SONGRAC PRIVACY POLICY

Songrac, Inc. (“Songrac,” “we,” “our,” or “us”) is a Delaware corporation based in the United States. This Privacy Policy describes how personal information is collected, used, disclosed, retained and protected through the Songrac website, accounts, music distribution features and public Artist Link Pages. It applies to account holders, invited Artists, people named as writers or other contributors, visitors to public Artist Link Pages and other website visitors, including fans who do not have an account.

A “User” is the person or organization that controls a Songrac account. An “Artist Login” is restricted access to that Artist’s permitted catalog and public Artist Link Page. A User can manage several Artists and is responsible for certain data submitted about them. A fan visiting a public Artist Link Page is not required to have a Songrac account. Please also read our Terms of Service and Music Distribution Agreement.

1. Personal information we collect

We collect information that you provide, information generated when you use the Services, information supplied by Users about Artists and collaborators, and information provided by relevant payment, distribution and other service providers.

1.1 Account, identity and profile information

This can include legal names, artist or stage names, organization names, email addresses, phone numbers, country, roles and permissions, verification status, account preferences, login identifiers and records of your acceptance of applicable terms. Authentication is managed through our sign-in services; Songrac does not need access to readable passwords.

1.2 Payment, billing and royalty information

Payment and billing information can include the $39 annual Songrac user account subscription, additional $12 annual Artist Slots, one-time $4 Song Credit purchases, receipts, tax and billing details, payment status, renewals, cancellations, masked payment card information and processor transaction identifiers. The annual account subscription includes one Artist Slot and a one-time grant of 12 complimentary Song Credits. Stripe processes customer card payments to Songrac. Songrac does not store full payment card numbers or security codes, although the payment processor may do so under its own terms and privacy notice.

Where royalty features apply, we process recording and account identifiers, reported plays and purchases, royalty statements, amounts credited to Users, service fees and commissions, adjustment lines, disputes, balances, tax information where necessary, payout eligibility and payout instructions. A payout provider may collect full bank account and identification documents directly. Songrac may receive payment-account identifiers, verification results, bank names, last four digits, account fingerprints, tax-compliance results and transfer status information. The provider used for future royalty disbursements and the associated settlement mechanics may change; this Policy does not imply that a particular provider or custody arrangement has been approved or activated.

1.3 Catalog, Artists and collaborator information

Catalog and collaborator information may include recordings, cover art, photographs, Artist names and profiles, public Artist Link Page content, release metadata, writer and composer names, publisher and performing rights organization affiliations, identifiers such as ISRC, UPC, IPI and ISNI, rights declarations, licensing details and any contact information the User provides. The information can concern individuals who never register with Songrac. Some writer and publisher identity records may be shared, matched or reused across different customer accounts in an upstream distribution system to support accurate credits and prevent duplicate or conflicting identities.

1.4 Rights, safety, support and communications

We may maintain records of music submissions, copyright warranties, AI or sample disclosures, Terms acceptances, store delivery decisions, rights complaints, counter-notices, fraud reviews, security events, customer support cases, emails and messages sent to Ringo, Songrac’s automated assistant.

1.5 Automatically collected information

Technical information can include IP address, approximate country inferred from IP address, browser and device type, operating system, access timestamps, requested pages and URLs, error reports, security events, login activity, and where available the referring page or source. These records may be collected from ordinary website visitors and fans visiting a public Artist Link Page, even if they do not log in or submit information. Where advertising measurement is enabled, additional browser identifiers, advertising cookies, referral or campaign information, and details of eligible visits or conversion events may be collected or shared as described in Sections 1.8 and 7. IP-based country estimates can help verify registration and payout eligibility and protect against abuse, but they are not guaranteed accurate.

1.6 Information obtained from third parties

Our distribution and accounting partners and Digital Services supply release status, usage data, royalties, adjustments, claims and other catalog activity. Payment and identity providers give us transaction and verification information. We may receive legitimate copyright complaints, abuse reports or compliance information from rights holders, regulators and authorized third parties.

1.7 Public Artist Link Page visitors

Fans and other visitors can view public Artist Link Pages without creating a Songrac account. To deliver, secure and troubleshoot those pages, Songrac and its hosting and security providers may process access logs, IP addresses, device/browser information, page URLs, timestamps and similar technical data. Where the Meta Pixel is enabled on a public page, advertising-related information may also be collected as described in Section 7, subject to applicable consent and opt-out rules. The pages may display information and links intentionally published by a User or authorized Artist. Songrac does not currently offer a dedicated Artist-facing fan analytics or fan mailing-list service through these pages. Following a link to another service may result in that service collecting information under its own privacy policy.

1.8 Advertising and conversion measurement information

Songrac uses the Meta Pixel for advertising measurement on eligible parts of its website. When enabled on a page, Meta may receive or collect identifiers associated with browser cookies, IP address, browser or device details, page addresses and referring information, advertising-click identifiers and information about visits to Songrac pages. Depending on the events actually enabled, measurement may also concern successful account registrations and first paid subscription activations, including the event type, time and relevant payment value. These are different from unpaid registration attempts or subscription renewals. If an approved server-side Meta Conversions API integration is later enabled, selected permitted information may also be sent by Songrac directly to Meta, including appropriately transformed or hashed matching identifiers where configured. Hashing does not necessarily make information anonymous. We do not intentionally send full card or bank details, royalties, private catalog files, writer records, passwords, government IDs or sensitive account content to Meta for advertising measurement.

2. Why we use personal information

We use personal information to register and maintain accounts; verify identity and contact details; administer the account subscription, Artist Slots, Song Credits, billing, renewals and cancellation; host public Artist Link Pages; deliver music and metadata to selected Digital Services; reconcile statements, calculate eligible royalties, fees, commissions and adjustments; arrange lawful payouts; maintain security and enforce country or sanctions restrictions; address rights and copyright issues; respond to support requests; and operate Ringo when requested. We also use Meta advertising measurement to understand visits associated with our marketing, measure successful registrations and initial paid activations where enabled, attribute conversions to advertising campaigns and improve advertising effectiveness. For public page visitors, technical information may be used for page delivery, security and, where enabled and legally permitted, advertising measurement. Songrac does not provide Artists with a dedicated fan analytics service through its current Link Pages.

We do not sell personal information in exchange for money. However, sharing browsing activity, device identifiers or conversion information with Meta for advertising measurement or optimization can be treated as a "sale," "sharing" or "targeted advertising" under some United States state privacy laws, even without payment to Songrac. Where those laws apply, the associated opt-out rights are described in Sections 7 and 13. Songrac does not authorize the use of a User’s private catalog or account data to train unrelated third-party generative AI models as a general purpose of the Services. Specific AI processing necessary to answer a Ringo query is described below. If we introduce materially different uses, we will provide additional notice or obtain consent where applicable law requires it.

3. Legal bases for processing in the EEA, UK and similar jurisdictions

Where law requires a legal basis, Songrac relies on one or more of the following as relevant to the activity:

• Contract or steps requested before contract: account creation, subscription administration, access, music delivery, support and other features requested by a User.
• Legal obligations: tax and accounting records, sanctions, lawful disclosures, valid rights notices and legally required identity checks.
• Legitimate interests: keeping the platform secure and reliable, detecting abuse, resolving disputes, preventing infringement and payment fraud, protecting users and rights holders, maintaining proportionate evidence of transactions and improving essential functionality, subject to appropriate balancing against individual rights.
• Consent: nonessential cookies, Meta advertising technologies and related marketing measurement where consent is required; other purposes for which consent is expressly requested. Consent may be withdrawn without retroactively invalidating lawful processing that occurred before withdrawal. Where consent is not the required legal basis, applicable advertising opt-out rights and other legal requirements still apply.

For information about someone other than the contracting User, the appropriate legal basis may depend on whether Songrac or the business User determines the purposes of the processing. Songrac may be an independent controller for its own account, security, billing and compliance activities and a processor for certain data handled solely on a business User’s documented instructions. The roles and any applicable Data Processing Agreement must reflect the actual Services and applicable law.

4. When and with whom we share information

We share information as necessary for the purposes above, subject to applicable law and contractual protections where relevant. Recipient categories include:

• Music distribution and accounting partners: to deliver releases and metadata, process claims, collect and reconcile store statements and help administer royalties. We may use white-label partners and do not routinely identify every commercial integration in customer-facing agreements. We will identify a particular recipient or subprocessor where the law or an applicable Data Processing Agreement requires it.
• Digital Services and public platforms: streaming, download, user-generated-content and social services selected or authorized for a release. Artist names, credits, public images, recordings and metadata may become public and subject to the Digital Services’ own privacy practices.
• Payments, banking and verification providers: Stripe for subscription transactions; banks and, where enabled, a selected royalty payout provider for verification, payment administration and compliance. A future provider may replace or supplement existing providers following appropriate notice and legal safeguards.
• Technical service providers: Google services, including Firebase authentication and cloud hosting where used, and Twilio where used for SMS verification; operational providers for email delivery, security, diagnostics and customer support.
• AI processing providers: Anthropic’s API, identified as the service supporting Ringo, receives the prompts and relevant context needed to provide a requested response, subject to applicable provider terms and the safeguards Songrac implements.
• Meta advertising services: Meta Platforms and its relevant affiliates, through the Meta Pixel and, if enabled later, the Meta Conversions API, for permitted advertising attribution, performance measurement and optimization. Meta may receive or collect device and online activity information and may use it under its own privacy terms. See Section 7 and Meta's privacy policy at https://www.facebook.com/privacy/policy/.
• Account participants: a User may view and manage Artists and Releases associated with the account. An authorized Artist Login may manage only that Artist’s permitted catalog and public Artist Link Page, not billing, royalties, payout information or private collaborator splits. Information supplied for shared writer or publisher identities may appear to other authorized account users or relevant distribution partners to the limited extent required for release metadata and accurate attribution.
• The public and link-page visitors: names, photographs, promotional text, music artwork, credit information and third-party links deliberately published on public Artist Link Pages, or delivered as public release metadata to Digital Services, may be accessible to fans and search engines globally. Visitors may also interact directly with third-party destinations under those services’ separate privacy rules.
• Professional advisers, corporate successors and authorities: where reasonably necessary for lawful claims, audits, disputes, restructuring, enforcement, compliance or a legitimate corporate transaction.

Some partners independently decide how they process data that is properly shared with them, while others act for Songrac or for business Users under instructions. The privacy policies of independent Digital Services or payment providers also apply to their separate processing.

5. Public artist information and link pages

Information intentionally published through an Artist Link Page can be visible to anyone, including visitors without Songrac accounts, and can be indexed, copied, shared or cached by search engines, listeners and social platforms. Users and authorized Artists control the public content they publish through available page features and must possess lawful authority to publish personal information, images, credits and other material. Songrac may host the page and process visitor request logs for delivery, security and abuse prevention. Songrac may also conduct its own Meta advertising measurement on public Artist Link Pages where enabled, as explained in Section 7; this is separate from an Artist-facing fan analytics product. Where pages contain outbound links, clicking them can send a visitor to an independent service that separately determines its own data practices. Songrac does not currently operate a pre-save sign-up, fan email capture or dedicated Artist-facing fan analytics service through these pages. Deleting a Songrac page cannot ensure removal of copies held by independent third parties.

6. Ringo and automated assistance

When you use Ringo, Songrac processes your question and relevant account or catalog context that you are authorized to access. A third-party AI provider processes the information needed to generate a response. Do not put unnecessary financial identifiers, identity documents, health information or confidential third-party details into Ringo. Automated responses may be inaccurate and are not a substitute for professional advice. Ringo is not described as making binding decisions about rights ownership, legal eligibility or payouts without appropriate human or operational review.

7. Cookies, Meta Pixel and advertising choices

We use cookies, local storage and similar technologies for authentication, security, user sessions, site preferences and essential website functions. Separately, Songrac uses the Meta Pixel, an advertising measurement technology operated by Meta Platforms. On pages where it is enabled, the Pixel can cause a browser to contact Meta and permit Meta to collect or receive online activity information and advertising identifiers, including Meta cookies such as _fbp and _fbc where present, IP address, browser and device information, page URLs, referral or campaign information, and event data. The purpose is to measure how people respond to Songrac advertising and, where permitted, improve attribution and advertisement effectiveness on services such as Facebook and Instagram. The types of events may include PageView, CompleteRegistration and Purchase if enabled; we do not claim that every event is active today. Meta can process information it receives for purposes described in its own privacy policy, potentially including advertising personalization.

Songrac may use Meta advertising measurement on public Artist Link Pages as well as other website pages if the Pixel is enabled there. Visitors do not need an account to encounter such measurement. The presence of Meta advertising tracking does not mean Songrac offers the Artist or account holder a fan analytics dashboard, fan mailing list or pre-save service. We do not treat marketing measurement as an essential function required to create a Songrac account, submit a release or visit a public Link Page.

7.1 Advertising consent, withdrawal and opt-outs

Where applicable law requires advance consent for optional advertising cookies or tracking technologies, we seek that consent before using those technologies. Declining or withdrawing advertising consent must not prevent access to essential Songrac features. Where applicable law gives a right to opt out of sharing or targeted advertising, you can submit that request through Songrac Support at support@songrac.com, and we recognize applicable browser opt-out preference signals, including Global Privacy Control, as required by law. If website privacy-choice controls are available, they may be used to manage your preference. Browser settings can help limit cookies but may not, by themselves, prevent all server-side transmission of information. You may also manage certain Meta advertising preferences directly through Meta.

7.2 Meta Conversions API

If Songrac enables Meta's server-side Conversions API, it may report selected advertising conversions, such as completed account registrations or confirmed initial paid subscription activations, directly from its servers. Data types may include an event identifier, event timestamp, event source, campaign or browser identifiers, actual initial payment value in US dollars and, where specifically enabled and permitted, hashed matching identifiers. Server-side transmission is subject to the same applicable consent and opt-out restrictions as browser-based tracking. This feature is only used if enabled for Songrac and permitted by applicable law.

7.3 Meta information and cookie retention

Songrac retains advertising event records, campaign attribution information and privacy preference or consent evidence only as reasonably needed for advertising measurement, security, troubleshooting, accounting support where applicable and legal compliance. We determine retention by the type of information and applicable requirements rather than a single unlimited period. Meta is separately responsible for its retention and further use of information it receives, as described in Meta's own privacy policy. Withdrawing consent or opting out generally affects future processing and does not necessarily erase information already processed lawfully.

8. Emails, SMS and other communications

We use your verified account contact information for essential messages such as authentication codes, receipts, subscription and renewal notices, security alerts, release updates, payment issues, rights complaints and responses to support requests. These transactional messages may continue where reasonably necessary even if you opt out of promotional messages.

If Songrac sends optional promotional emails or text messages, we will use any consent or other legal basis required for the location and channel and provide applicable unsubscribe or preference controls. Marketing preferences do not remove obligations relating to contracts, existing royalties, security or compliance.

9. Retention and deletion

We keep personal information only for as long as reasonably necessary for the purposes explained here, including an active account, maintaining a distributed catalog, administering royalties, providing support, complying with legal retention requirements and resolving genuine disputes. We apply different retention criteria to different records:

• Active account and catalog data: while the account, distributed music or associated service remains in use, followed by a reasonable closure, takedown and support period.
• Financial, tax and royalty records: for applicable tax, accounting, audit, payment, unclaimed-property and contract limitation periods, including adjustments that arrive after a release or subscription ends.
• Rights confirmations, licenses and infringement records: while the relevant content or rights are active and for a further proportionate period where reasonably necessary to establish, defend or resolve claims; these records are not kept permanently merely because the system can retain them.
• Security and technical logs: for appropriate operational and security periods, extended where a specific incident, investigation or legal obligation justifies it.
• Support, Ringo and communication records: for operational support, quality, safety and dispute needs, subject to provider retention and lawful deletion requirements.
• Advertising and privacy-choice records: for the periods reasonably needed to validate campaign measurement, honor user choices, investigate errors and demonstrate compliance with applicable privacy obligations; retention is reviewed and limited according to purpose.
• Backups: under a rotation schedule; deletion from active systems may not instantly remove information from every protected backup.

When an applicable purpose and legal basis end, we will delete, deidentify or restrict access to data as appropriate. A lawful deletion request may not require erasure of data still needed for pending store royalties, fraud prevention, legal compliance or a real claim. We will not present rights-confirmation records as categorically immune to privacy erasure rights.

10. Security and incident response

We use reasonable administrative, technical and organizational measures appropriate to the personal information involved, including access restrictions, authenticated accounts, measures intended to protect transfers and systems, and monitoring for misuse. Not every risk can be eliminated. Where applicable law requires it, we will investigate reportable security incidents and notify affected people or regulators within the required time.

11. International processing and transfers

Songrac is based in the United States. Personal information may be processed in the United States or other countries where Songrac, its service providers or authorized Digital Services operate. Worldwide music delivery necessarily involves international sharing of public artist and catalog information. Local privacy laws may differ from those in your country.

Where EU, UK, Swiss or other rules require transfer safeguards, Songrac will use an appropriate lawful mechanism for the relevant data transfer, such as an applicable adequacy decision, approved standard contractual clauses, the UK International Data Transfer Agreement or approved addendum, together with supplementary protections where required. You may contact us about the applicable safeguards and available copies where the law grants that right. We do not treat the act of signing up as a waiver of lawful international transfer protections.

12. Privacy rights for EEA, UK and Swiss individuals

Depending on your location and the processing, you may have rights to access information, receive a copy, correct inaccurate data, request deletion or restricted processing, object to certain legitimate-interest processing, portability of eligible data, and withdraw consent where consent is the legal basis, including consent to optional advertising tracking. You may complain to a relevant supervisory authority, including the supervisory authority in your EEA country, the UK Information Commissioner or the Swiss Federal Data Protection and Information Commissioner, as applicable. Statutory exceptions can apply.

Where EU GDPR or UK GDPR requires an EU or UK representative, Songrac will make the representative’s contact details available through its publicly accessible privacy contact information. Certain business customers act as controllers of the personal information they submit concerning Artists or collaborators; requests about that information may need to be referred to that customer where Songrac processes it only on the customer’s instructions.

13. United States state privacy rights

Residents of California and other states with applicable privacy statutes may, subject to statutory coverage and exceptions, have rights to know and access personal information, correct inaccuracies, delete certain information, receive a portable copy, opt out of covered sales or sharing and certain targeted advertising, limit certain use of sensitive information, and appeal qualifying denials. Songrac's use of the Meta Pixel for advertising measurement may qualify as "sharing" or "targeted advertising," and potentially as a "sale" under a law that defines those terms broadly, even where we receive no monetary payment. To request an applicable opt-out, contact support@songrac.com; where applicable, our website must also process legally recognized opt-out preference signals such as Global Privacy Control. We will not unlawfully discriminate against you for exercising these rights.

For California notice purposes, the categories that may be collected include identifiers and contact information; commercial, billing and royalty records; internet, device and activity information, including advertising-cookie identifiers, website visits and eligible conversion events; professional, public artist and catalog identifiers; visual and audio content; approximate location inferred from an IP address; and rights, verification and legal-compliance information. Purposes, sources and recipient categories, including Meta for advertising measurement, are explained throughout this Policy. We do not sell personal information for monetary consideration, but advertising-related disclosures may constitute a sale or sharing under applicable law. Applicable consumer rights, choice mechanisms and retention criteria are described here and in any additional notices required by law.

14. Children and artists who are minors

User accounts and Artist Logins are intended for adults aged at least 18 and of legal majority. Public Artist Link Pages may nonetheless be viewed by music fans of different ages without registration. We do not knowingly ask children to submit personal information through the current Link Page feature. Basic technical information may be processed when any visitor views a public page for delivery and security purposes. A User may supply a minor Artist’s or collaborator’s catalog information only with the necessary legal authority, notices and permissions, including guardian consent where required. Please contact us if you believe personal information about a child has been collected unlawfully.

15. How to make privacy requests

Privacy requests, including requests to opt out of advertising-related sale, sharing or targeted advertising where available by law, may be submitted through the website or in-account Support function or to support@songrac.com. Visitors to public Artist Link Pages can also contact us without creating an account. Please provide sufficient information to identify the relevant account, browser choice or record, but do not email unnecessary identification documents. We may verify requests as permitted by law, establish the authority of an authorized agent, apply lawful exceptions, and provide statutory appeal rights where applicable. Requests concerning personal information controlled by a business User may need to be routed to that User. We will respond within applicable legal deadlines.

16. Changes to this Policy

We may change this Privacy Policy to reflect changes in the Services, technology, law or personal information practices. We will update the date above and give additional notice or ask for consent if required for material changes. New material processing will not be justified solely by a general statement that this Policy may change.

17. Contacting Songrac

Songrac, Inc. is responsible for the personal information it controls. For privacy questions, access or deletion requests, complaints and questions about international transfers, use the Support function on the Songrac website or contact support@songrac.com. Where required, additional business contact or appointed representative information will be published on the Privacy or Contact page. Independent streaming services, external links and payment providers have their own privacy notices and contacts.