Privacy Policy

1. Introduction

Bspoke Music Ltd, trading as Royalty Sync ("we", "us", "our"), is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use the Royalty Sync platform and services.

We are the data controller for the personal data we process. We are registered in England and Wales and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Information You Provide

• Account information: Name, email address, password (encrypted), phone number
• Profile information: Company name, PRS/MCPS membership details, role in the music industry
• Payment information: Processed securely by Stripe; we do not store card details
• Music catalogue data: Track titles, ISRCs, tunecodes, writer information, publisher details
• Uploaded files: Broadcast data, royalty statements, audio files for fingerprinting
• Support communications: Messages, tickets, and feedback you submit

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, actions taken within the platform
• Device information: Browser type, operating system, IP address
• Cookies: Session cookies, preferences, and analytics (see our Cookies Policy)
• Log data: Access times, error logs, referring pages

2.3 Information from Third Parties

• Music metadata: From Spotify, MusicBrainz, and ACR Cloud for track enrichment
• Broadcast data: From BMAT, ACR Cloud, and TRQK for monitoring services
• Authentication: If you sign in via Replit or social login

3. How We Use Your Information

We use your personal data for the following purposes and lawful bases:

4. Data Sharing

We share your data only with trusted third parties for specific purposes:

• Payment processors: Stripe for secure payment handling
• Cloud infrastructure: Hosting and database providers
• Music services: BMAT, ACR Cloud, Spotify, MusicBrainz for data enrichment
• Email services: SendGrid for transactional and marketing emails
• Analytics: To understand how users interact with our platform

We require all third parties to respect your data security and to treat your personal data in accordance with the law. We do not sell your personal data to any third parties.

5. International Transfers

Some of our third-party service providers may process data outside the UK/EEA. When this occurs, we ensure appropriate safeguards are in place, including:

• Adequacy decisions by the UK government
• Standard Contractual Clauses (SCCs) approved by the ICO
• Binding Corporate Rules where applicable

6. Data Retention

We retain your data only for as long as necessary:

• Account data: For the duration of your account, plus 30 days after deletion
• Financial records: 7 years as required by UK tax law
• Support tickets: 3 years from resolution
• Usage logs: 12 months for security and analytics
• Marketing preferences: Until you withdraw consent

7. Your Rights

Under UK GDPR, you have the following rights:

• Right of access: Request a copy of your personal data
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure: Request deletion of your data ("right to be forgotten")
• Right to restrict processing: Limit how we use your data
• Right to data portability: Receive your data in a portable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Where consent is the lawful basis
• Rights related to automated decision-making: We do not make solely automated decisions with legal effects

To exercise any of these rights, please contact us at support@royaltysync.ai. We will respond within one month.

8. Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Secure password hashing
• Access controls and authentication
• Regular security audits and updates
• Staff training on data protection

9. Cookies

We use cookies and similar technologies to provide and improve our Service. For detailed information about the cookies we use and your choices, please see our Cookies Policy.

10. Children's Privacy

The Service is not intended for children under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. The updated policy will be effective when posted.

12. Complaints

If you have concerns about how we handle your data, please contact us first. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Phone: 0303 123 1113

13. Contact Us

For any privacy-related questions or to exercise your rights:

Email: support@royaltysync.ai
Address: Bspoke Music Ltd, 111 Charterhouse Street, 5th Floor, London, England, EC1M 6AW