do not access anyone's private data, subscriptions, messages or contacts. Tokens are stored on a private server with file permissions restricting them to the system owner, and are never shared.
When we contact press and playlist curators
To tell music writers and playlist curators about her releases, we keep the name and business email address that an outlet or curator publishes for submissions — on its own website, or in a public Spotify playlist description — together with the one pitch we sent and any reply. Each is contacted once; there is no follow-up. If you reply asking us not to write again, or ask us to delete your details, your address is kept only on a do-not-contact list so that it is never emailed again, and everything else is deleted.
3. Cookies
This website sets no cookies of its own and no advertising cookies. Google Analytics sets two of its own — _ga and _ga_06J3QFCYTP — which hold a randomly generated number so that a repeat visit is not counted twice. They carry nothing that identifies you, and Google discards part of your IP address before storing anything.
If you are in the EU, the EEA or the UK, nothing is stored until you say so. Analytics is switched off before the page loads for visitors in those countries — Google checks that against your IP address, not against anything this page guesses — and a small bar at the bottom asks whether you are happy for it to be switched on. Choose Reject and no analytics cookie is ever written. Choose Accept and the two cookies above are set. Either way the choice is remembered in your own browser, so you are only asked once, and you can change it by clearing this site's data.
Everywhere else, analytics is on by default and the bar is not shown. If you would rather it were off, any browser's Do Not Track or tracking-protection setting, or an ad blocker, will stop it — and the site works exactly the same either way.
The private administrative dashboard used to manage the music catalogue sits on a separate subdomain and is not part of this website. It sets a single session cookie for the signed-in operator, which does nothing but keep that person logged in. Visitors to this site never receive it.
4. Third-party services
Clicking a streaming link takes you to a third party, whose own terms and privacy policies then apply. We have no control over, and take no responsibility for, how they handle your data. The services linked from this site are:
- Google / YouTube — video hosting, embedded player, YouTube Music
- Spotify — music streaming
- Apple Music — music streaming
- JioSaavn — music streaming
- Meta — Instagram profile link
- Threads — profile link
- Gaana — music streaming
- Google Analytics — counts visits and records which song pages, streaming links and lyrics tabs get opened. Denied by default in the EU, EEA and UK until you accept (Google Consent Mode v2)
5. How long data is kept
- Server access logs, including the Listen-page click log — 14 days, then deleted automatically. Click counts (day, song, platform, number) are kept.
- Her YouTube analytics and statistics (views, watch time, subscribers, traffic sources, countries, per-video daily figures, and the metrics the dashboard calculates from them) — kept while her channel stays connected. The connection is checked every day.
- Comments on her videos — the commenter's display name and the comment text are deleted 30 days after we read them. Our reply is kept.
- Her video titles, descriptions and tags — refreshed from YouTube every day; a copy not refreshed for 30 days is deleted, as is the record of a video that has been gone from her channel for 30 days.
- Earlier versions kept for Undo (a title or description before a change) — deleted after 30 days, when Undo is no longer offered.
- Public data about other channels' videos used for comparison — deleted 30 days after it was last seen.
- Press and curator contact details and the pitch we sent — kept so that nobody is contacted twice; an opt-out keeps only the address, on the do-not-contact list.
- Platform access tokens — until Sushmita revokes them or they expire.
Revoking access. Sushmita can revoke the dashboard's access to her YouTube data at any time on her Google Account's permissions page: myaccount.google.com/permissions (also reachable as security.google.com/settings/security/permissions). If YouTube stops accepting our access, every piece of data obtained through YouTube API Services is deleted within 21 days — inside the 30 days YouTube's policy allows. A deletion request emailed to sri@sushmitasrivastava.com is carried out within 7 days.
Nothing on this list is retained for advertising or profiling, because we do neither.
6. Your rights
Under India's Digital Personal Data Protection Act, 2023, and under the EU and UK General Data Protection Regulation where it applies to you, you have the right to:
- ask what personal data we hold about you
- ask for it to be corrected
- ask for it to be deleted
- object to its processing, or ask that we restrict it
- complain to your data protection authority
In practice we hold very little: unless you have commented on one of her videos or posts, a server log entry containing your IP address is likely to be the only record that exists, and it is deleted within 14 days. A comment's display name and text are deleted within 30 days.
To make any of these requests, email sri@sushmitasrivastava.com. We will respond within 30 days. We may need to ask for information confirming your identity before acting on a request about personal data.
7. Children
This site is not directed at children and does not knowingly collect data from anyone under 18.
8. Changes to this policy
If this policy changes, the revised version will be posted on this page with a new date below. Material changes to how data is used will be described rather than made quietly.
9. Governing law
This policy is governed by the laws of India, and the courts of India have jurisdiction over any dispute arising from it.
10. Contact
Privacy questions and data requests: sri@sushmitasrivastava.com
General enquiries: sushmita1317@gmail.com