Privacy Policy

1. Summary

• We collect information you provide (account, profile, uploads, submissions, messages), information generated as you use the Platform (orders, playback and interaction events, device and log data), and information from partners (such as our payment processor).
• We use it to operate the marketplace, catalog, and label; process payments and payouts; personalize and recommend; keep the Platform safe; communicate with you; and meet legal obligations.
• We share it with service providers (payments, hosting, storage, email, analytics, distribution, accounting), with other users where you choose to make information public, and where required by law. We do not sell your personal information.
• You have rights over your information, including access, correction, deletion, and objection, described in Section 11.

2. Information we collect

2.1 Information you provide

• Account & identity: name, display name, username, email address, password (stored hashed by our auth provider), and account settings.
• Profile: avatar, cover image, bio, location, genres, role, social links, and—for professionals—headline, studio details, equipment/software, experience, and portfolio.
• User Content: audio uploads, recordings, artwork, credits, metadata, playlists, reviews and ratings, and messages.
• Label submissions: the artist and track information, biography, links, team details, and files you submit to our A&R team.
• Transactions: orders, order requirements and files, and, for sellers and artists, payout and tax details needed to pay you (handled with our payment provider).
• Support & communications: messages you send us and information in support requests, reports, or disputes.

2.2 Information collected automatically

• Usage & interaction events: searches, pages and services viewed, favorites, and other interactions used for search and recommendations.
• Listening events: plays, meaningful plays, and completions used to power “recently played” and discovery. These are a product/analytics signal and are kept separate from royalty accounting.
• Device & log data: IP address, browser and device type, operating system, referring pages, timestamps, and diagnostic/error data.
• Cookies and similar technologies: see Section 5.

2.3 Information from third parties

• Payment provider: transaction status, payout status, and limited billing metadata (we do not receive full card numbers).
• Authentication and infrastructure providers that help us verify sessions and operate the service.
• Public or partner sources you connect or that you make available (for example, links you add to your profile).

We do not intend to collect special-category data (such as health or precise biometric data). Please do not submit it unless necessary and lawful. Voice recordings you upload are User Content you are responsible for having the rights to.

3. How we use your information

We use personal information to:

• create and manage your account and its capabilities;
• operate the marketplace—list services, process orders, enable messaging and file exchange, and facilitate payments and payouts;
• operate the catalog—stream rights-cleared music, power libraries, playlists, follows, and discovery;
• operate the label—receive and evaluate submissions and administer signed-artist relationships;
• personalize content and provide rule-based recommendations;
• detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms, including account moderation;
• provide support and respond to your requests;
• send service, transactional, and (where permitted) marketing communications;
• analyze and improve the Platform and develop new features; and
• comply with legal obligations, including tax, accounting, and record-keeping.

4. Legal bases (EEA/UK)

If you are in the EEA or UK, we rely on the following legal bases under the GDPR/UK GDPR:

• Performance of a contract — to provide the Platform, process orders, and pay sellers and artists.
• Legitimate interests — to secure the Platform, prevent fraud and abuse, understand usage, and improve and market our services, balanced against your rights.
• Consent — for certain cookies and optional marketing; you may withdraw consent at any time.
• Legal obligation — to meet tax, accounting, and other legal requirements.

5. Cookies and similar technologies

We and our providers use cookies and similar technologies to:

• Strictly necessary — keep you signed in, maintain sessions, and secure the Platform. These cannot be switched off without breaking the service.
• Functional — remember preferences such as theme and playback state.
• Analytics — understand how the Platform is used so we can improve it.

You can control cookies through your browser settings and, where offered, through our cookie/consent controls. Blocking some cookies may affect functionality. We honor recognized opt-out signals where legally required.

6. How we share information

We share personal information only as described here:

• Other users. Information you choose to make public—such as your public profile, artist page, credits, reviews you post, and public playlists—is visible to others. Order-related details are shared between the Buyer and Seller involved.
• Service providers (processors) who act on our instructions, including: payment processing (Stripe); hosting, database, authentication, and file storage (Supabase and its infrastructure providers); email/notification delivery; analytics and error monitoring; music distribution to digital service providers for released catalog; and accounting/bookkeeping (which may include QuickBooks) for finance operations.
• Professional advisors such as auditors and lawyers, under confidentiality.
• Legal and safety. To comply with law, respond to lawful requests, enforce our Terms, or protect the rights, property, and safety of WAVEKEEP, our users, or the public.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your consent or at your direction.

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

7. Payment information

Card and bank details are collected and processed directly by our payment provider (Stripe) under its own terms and privacy policy. We do not store full payment-card numbers. We receive transaction and payout status and limited metadata needed to fulfill orders, pay sellers and artists, handle refunds and disputes, and meet tax and accounting obligations.

8. Data retention

We keep personal information for as long as needed to provide the Platform and for the purposes described here, then delete or anonymize it. Retention periods depend on the type of data and our legal obligations, for example:

• Account and profile data — for the life of your account, then removed or anonymized after closure, subject to backups and legal holds.
• Transaction, invoice, and tax records — for the period required by tax and accounting law (often several years).
• User Content — until you delete it or your account, subject to residual backups and content others have saved or re-shared.
• Usage, listening, and log data — for a limited period for analytics, security, and troubleshooting.
• Moderation and dispute records — as needed to enforce our Terms and resolve disputes.

9. How we protect your information

We use technical and organizational measures designed to protect personal information, including encryption in transit, hashed credentials, access controls, and database row-level security that scopes data to the accounts entitled to it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential.

10. International data transfers

We may process and store information in countries other than where you live, including the United States. Where we transfer personal information out of the EEA, UK, or other regions with transfer restrictions, we use appropriate safeguards—such as Standard Contractual Clauses—or another lawful transfer mechanism. Contact us for more information about these safeguards.

11. Your privacy rights

11.1 EEA/UK and similar jurisdictions

Subject to conditions and exceptions, you may have the right to:

• access the personal information we hold about you and receive a copy;
• correct inaccurate or incomplete information;
• delete your information (“right to be forgotten”);
• restrict or object to certain processing, including direct marketing and processing based on legitimate interests;
• data portability—receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• lodge a complaint with your local data-protection authority.

11.2 United States (including California)

Depending on your state, you may have the right to know or access the categories and specific pieces of personal information we collect, to delete or correct it, to opt out of any sale or sharing for targeted advertising (we do neither), and to be free from discrimination for exercising these rights. You may use an authorized agent, and we will verify your request before acting. If we decline, you may appeal by contacting us.

11.3 How to exercise your rights

Email privacy@wavekeep.com. You can also update much of your information directly in your account settings, and delete your account there or by contacting us. We may need to verify your identity before responding, and we will respond within the timeframe required by applicable law.

12. Children’s privacy

The Platform is not directed to children under 16 (or the age of digital consent in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

13. Automated decision-making

Our recommendations and discovery features are rule-based and designed to help you find music, artists, and professionals. We do not use solely automated processing that produces legal or similarly significant effects about you without human involvement. Account moderation decisions involve human review.

14. Third-party links and services

The Platform may link to or rely on third-party sites and services with their own privacy practices. We are not responsible for those practices; review their policies before providing information.

15. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will update the effective date above and provide notice where appropriate. Your continued use of the Platform after changes take effect means you accept the updated Policy.

16. Contact us

For privacy questions or to exercise your rights, contact our privacy team at privacy@wavekeep.com, or our Data Protection Officer at dpo@wavekeep.com. You can also write to WAVEKEEP, [Company mailing address]. If you are in the EEA or UK and we are required to designate a representative, their details are: [EU/UK representative name and contact].

This document is a detailed starting template tailored to WAVEKEEP’s data practices. It is not legal advice. Confirm the named sub-processors and retention periods match your actual deployment, complete the bracketed items, and have it reviewed by qualified privacy counsel before you rely on it.