Privacy Policy

1. Information we process

• Account information: email, name, account identifiers, authentication records, verification status, profile images and workspace membership.
• Artist and media information: artist profiles, links to music platforms, release metadata, uploaded audio, video, images, lyrics, documents, prompts, generated outputs and processing history. Files can contain personal information about you or other people.
• Billing information: plans, credits, purchases, payment and subscription identifiers, transaction status and related records. Payment providers process payment details through their checkout systems.
• Technical and usage information: IP address, browser or device information, sessions, security and error logs, pages or features used, processing events and support communications.
• Acquisition information: campaign parameters, referring pages, landing pages and anonymous identifiers used to understand how people arrive and to connect an eligible signup with an offer.

2. Why we use information

We use information to create and secure accounts, provide workspaces and processing tools, deliver requested releases, manage permissions, administer subscriptions and credits, communicate about the service, handle support, prevent abuse and understand reliability and product usage.

Where data-protection law requires a legal basis, we rely on performance of our agreement for requested services; legal obligations for required accounting, compliance and rights requests; legitimate interests in security, fraud prevention, support and proportionate service improvement where those interests are not overridden by your rights; and consent where a particular activity requires it. You may withdraw consent for future processing without affecting processing already lawfully carried out.

3. Browser storage and analytics

Browser storage is used for login state, selected workspaces, onboarding progress, preferences, attribution and signup offers. Clearing it may sign you out or interrupt an unfinished setup. The offer marker is separate from your original marketing campaign information.

Where configured, we use PostHog for product events and session diagnostics. Our application configures input and text masking and blocks media elements in session recording; recording can still include interaction and technical metadata. Product events can be associated with an account identifier. We do not intend to include passwords, uploaded media or full payment details in analytics. Browser privacy tools can restrict analytics requests; contact support with questions or objections. Where local law requires consent, that requirement applies to the relevant analytics activity.

4. Service providers and other recipients

Information is shared as needed with providers of hosting and file storage, email delivery, payment processing, analytics, AI or media processing, and music distribution. Depending on the tool selected, prompts, reference files or media may be sent to a processing provider, including services accessed through OpenRouter. Providers receive information needed for the requested operation and are subject to their applicable terms and data practices.

Workspace collaborators receive the access you or an authorized workspace manager grants. Distribution destinations receive the releases and metadata you submit for delivery. Public artist information may be imported from platforms such as Spotify when you request it. We may also disclose relevant information to comply with valid legal requests, establish or defend legal claims, address abuse, or support a corporate transaction with appropriate safeguards and notice where required.

5. Locations and international transfers

Our infrastructure and providers may process information in countries other than where you live. Applicable privacy protections may differ between countries. When a transfer requires a legal safeguard, we must use an applicable lawful transfer mechanism. Contact support for information about the providers and safeguards relevant to your use of the service.

6. Retention and deletion

We retain information for as long as reasonably needed for the purposes described here, including operating your account, providing stored files and processing history, handling disputes, protecting the service and meeting recordkeeping obligations. Retention depends on the data type, your use of the service and legal requirements. Closing an account does not necessarily erase every transaction, audit record or backup immediately.

You can request account closure or deletion through support. We may need to verify your identity and retain limited information where legally required or necessary for legitimate claims and security. Copies already delivered to stores or shared with authorized collaborators are subject to their own processes. We cannot promise deletion from systems we do not control.

7. Your choices and rights

Depending on your location, you may have rights to access, correct, delete or receive a copy of personal information; restrict or object to processing; withdraw consent; or complain to a competent privacy regulator. Send requests to support. We may ask for proportionate verification and will explain any lawful restriction on fulfilling a request. Exercising a privacy right does not itself justify discriminatory treatment.

Review workspace access before sharing files and avoid uploading sensitive personal information that a feature does not need. You are responsible for having a lawful basis to provide other people’s information and for giving them any notices required for your own activities.

8. Security, children and policy updates

We use access controls and technical safeguards to protect information, but no online service can guarantee absolute security. Report suspected unauthorized access promptly. The service is intended for adults aged 18 and over; contact us if you believe a child has provided personal information.

We may update this policy as our service or obligations change. The updated date appears at the top. We will provide notice or obtain consent for material changes when required, including where a new use would be incompatible with an existing commitment.

Contact

For account, billing, rights or privacy questions, contact the tothestarz team at [email protected]. Include the email associated with your account and enough information for us to understand your request. Do not send passwords or full payment card details.