AKS / Less Is More Music — Privacy Notice
Last Published: 04 Oct 2026
1. Who we are
Less is More Music Limited trading as Less is More Music. We release music with and on behalf of the artist, AKS. In this notice, “we”, “us” and “our” mean us.
We are the controller of the personal data described here. That means we decide how and why it is used, and we are responsible for it.
| Registered address | 5 Brayford Square, London E1 0SG |
| Company number | 07319484 |
| ICO registration number | ZB020586 |
| Privacy contact | [email protected] |
2. What this notice covers
This notice explains how we use personal data when you:
- Buy from our store at https://aksmusic.co.uk/. The store is a WooCommerce shop we host ourselves. You can buy digital access passes and, where offered, physical items such as vinyl, CD, T-shirts.
- Use the fan portal, the members’ area of our private fan club. You get access with a digital “boarding pass” sent to you by email after purchase, or by tapping a physical NFC key.
- Join our fan mailing list by ticking the box at checkout (section 4).
- Contact us by email or social media.
What this notice does not cover. Our fan pages at aksonline.hq.fan, including the mailing list, fan profiles, SMS, pre-saves and surveys, run on a platform provided by OpenstageIt Limited. They’re covered by their own Privacy Policy and Terms for Fans. Once your details reach our mailing list, that policy governs how they’re used there. In both documents, we (AKS / Less Is More Music, called “the Artist” there) are the controller, and Openstage acts on our behalf.
3. The data we collect, why, and our legal basis
We only collect what we need to sell you access, deliver the music, protect unreleased material and understand how our releases are received. The table lists each type of data with its purpose and the legal basis we rely on under UK GDPR.
| Data | Where it comes from | What we use it for | Legal basis |
| Name, email, billing address, phone (if given) | You, at store checkout | Taking your order, creating your boarding pass, emailing your pass, customer service | Contract |
| Delivery address | You, at checkout (physical items only) | Delivering physical items | Contract |
| Order details (items, tier, price, date, order number) | Our store | Fulfilment, accounts, refunds, tax records | Contract; legal obligation (tax records) |
| Payment details | Our payment providers Stripe / PayPal | Taking payment. We never see or store your full card details. | Contract |
| Boarding pass record (pass ID, tier, seat number, which release, status) | Created by us | Giving you access to the right music and features | Contract |
| Device record: a one-way code made from technical details your browser sends (browser type, language, operating system, device type and model), a device name such as “iPhone”, first and last seen dates | Your browser, when you open the portal | Enforcing the limit of 5 devices per account, letting you see and remove your devices, preventing pass sharing | Legitimate interests (protecting paid and unreleased content) |
| Listening activity: tracks played, skipped or completed, listening time, downloads, the device code, with date and time | The portal, as you listen | Release analytics; spotting abuse such as a pass being shared; supporting you if playback fails | Legitimate interests (understanding our audience and protecting content) |
| Approximate country | Worked out from your IP address by our host. We do not store your IP address for this. | Seeing where our listeners are | Legitimate interests |
| IP address | Your connection | Short-term rate limiting to block automated abuse. Deleted within 2 days. | Legitimate interests (security) |
| NFC key sessions: session ID, date and time, device code and type, approximate country | Tapping a physical NFC key | Granting time-limited access; one-person-at-a-time enforcement on single-use keys | Legitimate interests; contract (if you bought the key) |
| Email delivery records | Our email provider | Confirming your pass, renewal or recovery email was sent | Contract; legitimate interests |
| Account status (for example archived, banned or under review) | Created by us | Enforcing our terms and preventing repeat abuse | Legitimate interests; contract |
| Mailing list details: name, email, country and city, shirt size (sized items only), and how you joined | You, when you tick the mailing list box at checkout, or join on our fan pages | See section 4 | Consent |
| Messages you send us | You | Replying to you | Legitimate interests |
4. Marketing and our Openstage fan community
4.1 Emails about your order and access
We’ll email you about your purchase, your boarding pass, access renewals, device management and important service changes. These messages are part of the service. You can’t opt out of them while you have an active pass. These emails are only about your pass and access. They never contain marketing.
4.2 Marketing emails
We only send you marketing if you ask for it. At checkout there’s a box to join our mailing list. It isn’t ticked for you, and you don’t have to tick it to buy. If you do, we’ll send you news about AKS music, merch and shows. We rely on your consent, and you can withdraw it at any time using the unsubscribe link in every marketing email, or by emailing [email protected]. Unsubscribing does not affect your boarding pass or access to the fan portal.
4.3 Passing your details to our mailing list provider
If you tick the box, our store passes these details to OpenstageIt Limited (“Openstage”), who run our mailing list at aksonline.hq.fan:
- your email address and first and last name, so we can write to you;
- your country and city, so we can tell you about shows and releases near you;
- your shirt size, if your order included a sized item, so we can tell you about merchandise in your size;
- a note that you joined at checkout, so we have a record of your consent.
If you don’t tick the box, we pass nothing. Openstage acts as our processor: they act on our instructions under a written contract, and we remain responsible for your data. From that point, how your details are used on our fan pages is explained in our Openstage Privacy Policy. Nothing from the fan portal, such as your listening activity, devices or pass tier, is shared with Openstage.
5. Who we share your data with
We don’t sell your personal data. We share it only with the providers below. Most act as our processors under a contract that requires them to keep it secure and use it only on our instructions. Stripe and PayPal process payments, and Google supplies web fonts, as independent controllers under their own privacy policies.
| Provider | What they do for us | Data involved | Where |
| Hostinger | Hosts our WooCommerce store | Orders, customer details, and mailing list sign-ups sent on to Openstage | UK (backups in Germany) |
| Stripe & PayPal | Takes card payments | Payment and billing details | UK/EU/US |
| Vercel Inc. | Hosts the fan portal | All portal data in transit; technical logs | US and global edge network |
| Supabase Inc. | Database and file storage for the fan portal | Passes, pass images (which show your name and seat), devices, listening activity, account status | EU (Ireland) |
| Cloudflare Inc. | Protects and speeds up our store; stores the portal’s audio and artwork | Store traffic, including order and customer details in transit; audio and artwork files | Global |
| Resend Inc. | Sends our account emails | Name, email, email content | US |
| OpenstageIt Limited | Our mailing list and fan community | See section 4.3 | UK |
| Postal and courier services | Deliver physical items | Name, delivery address, phone | UK / destination country |
| Google (Google Fonts) | Supplies some of the fonts on the fan portal’s boarding and pass-selection screens | Your IP address, browser details and the page that requested the font. No cookies are set.
| US and global |
We may also share data:
- with Apple, if you add your boarding pass to Apple Wallet. The pass then sits on your device and in your Apple account, under Apple’s privacy policy;
- with professional advisers (accountants, lawyers, insurers) when needed;
- with the police, regulators or a court, if the law requires it, or to protect our rights, for example to deal with leaks of unreleased music;
- with a buyer, if our business or catalogue is sold, under the same protections as this notice.
6. International transfers
Some of our providers are based in, or store data in, the United States and other countries outside the UK. When your data leaves the UK, we make sure it’s protected by one of these:
- the UK government’s adequacy regulations, including the UK–US “data bridge” for US companies certified under it;
- the UK International Data Transfer Agreement; or
- the UK Addendum to the EU Standard Contractual Clauses.
You can ask us for a copy of the safeguards that apply by emailing [email protected].
7. Cookies and storage on your device
Our website has two parts: the store, where you buy music and merch, and the fan portal, where you open your boarding pass and listen. They work a little differently, so this section covers both.
Essential cookies and storage are needed for the site to work: keeping your basket, taking payment safely, signing you in to your boarding pass and playing music. These are always on.
Analytics and advertising cookies are only used on the store, and only if you agree to them in the cookie banner. They help us understand how the store is used (Google Analytics) and show you relevant ads on Facebook and Instagram (Meta Pixel). If you decline, none of them are set.
The fan portal uses essential cookies and storage only. It has no analytics or advertising cookies, so it doesn’t show a cookie banner. Openstage pages may use analytics cookies, but only with your consent through their own cookie banner.
Essential: store
| Name | Purpose | How long |
| PHPSESSID | Keeps your visit to the store working | Until you close your browser |
| wp_woocommerce_session_* | Links you to your basket | Up to 48 hours |
| woocommerce_cart_hash, woocommerce_items_in_cart | Keeps your basket up to date | Until you close your browser |
| __wpdm_client | Handles digital downloads | Until you close your browser |
| _GRECAPTCHA (Google reCAPTCHA) | Protects our forms from spam and bots | 6 months |
| cookieyes-consent | Remembers your cookie choices | 1 year |
| Payment provider cookies, e.g. __stripe_mid, __stripe_sid (checkout only) | Fraud prevention | Up to 1 year |
Essential: fan portal
| Name | Purpose | How long |
| pass_session | Keeps you signed in to your boarding pass | 90 days |
| user_session | Lets you switch between passes on the same email | 90 days |
| nfc_session | Keeps an NFC key session open | Set by the key: from the end of your browser session up to 7 days |
| session_token (local storage) | Completes sign-in after the boarding animation | Until cleared |
| Offline music cache (service worker) | Stores tracks you’ve played so they load quickly and play offline | Until you clear it, or until your access ends (removed the next time the app checks) |
| Device identifier (not a cookie) | See section 3: enforcing the device limit | Not stored on your device |
Analytics: store only, with your consent
| Name | Purpose | How long |
| _ga, _ga_BJ8G9EM164 (Google Analytics) | Tells visitors apart and produces anonymous statistics on how the store is used | 13 months |
| sbjs_* (WooCommerce) | Records how you arrived at the store (for example from a search or a social post) so we know which links lead to orders | Until you close your browser (sbjs_session: 30 minutes) |
We use Google Analytics with Google Consent Mode. If you decline analytics cookies, no Google Analytics cookies are stored, and Google receives only limited, cookie-free signals (such as that a page was viewed) which cannot be used to identify you.
Advertising: store only, with your consent
| Name | Purpose | How long |
| _fbp, fr (Meta) | Measures our Facebook and Instagram ads and shows you relevant ads | 3 months |
| pixelcat_id, fca_pc_woo_add_to_cart | Sends store events, such as adding to your basket, to Meta | Up to 1 year |
Your choices
You can change or withdraw your consent for store cookies at any time using the cookie settings button on the store. You can also delete cookies and site data in your browser settings. If you do, you’ll need to open your boarding pass link again to sign back in.
8. How long we keep your data
We keep personal data only as long as we need it, then delete it or anonymise it so it can no longer identify you.
| Data | How long |
| Orders, invoices and payment records | 6 years from the end of the financial year (HMRC requirement) |
| Boarding pass and account (name, email, tier, status) | While you have access, and afterwards for as long as we need it to answer questions about your purchase and enforce our terms. You can ask us to delete it at any time (section 9). |
| Listening activity tied to you | 24 months, then anonymised (kept only as totals with no link to you), or sooner if we delete your account |
| Device records | Deleted after 90 days without use, or straight away when you remove a device |
| IP addresses (rate limiting) | Deleted within 2 days |
| NFC key sessions | 12 months |
| Ban records (email and ban status only) | As long as needed to stop repeat abuse, reviewed every 3 years |
| Marketing list | Until you unsubscribe, then only a “do not contact” record of your email |
| Emails you send us | 2 years after the conversation ends |
| Pass images | Deleted with your pass |
9. Your rights
You have the right to:
- access the personal data we hold about you and get a copy;
- correct data that’s wrong or incomplete;
- delete your data, where we don’t need to keep it, for example for tax records;
- restrict how we use it while a complaint is resolved;
- object to our use of it based on legitimate interests. You can always object to marketing, and we will stop;
- move data you gave us to another provider, in a common format;
- withdraw consent at any time, where we rely on it. This doesn’t affect anything we did before.
To use any of these rights, email [email protected] with the subject “Privacy request”. We may ask you to confirm your identity, usually by replying from the email address on your pass. We’ll reply within one month. If your request is complex, it may take up to two more months, and we’ll tell you if so. It’s usually free.
If you ask us to delete your data while you have an active pass, your access will end, because we can’t give you access without knowing who you are. We’ll still keep order records for as long as tax law requires.
Complaints. We’d like the chance to fix any concern first. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
10. Security, children, automated decisions and changes
Security. Data in the portal is encrypted in transit and stored with providers that encrypt it at rest. Access to the admin area needs a sign-in link plus a one-time code from an authenticator app. Changes to admin accounts, and every export or deletion of a person’s data, are logged. Music files are delivered through short-lived signed links. No system is perfectly secure. If a breach is likely to put you at risk, we’ll tell you and the ICO as the law requires.
Children. Our store and fan portal are for people aged 13 and over. If you’re under 18, you need a parent or guardian’s permission to buy. If we learn that we hold data about a child under 13, we’ll delete it.
Automated decisions. We don’t make decisions about you that have legal or similarly significant effects using automated means alone. The portal automatically limits each account to 5 active devices, and you can remove a device yourself. If you’ve previously been banned and buy a new pass, it’s held for a person to review rather than refused automatically.
Changes to this notice. We’ll post any changes here and update the date at the top. If a change is significant, for example a new use of your data, we’ll email you before it takes effect.
