Privacy Policy

Effective date: 9 October 2026

01About this policy

This policy explains how TUNEARO LIMITED (“Tunearo”, “we”, “us” or “our”) collects, uses, shares and protects your personal data, and what rights you have. We are registered in England and Wales under company number 17510806. Our registered office is 66 Paul Street, London, England, EC2A 4NA.

We are the controller of your personal data for the purposes described in this policy. This means we decide why and how it is used.

Who this policy covers. It applies to visitors to our website and to artist and label customers who use the Tunearo dashboard and our music distribution services. It also covers other people whose details you give us, such as featured artists, songwriters and producers named in your release credits.

Who it does not cover. If you use our API, or an enterprise or white-label service, under a separate agreement, the privacy terms in that agreement apply instead.

This policy sits alongside our Tunearo Artist and Label Dashboard Terms of Service and should be read with them. If you have questions, contact us as set out in Section 16.

02Personal data we collect

2.1Data you give us

• Identity data: your name, artist or label name, username, country and, where verification needs it, your date of birth.
• Contact data: your email address, telephone number and billing address.
• Content data: the audio files, artwork, lyrics, metadata and credits you upload, including the names of featured artists, songwriters and producers. Please make sure you have the right to share their details with us.
• Financial data: your payout details (such as bank account or PayPal details) and any tax identifiers we need for a tax or reporting requirement. Card payments are handled by our payment provider, and we do not store full card numbers.
• Verification data: government-issued ID, proof of address and a selfie, as described in Section 4.
• Communications data: your messages to our support team and your marketing preferences.

2.2Data we collect automatically

• Technical data: your IP address, login data, browser type and version, time zone and location setting, operating system and device information.
• Usage data: how you use the dashboard and our website, such as uploads, edits and analytics views.
• Audio fingerprints and acoustic features that we derive from the audio you upload, to check quality, duplicates and possible infringement.
• Cookie data: see Section 12.

2.3Data we receive from others

• DSPs and distribution partners: streaming statistics, royalty and revenue reports, and notices about your releases.
• Payment providers: confirmation that payments and payouts have been made, failed or reversed.
• Our identity verification provider: the outcome of your verification checks (see Section 4).
• Rights holders and platforms: copyright notices, takedown requests and counter-notices that involve your Content.

2.4Sensitive data

We do not ask for special-category data such as health, religion or political views, and we ask you not to send us unrelated sensitive information. The one exception is the biometric data described in Section 4, which is used only if you give your explicit consent.

03How we use your data and our lawful bases

The law lets us use personal data only where we have a lawful basis. The table shows what we do and which basis we rely on.

Where we rely on legitimate interests, we weigh our interests against your rights and freedoms first. You can ask us about that balancing exercise and object to the processing (see Section 11).

04Identity verification and biometric data

Before we pay out royalties, we verify your identity and payee details to prevent fraud and to confirm you are entitled to the funds. We may ask for:

• government-issued photo ID;
• recent proof of address; and
• a selfie so that we can compare it with your ID.

We ask for tax identifiers only where a tax or reporting requirement needs them.

Automated facial matching. We use Didit, our identity verification provider, to compare your selfie with your ID document using automated facial matching. This creates biometric data, which is special-category data under data protection law. We therefore ask for your separate, explicit consent before we start. Accepting our Terms of Service is not consent to biometric processing.

Your choices. You can withdraw your consent at any time. If you would rather not use automated matching, or the automated match is not confident enough, our staff will check your selfie and ID manually instead. Choosing a manual check will not count against you, although it may take longer.

What we use it for. We use verification data only to verify identity and payee details, prevent fraud and meet legal requirements. We do not use it for marketing or profiling, and we do not use biometric data to identify you in any other context.

Who sees it. Only authorised staff and the service providers we need can access verification documents. Didit processes the data on our behalf under a contract that restricts how it can use the data. Section 9 explains how long we keep it.

05AI and automated decisions

5.1How we use AI

We use artificial intelligence and machine learning to:

• analyse uploaded audio for quality and technical compliance;
• detect possible copyright infringement or duplicate content;
• suggest metadata and categories, such as genre;
• identify fraudulent streaming patterns and payment fraud; and
• provide personalised insights and analytics in your dashboard.

5.2Training our models

We may use aggregated, anonymised data to train and improve our models, for example to improve content recognition, strengthen fraud detection and optimise distribution. Before we do, we remove personal identifiers, combine data across many users and take reasonable steps to reduce the risk that individual Content can be recovered from a model.

We do not use your specific Content to train models that other users can access without your explicit consent. You can object to, or opt out of, non-essential AI processing by contacting us, although some features may then be limited.

5.3Automated decisions and human review

Some of our systems, such as fraud detection, can lead to a royalty hold, a strike or an account suspension. Before we suspend an account because of an automated flag, a member of our team reviews the case, unless urgent action is needed to protect users, DSPs or the platform. In that case we review it promptly afterwards.

If an automated decision significantly affects you, you can ask us for human review, explain your side and challenge the decision. Contact support or privacy@tunearo.com. A person who was not involved in the original decision will consider your request.

06Who we share your data with

We share personal data only where we need to, and we do not sell it. The main recipients are:

• Digital Service Providers (DSPs), such as Spotify, Apple Music, YouTube Music, Amazon Music and TikTok. We send them your Content, artist name, credits and metadata so they can publish your music. Once a DSP receives it, the DSP is responsible for its own use of the data under its own privacy policy.
• Upstream delivery and distribution partners, such as Beatrising GmbH, who help us deliver releases and reports to DSPs.
• Payment providers, who process card payments and royalty payouts.
• Our identity verification provider, Didit, for the checks described in Section 4.
• Our service providers, who host our systems, secure our network and support our operations (see Section 7).
• Rights holders, platforms and claimants. If a copyright notice or counter-notice involves your Content, we may share the details the process requires with the other party.
• Professional advisers, such as lawyers, accountants, auditors, banks and insurers.
• Authorities and regulators, such as tax authorities, law enforcement and courts, where the law requires or we reasonably believe it is necessary to prevent crime or protect our rights.
• A buyer or successor. If we sell, merge or transfer part of our business, we may share data with the other party and its advisers. We will tell you if your data is transferred and your rights will continue.

Where we share data with a service provider, we require it to protect the data and use it only on our instructions.

07Our service providers

These providers act as our processors, which means they handle personal data on our behalf and under our instructions. We have written contracts with them. They may not use your data for their own purposes.

This list shows the main providers we use today. We update it when it changes, and we will tell you about material changes in line with Section 15.

08International transfers

We operate globally, and our providers and DSPs are in many countries. Your data may therefore be transferred to, stored in and accessed from countries outside the UK and the European Economic Area (EEA), including countries that do not offer the same level of protection.

Whenever we transfer personal data out of the UK or EEA, we make sure it stays protected by using at least one of these safeguards:

• the destination country has been recognised by the UK or EU as providing adequate protection;
• we have a contract approved for the purpose, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or
• another lawful transfer mechanism applies.

Sending your Content and metadata to DSPs around the world is a transfer that is necessary to perform our contract with you, and it will go to the DSPs you choose to distribute to. Their own privacy policies apply once they receive it.

You can ask us for more information about the safeguards we use by contacting privacy@tunearo.com.

09How long we keep your data

We keep personal data only for as long as we need it for the purposes in this policy, including to meet legal, tax and accounting requirements. When we no longer need it, we delete it or make it anonymous.

In some cases a specific legal duty to preserve records, or a need to keep them for legal claims, means we keep selected records longer. When that happens we document the reason, scope and review date, and delete the records when the reason ends. Keeping accounting records does not mean we keep your identity documents.

10Security

We use appropriate technical and organisational measures to protect your personal data from accidental loss, unauthorised access, alteration and disclosure. These include:

• encryption in transit (TLS 1.2 or higher) and at rest (AES-256);
• access controls and authentication, with access limited to people who need it and who are bound by confidentiality;
• regular security reviews and testing;
• staff training on data protection;
• incident response procedures; and
• regular backups and disaster-recovery plans.

We recommend a strong, unique password and two-factor authentication where available.

If there is a personal data breach, we will notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of it, where the law requires. Where a breach is likely to result in a high risk to you, we will tell you without undue delay, explain what happened and describe the steps you can take to protect yourself.

11Your rights

Under data protection law you have the right to:

• access a copy of the personal data we hold about you;
• rectification of data that is inaccurate or incomplete;
• erasure of your data in certain circumstances;
• restriction of how we use your data in certain circumstances;
• data portability, meaning to receive your data in a structured, machine-readable format, or have it sent to another provider;
• object to processing based on our legitimate interests, and to object at any time to direct marketing;
• withdraw consent at any time where we rely on it, including for biometric matching and marketing; and
• human review of, and to challenge, automated decisions that significantly affect you (see Section 5.3).

Withdrawing consent does not affect processing that took place before you withdrew it.

How to use your rights. Email privacy@tunearo.com. We may need to confirm your identity first, using information we already hold where we can. We reply within one month. For complex or numerous requests we may extend this by up to two further months, and we will tell you why. We do not charge a fee unless a request is clearly unfounded or excessive, in which case we may charge a reasonable fee or refuse it and explain our reasons.

We assess each erasure request individually. We do not refuse one only because a retention period in Section 9 has not yet ended, although we may need to keep some data for legal reasons.

If you are unhappy with how we handle your data or your request, you have the right to complain, as explained in Section 16.

12Cookies

Cookies are small files that a website stores on your device. We use similar technologies, such as local storage, in the same way.

We set only essential cookies until you choose otherwise. You can accept or reject non-essential cookies through our cookie settings, and change your choice at any time. You can also set your browser to block or alert you about cookies, but parts of the site may then stop working properly.

13Children

Our Services are for people aged 18 or over, or the age of majority where they live. Someone under 18 may use them only with the direct involvement and consent of a parent or legal guardian, as our Terms of Service explain.

We do not knowingly collect personal data from children under 13. If you are a parent or guardian and think your child has given us personal data, please contact us at privacy@tunearo.com and we will take steps to delete it and close the account.

14Third-party links

Our website and dashboard may link to other websites and services, such as your artist profiles on Spotify or Apple Music. Following those links may let third parties collect or share data about you. We do not control them and are not responsible for their privacy practices, so please read the privacy policy of each site you visit.

15Changes to this policy

We review this policy regularly. The effective date at the top shows when it last changed. If we make a material change to how we use your personal data, we will tell you by email and in the dashboard before the change takes effect, and where the law requires your consent we will ask for it.

Please keep your details up to date so that the data we hold about you is accurate.

16Contact us and complaints

For questions about this policy, or to use your rights, contact our privacy team:

TUNEARO LIMITED, 66 Paul Street, London, England, EC2A 4NA Email: privacy@tunearo.com

You have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113. If you live in the EEA, you can also complain to your local data protection authority. We would appreciate the chance to deal with your concern first, so please contact us before you go to the ICO.