Privacy Policy

A. Personal Information Provided by You, including:

• Account Details: Name, email, username, password, profile image, phone number, date of birth, country, city, state, and communication preferences.
• User-Generated Content (UGC): Uploaded videos, captions, hashtags, metadata (including timestamps and locations), impact scores, and user profile elements.
• Messaging Content: Messages and related metadata, such as participant IDs and timestamps, when using our messaging features.
• Payment Information: Transaction history and billing information submitted during purchases, processed securely by Stripe.
• Identity Verification: Information submitted to confirm user identity or age, particularly for verified accounts or restricted content.
• Support and Feedback: Information you submit when contacting support, participating in surveys, or entering competitions.

B. Automatically Collected Information

• Usage Data: Engagement metrics such as video views, likes, skips, watch time, and interactions with recommendations.
• Device and Technical Information: We automatically collect certain technical data when you use the platform, including your IP address, device model, browser type, app version, operating system, and time zone. This data helps us maintain platform functionality, improve performance, and detect unauthorized activity.
• Behavioral Insights: Inferred data such as age range, interests, and gender, used to improve personalization and content recommendations.
• Moderation Data: When you flag content or block another user, we collect the report metadata (reporting user ID, reported user ID, timestamp, category, optional comments) and any actions taken by our moderators.

C. Sensitive Data

• Location Data: Collected only with your explicit consent.
• AI Processing Data: Actions such as skips, likes, and view duration are used for recommendation logic. Personally identifiable data is excluded from AI training.

Key Safeguards:

• AI systems do not train on identifiable personal data.
• Final decisions affecting account status are made by humans.
• You may opt out of AI-driven recommendations.
• We do not use automated decision-making that produces legal or similarly significant effects without human review.

A. Licensed Music (Third-Party Licensor)

• Playback and Sync Data: Songs used, frequency, and duration
• User Preferences: Tracks synced to user content
• Engagement Trends: Aggregated for internal improvements and licensing reports

B. User-Uploaded Music

• Music Metadata: Title, artist name, genre, upload timestamp, and any tags provided by the user.
• Licensing Confirmation: Information confirming that the user holds rights to upload and share the song
• Usage Data: Number of times the uploaded song is synced with content or played by the community

Region / Law - Core Rights

• EU / EEA / UK / Switzerland (GDPR & UK GDPR): Access, rectification, erasure, restriction, portability, objection, withdraw consent, complaint to regulator.
• Brazil (LGPD): Confirmation, access, correction, anonymization/blocking, portability, deletion, info on sharing, withdraw consent, review of automated decisions.
• United States (CCPA/CPRA + State Laws): Know, access, delete, correct, opt-out of sale/sharing, limit sensitive data use, non-discrimination.
• Canada (PIPEDA + Quebec Law 25): Access, correction, deletion, withdraw consent, opt-out of AI-driven personalization when available.
• Asia-Pacific (APPI, PIPA, PDPA, DPDP): Access, correction, deletion/suspension, withdraw consent, grievance redressal, portability (some), parental consent under 14–18 depending on country.
• South Africa (POPIA): Access, correction/deletion, object to direct marketing or automated decisions, complaint to regulator.
• Middle East (UAE PDPL, KSA PDPL, Qatar, Bahrain): Access, rectification, erasure, restriction, portability, objection, withdraw consent, complaint to authority.

Full Jurisdiction Details

A. European Union, European Economic Area, Switzerland, and the United Kingdom

• You have the right to access your personal data.
• You have the right to correct inaccurate or incomplete data.
• You have the right to request the erasure of your data ("right to be forgotten").
• You have the right to restrict processing in certain circumstances.
• You have the right to data portability (to obtain your data in a structured, machine-readable format).
• You have the right to object to processing, including profiling and direct marketing.
• You have the right to withdraw consent where processing is based on consent.
• You have the right to lodge a complaint with your national Data Protection Authority.

B. Brazil

• You have the right to confirmation of whether we process your data.
• You have the right to access your personal data.
• You have the right to correct inaccurate, incomplete, or outdated data.
• You have the right to anonymization, blocking, or deletion of unnecessary or excessive data.
• You have the right to data portability to another service provider.
• You have the right to request deletion of data processed with your consent.
• You have the right to receive information about public and private entities with whom we share your data.
• You have the right to withdraw consent at any time.
• You have the right to review decisions made solely on automated processing, including profiling.

C. United States

• You have the right to know what personal data we collect, use, disclose, or share.
• You have the right to access and request a copy of your data.
• You have the right to request deletion of your personal data.
• You have the right to request correction of inaccurate data.
• You have the right to opt out of the sale or sharing of your personal data.
• You have the right to limit the use of sensitive personal data.
• You have the right not to face discrimination for exercising your rights.

D. Canada

• You have the right to access your personal information.
• You have the right to correct inaccurate or incomplete information.
• You have the right to delete your account and associated data.
• You have the right to withdraw consent for processing.
• You have the right to opt out of AI-driven personalized recommendations when they become available.

E. Asia-Pacific

• Japan – Act on the Protection of Personal Information (APPI): You have rights to access, correct, suspend, or delete your data. We will notify you in advance of overseas transfers as required by law, and we remain accountable for protecting your data even when processed outside Japan.
• South Korea – Personal Information Protection Act (PIPA): If you are under 14, parental/guardian consent is required. You have rights to access, correct, suspend processing, and delete your data. When your data is transferred overseas, organizations must ensure that it receives an equivalent level of protection under PIPA.
• Singapore – Personal Data Protection Act (PDPA): You have rights to access and correct your data and to withdraw consent at any time. We are required to ensure that any overseas transfer continues to provide a comparable standard of protection.
• India – Digital Personal Data Protection Act 2023 (DPDP Act): Effective 2025. You have rights to access, correct, and delete your data, and to file grievances for redressal. Children under 18 require parental/guardian consent. Transfers of your data outside India must comply with government-prescribed safeguards to ensure continued protection.
• Australia – Privacy Act 1988 (as amended): You have rights to access and correct your personal data. As your data is transferred and stored in the United States, we remain accountable under Australian law. We take reasonable steps to ensure it is protected, including relying on Amazon Web Services (AWS) data centers that are independently certified to internationally recognized security standards such as ISO 27001 and SOC 2, and on contractual safeguards (Data Processing Addendums and Standard Contractual Clauses) to provide equivalent protection to the Australian Privacy Principles (APPs).
• New Zealand – Privacy Act 2020: You have rights to access and correct your data, and to file complaints with the Office of the Privacy Commissioner. When data is sent overseas, we must ensure it is subject to comparable privacy protections.

F. South Africa

• You have the right to access your personal data.
• You have the right to request correction or deletion of inaccurate, irrelevant, or excessive data.
• You have the right to object to processing for direct marketing or automated decision-making.
• You have the right to lodge a complaint with the Information Regulator.

G. Middle East

• You have the right to access your personal data.
• You have the right to correct inaccurate or incomplete data.
• You have the right to request the erasure of personal data where legally permitted.
• You have the right to restrict processing in certain circumstances.
• You have the right to data portability (where applicable).
• You have the right to object to processing, including direct marketing.
• You have the right to withdraw consent where processing is based on consent.
• You have the right to lodge a complaint with your national Data Protection Authority or competent regulator.

International Data Transfers

• Contractual protections: Standard Contractual Clauses (SCCs), Data Processing Addendums (DPAs), and equivalent agreements.
• Technical protections: We rely on Amazon Web Services (AWS) data centers, which are independently certified to internationally recognized security standards such as ISO 27001 and SOC 2.
• Accountability: We remain responsible for your data under applicable laws such as the General Data Protection Regulation (GDPR), the Personal Information Protection and Electronic Documents Act (PIPEDA), and the Australian Privacy Principles (APPs).
• Consistency: These safeguards ensure your personal data receives a level of protection consistent with your local law.

Children's Privacy

• Minimum Age: Users under 13 are not permitted to create an account.
• Global Parental Consent (Launch Policy): Users under 18 require verifiable parental/guardian consent to register and use the service.
• Verification Process: We use industry-standard methods (such as email verification, one-time passcodes, or guardian authorization) to confirm parental consent before enabling full access.
• Parental Rights: Parents/guardians may review their child's data, request deletion, and revoke consent at any time by contacting us.