Privacy Policy

Account information includes your name, artist or business name, email, contact details, login credentials, and account preferences. Release information includes recordings, artwork, contributor names and credits, release metadata, rights agreements, and evidence of permission. Support and legal correspondence includes messages, attachments, complaints, and responses. You should only submit another person's information if you have authority to do so and have given them appropriate information about its use.

Payment and verification information includes your payout destination, bank or PayPal details, payment history, and information reasonably required to verify identity or comply with tax and other legal duties. The information needed depends on the service and payment route. Do not send passwords, complete financial credentials, or identity documents through an ordinary support email unless we have specifically arranged a suitable method.

When you use the service, technical information can include an IP address, device and browser details, access times, referral pages, errors, and activity associated with your account. With your opt-in consent, we use Google Analytics 4 to measure website visits and performance. It can receive cookie identifiers, page and interaction information, device and browser details, referral information, and approximate location derived from an IP address. We do not enable advertising personalization, Google Signals, advertising account links, or cross-site advertising pixels. Our Cookie Policy gives the provider, purposes, lifetimes, and choices.

Platforms and distribution partners provide release status, revenue reports, corrections, and fraud or rights alerts. Payment providers provide transaction status and reconciliation information. Account representatives, contributors, rights holders, and complainants may supply information about you or a release. We may use public release listings and ownership information to check metadata or investigate a specific claim. Revenue reports may be aggregated and need not identify individual listeners.

We use account and communication details to register and authenticate users, manage requests, provide support, and send service notices. We use release and rights information to verify permissions, deliver and identify releases, publish credits as instructed, and handle corrections and takedowns. We use financial and verification information to calculate earnings, direct payments, prevent misdirected payouts, and meet legal duties.

Technical records and relevant account information help us keep the service secure, diagnose errors, detect misuse, investigate suspicious activity, and protect legal rights. Google Analytics is used only for website measurement after consent. We do not intentionally send names, email addresses, bank details, tax identifiers, release files, or support messages to it. Marketing messages, if sent, are subject to applicable consent and opt-out requirements. You can decline marketing without losing necessary account or payout notices.

Platforms and delivery partners receive the recordings, artwork, metadata, rights information, and contact details needed for distribution, support, and claims. Artist names, recordings, artwork, and designated credits are intended for public display. Do not put private contact information in public metadata unless you intend to publish it.

Hosting, account administration, communications, security, and other service providers receive information needed for their tasks. PayPal, banks, and other parties involved in a transfer receive the details needed to process and verify payments. Depending on their role, payment providers and Platforms may handle information under their own privacy policies as well as their arrangements with us. Advisers and authorities may receive relevant records for legal obligations, disputes, or protection of rights. Information may also be disclosed in a proposed or completed business transfer, with appropriate protections required by law.

We do not sell personal information for money or other valuable consideration, or share it for cross-context behavioral advertising. We do not permit service providers to use information supplied for our service for their own unrelated advertising. Public distribution of credits and music at your direction and disclosures needed for payments or service delivery are explained above. We do not exchange personal information for a financial incentive or offer a different price in return for its sale or advertising use.

Automated tools may assess sign-in activity, metadata inconsistencies, payment risk, and unusual streaming patterns against security rules, account history, and Platform reports. Checks can flag a release, request verification, temporarily restrict access or delivery, or delay a payout for investigation. These signals indicate risk and do not establish ownership or guarantee that activity is genuine. Crowntune may rely on Platform findings as described in the Terms. We do not use solely automated processing to make decisions with legal or similarly significant effects about individuals. Operational checks may be automated; this policy does not promise a separate manual investigation of every alert, temporary restriction, or Platform finding. Any legally required right to human intervention, an explanation, or a challenge remains available through legal@crowntune.com.

Account and release records are kept while needed for active services, corrections, removal requests, and related administration. Royalties, tax forms, payment confirmations, and contractual records are kept for the applicable accounting and legal retention periods and while a related claim remains unresolved. Security logs and verification material are retained according to the risk addressed, the need to investigate incidents, and applicable duties; they are not kept indefinitely solely because storage is available. Support messages are kept for the request, follow-up, and a reasonable record of how it was handled. A limited suppression record may be retained to honor a marketing opt-out. We use a two-month retention setting for Google Analytics user and event data covered by that setting, with reset on new activity disabled. Aggregated reports that are not subject to that setting may remain longer. Cookie lifetimes are separate and are stated in the Cookie Policy.

We assess retention using the purpose, sensitivity, legal requirements, and unresolved disputes. When information is no longer needed, we delete it or deidentify it as appropriate. Backup copies may remain until normal replacement cycles complete, with access limited to recovery or legal needs. Closing an account does not immediately erase payment or rights records that must still be kept. Public release information already delivered to a Platform may remain subject to that Platform's duties and valid prior uses.

We use safeguards appropriate to the information and risks involved. No method of transmission or storage is completely secure. Keep your credentials private and report suspected unauthorized access to support@crowntune.com. The service and its partners can involve processing across national borders. For a restricted international transfer, we use an applicable adequacy decision or approved contractual safeguards, with additional measures where needed. We do not rely on a provider's certification unless it applies to the provider and information involved. The GDPR and UK Privacy Notice explains the relevant protections and how to request more information.

Email legal@crowntune.com to request access, correction, deletion, portability, restriction, an objection, or another right available where you live. Tell us the request and enough information to locate the relevant account or record. We may ask for proportionate verification for requests that disclose or change personal information; we do not need your account password. An authorized agent may act for you subject to applicable verification requirements. Where law provides an appeal, reply to our decision asking for a privacy appeal.

We apply legal exceptions where necessary, explain a refusal as required, and provide a response within the applicable deadline. Requests are normally free; a charge or refusal for an excessive or unfounded request is limited to circumstances allowed by law. You can unsubscribe from promotional messages using the instructions in the message or by contacting us. You can manage optional analytics through Cookie Settings in the website footer. We treat a recognized Global Privacy Control signal as a request not to sell or share information; because we do not conduct those activities, the signal does not need to stop an existing sale or advertising-sharing flow. We do not change our practices in response to the separate Do Not Track browser setting. Cookie choices remain available regardless of that setting. We do not treat acceptance of the Terms of Service as consent to unrelated tracking or marketing.

Crowntune accounts are for adults aged 18 or older who can enter a binding contract. The service is not directed to children under 13. If you believe a child has provided personal information without the authorization required by law, contact legal@crowntune.com so we can investigate and take appropriate action, including deletion where required. An age restriction does not remove privacy rights in information we actually receive.

We update this policy when practices change and show the revision date above. Material changes will receive appropriate notice, and a new use that requires consent will not rely solely on posting revised text. For an accessible copy of this policy or a privacy question, email legal@crowntune.com. For account and release help, email support@crowntune.com.

The Privacy Policy describes account and contact information, release files and credits, rights evidence, financial and verification records, correspondence, technical logs, and information relevant to security or claims. We obtain information from you, use of the service, an artist or label representative, distribution Platforms, payment providers, contributors, complainants, and relevant public release or ownership records. When someone else supplies your credits or contact details, you may contact us even if you do not have an account.

For an individual contracting with us, processing necessary to register an account, deliver releases, report earnings, pay royalties, and answer service requests is based on performing that contract or taking requested steps before it. Where we deal with the representative of a company or another contributor who is not personally a party to that contract, we rely on our legitimate interests in administering the business relationship and providing the requested distribution, subject to their rights.

We rely on applicable legal obligations for processing required by EU or UK law, including a valid requirement to retain or disclose records. Where another country's legal requirements or a legal claim is involved, we assess an appropriate lawful basis rather than treating every foreign request as an EU or UK legal obligation. Our legitimate interests can include reliable accounting, prevention of fraud and unauthorized access, investigating rights complaints, service administration, and establishing or defending claims. We balance those interests against the person's rights and use information proportionately.

We rely on opt-in consent for Google Analytics cookies and associated measurement. We also obtain consent for marketing where required. You can withdraw it at any time using the relevant control, the message's unsubscribe instructions, or legal@crowntune.com. Withdrawal does not affect processing already lawfully performed and does not prevent processing supported by a separate lawful basis for a different purpose. We do not use general acceptance of this notice as consent to every processing activity.

Recipients include the Platforms that deliver or display releases; hosting, communications, delivery, and security providers; PayPal and banks involved in payouts; professional advisers; parties to a rights claim where disclosure is needed; and authorities where disclosure is lawful. Public release information is intended to reach listeners. The main Privacy Policy explains these disclosures and business transfers.

Processing may involve the United States and other countries in which the service or a recipient operates. A transfer restricted by EU or UK law may proceed only on an applicable legal basis for the transfer. For service-provider transfers, we use an applicable adequacy decision or the European Commission's standard contractual clauses and, where needed for UK transfers, the UK International Data Transfer Agreement or UK Addendum, together with required additional measures. A limited statutory exception is used only when its conditions are met. Contact legal@crowntune.com for the destination and mechanism applicable to your information and to request a copy or description of the safeguards, with confidential terms redacted where appropriate. The availability of a transfer route is assessed for the particular recipient and information.

Account and release records are kept for active services and necessary completion of takedowns and accounting. Financial and contractual records are retained for applicable statutory periods and unresolved claims. Security, verification, and support records are kept according to the issue, risk, and legal need rather than indefinitely. For Google Analytics data covered by its user and event retention setting, we use two months with reset on new activity disabled; aggregated reports may remain longer. The main Privacy Policy explains the other retention criteria in more detail.

Identity, rights, account, and payout information may be necessary to provide distribution and payment, or to meet a legal duty. If required information is missing, we may be unable to provide that service. Optional marketing or analytics consent is not a condition of an account.

Subject to the conditions and exceptions in law, you may request access and a copy, correction, erasure, or restriction of processing. For qualifying information processed by automated means on the basis of consent or contract, you may request a portable copy and, where technically feasible, transmission to another controller. You may withdraw consent. Automated screening uses security rules, account history, metadata, and Platform reports to identify unusual activity and may flag releases, request verification, temporarily restrict access or delivery, or delay payouts. We do not make decisions about individuals with legal or similarly significant effects solely by automated processing. The main Privacy Policy explains these checks. Where applicable law provides a right to human intervention, to express your position, or to contest a decision, contact legal@crowntune.com. This does not create a general contractual appeal or investigation deadline for distribution disputes.

You may object, for reasons relating to your circumstances, to processing based on legitimate interests. We must then stop unless an applicable legal ground allows it to continue. You may object to direct marketing at any time, including related profiling, and we will stop that marketing without requiring a reason.

Send a request to legal@crowntune.com. We may ask for proportionate identity verification where there is a reasonable doubt about identity. Under the EU GDPR, we normally respond without undue delay and within one month. Where permitted because of complexity or number of requests, that period may be extended by up to two further months, with notice and reasons within the initial month. UK requests are handled within the applicable UK statutory period, including any lawfully permitted clarification or extension. If we refuse a request, we explain the reason and available complaint or judicial remedies as required by law.

You may complain to a competent EEA supervisory authority, particularly in the country where you live, work, or believe a violation occurred, or to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. You can exercise that right without first contacting us. The EEA supervisory authority directory is available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

The categories below describe information collected and disclosed for business purposes during the 12 months before the date above, or since service launch if that period is shorter, and our current practices. A category applies to the extent you use the relevant account, release, payment, or support function; we do not collect every example from every visitor. These descriptions also explain our notice at collection for those functions. No listed category is sold or shared for cross-context behavioral advertising.

Identifiers and California customer-record information include names, stage names, email and other contact details, account identifiers, IP addresses, payout instructions, and transaction records. They are supplied by you, an authorized representative, service activity, or payment providers and are used for account administration, communication, identity checks, and payments. Relevant recipients include account and hosting providers, payment providers, advisers, and authorities where disclosure is lawful.

Commercial information includes submitted releases, distribution activity, royalty statements, adjustments, and payout history. It comes from you, distribution partners, Platforms, and payment providers. We use it to deliver services, reconcile earnings, address questions, and maintain financial and legal records. Relevant recipients include delivery and account providers, Platforms, payment providers, and advisers.

Internet or other electronic network activity includes device and browser information, access logs, referral pages, errors, and activity associated with the service. Sources are your device and use of the site. Approximate geolocation, such as country, region, or city derived from an IP address, is used for security or consented analytics; we do not collect precise device location through this service. Purposes include security, reliable operation, troubleshooting, and any lawfully enabled analytics. Relevant recipients are hosting and security providers and Google, as the provider of consented Google Analytics measurement.

Audio, visual, and professional or employment-related information includes recordings, artwork, submitted biographies, artist and contributor credits, label roles, and rights documents. Sources include you, your representatives, contributors, and relevant release or rights records. We use this material for distribution, public credits, support, and claims. Relevant recipients include Platforms, delivery and storage providers, and parties or advisers handling a rights dispute. Information selected for publication can become public.

Inferences can include assessments of suspicious account or release activity based on the information above and reports from Platforms or complainants. They are used for fraud prevention, security, and rights review and may be disclosed to relevant security or delivery providers and affected Platforms where necessary and lawful. The main Privacy Policy describes additional disclosures for legal proceedings and business transfers.

We do not collect education records, genetic information, biometric templates used to identify you, or sensitive characteristics such as religion, race, or health for account profiling. Material you voluntarily submit, including a recording or rights document, may incidentally contain information in another category; it is handled for the submission's stated purpose and not used to infer those characteristics. Do not supply unrelated sensitive information.

Sensitive information can include account credentials that permit access, government identification numbers, and financial account information where it meets the statutory definition. It is requested or used only as needed for account access, verification, payouts, security, claims, or legal duties. Sensitive information is disclosed only to the providers or recipients needed for those purposes, such as account-security, verification, payment, professional, and lawful government recipients. We do not use it to infer characteristics about you or for purposes requiring a separate right to limit under the CCPA. A recording of a voice is not automatically biometric information used to identify a person. Do not submit unrelated sensitive information through support messages or public metadata.

Account identifiers and release records are kept for active services, corrections, takedowns, and necessary related administration. Commercial and financial records are retained for applicable accounting and tax periods and unresolved claims. Technical records and fraud assessments are retained according to the security risk and investigation need. Verification material is retained according to the verification purpose and applicable duties. Support correspondence is retained for the request and reasonable follow-up. We consider legal requirements and sensitivity for each category and delete or deidentify records when their purpose and required retention end. Google Analytics user and event data covered by its retention setting is kept for two months with reset on new activity disabled; aggregated reporting and browser cookie lifetimes are separate.

We do not sell personal information for money or other valuable consideration or share it for cross-context behavioral advertising, and have not done so during the preceding 12 months or since launch if shorter. We do not knowingly sell or share personal information of anyone under 16. Google Analytics is used for consented website measurement with advertising integrations disabled. Providers receive information for the service purposes described above subject to applicable contractual restrictions.

We honor a recognized Global Privacy Control signal as an opt-out request. Because no information is sold or shared for cross-context behavioral advertising, there is no such current flow for the signal to stop. You can separately refuse analytics through Cookie Settings. The main Privacy Policy explains automated security and fraud checks. We do not make decisions about individuals with legal or similarly significant effects solely by automated processing. This notice does not promise manual review of every operational alert or an internal distribution appeal beyond rights provided by applicable law. We do not offer a financial incentive in exchange for selling or sharing personal information.

Where the CCPA applies, you may request the categories and specific pieces of personal information collected about you, categories of sources and recipients, purposes of use, and applicable disclosure, sale, or sharing information. You may request deletion subject to legal exceptions, and correction of inaccurate information. You may request information for the period available under the law, including an earlier period where required. We will not discriminate or retaliate against you for exercising these rights.

California law also provides a right to opt out of a sale of personal information or sharing for cross-context behavioral advertising, and a right to limit certain uses or disclosures of sensitive information, where those activities occur. A sale can involve valuable consideration other than money, and sharing has a specific advertising meaning. A privacy request does not require you to close your account. Email legal@crowntune.com to raise a concern or exercise an applicable right; you can also use a recognized Global Privacy Control signal for an opt-out request. Our current no-sale and no-sharing practices are described above.

For our online service, email legal@crowntune.com and describe the request, relevant account or record, and the period you want covered. You need not use particular wording or create an account. For access, correction, and deletion, we may match information to records or ask for proportionate additional evidence. Do not send your password. Verification protects against disclosure or changes at an impostor's request. Opt-out and limit requests are not subject to identity verification, although we may need information necessary to apply the choice.

An authorized agent may submit a request with proof of permission. Where permitted, we may also ask you to verify your identity or confirm the authorization directly. Different rules apply to an agent acting under a valid power of attorney. If we cannot verify a request or an exception applies, we explain the result as required. Requests are ordinarily free; any fee or refusal for an excessive request must meet the law's conditions.

For requests to know, correct, or delete covered by the CCPA, we confirm receipt within 10 business days and respond within 45 calendar days. If permitted and necessary, we may take up to 45 additional calendar days after giving notice and an explanation. Applicable opt-out and limit requests are implemented as soon as feasibly possible and within 15 business days. We may retain limited records needed to honor a choice and document the request. Contact legal@crowntune.com for questions, an accessible copy, or a concern about our response. Read the main Privacy Policy and Cookie Policy for related information.