Privacy Policy

1. Introduction

Rightstune ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our publishing administration services, website, and client portal (collectively, the "Services").

By accessing or using our Services, you consent to the practices described in this Privacy Policy. If you do not agree with the policies and practices described here, please do not use our Services.

2. Information We Collect

We collect several types of information from and about users of our Services:

2.1. Personal Information

We may collect personal information that you provide directly to us, including but not limited to:

• Contact information (name, email address, phone number, mailing address)
• Account information (username, password)
• Professional information (artist name, band name, PRO affiliation, IPI numbers, publisher entity details)
• Financial information (payment details, banking information, tax identification numbers)
• Tax identifiers collected via IRS Forms W-9 and W-8BEN/BEN-E, including Social Security Numbers (SSNs) and Taxpayer Identification Numbers (TINs), processed through Track1099 (Avalara)
• Biometric data, including facial geometry templates derived from selfies and government-issued photo IDs, processed by Stripe Identity for fraud prevention and identity verification (Rightstune does not store raw biometric identifiers)
• Electronic signature and Letter of Direction (LOD) data, including signer name and email, IPI and publisher fields populated into the document, signature image, and signing audit details (such as IP address and timestamps) processed through SignWell
• Phone numbers used for SMS-based two-factor authentication when you enable that option (delivered via Twilio)
• Music catalog and credits identifiers associated with your works or profiles (such as Muso profile/track IDs and Spotify artist/track IDs) that we retrieve from catalog providers or that you select during registration
• Copyright and ownership information related to your musical works

2.2. Usage Information

When you consent to analytics cookies on our marketing site, we may automatically collect certain information about your equipment, browsing actions, and patterns, including IP address, browser type, device identifiers, and pages visited (via HubSpot). See our Cookie Policy for details.

When you submit certain marketing forms (such as contact, feedback, ambassador, or access-request forms), create a Rightstune account, join the affiliates program, or sign in after repeated failed attempts, Google reCAPTCHA may collect device and usage signals to help prevent spam and abuse.

3. How We Use Your Information

We use information that we collect about you or that you provide to us:

• To provide, maintain, and improve our Services
• To process and collect royalties internationally on your behalf
• To register your works with appropriate collection societies and music licensing organizations
• To facilitate electronic signing of Letters of Direction and related administration documents
• To retrieve and display music catalog and credits metadata so you can search for, claim, and register works
• To authenticate your account, including optional SMS or email one-time verification codes
• To send transactional account emails from Rightstune (such as password resets, verification codes, and LOD confirmations). Rightstune operates its own email delivery; we do not use a third-party email marketing or ESP provider for these messages
• To provide you with information, products, or services that you request from us
• To fulfill any other purpose for which you provide it
• To provide you with notices about your account
• To carry out our obligations and enforce our rights
• To notify you about changes to our Services

4. Cookies and Tracking

We use cookies and similar technologies on our website and client portal. Strictly necessary cookies (such as session cookies for secure login, SignWell embedded signing in the portal, and Google reCAPTCHA on certain marketing forms) are always active where those features are used. Analytics cookies (HubSpot) and functional cookies (Jotform live chat) are used on our marketing pages only with your consent where required by law.

For a full list of cookies, providers, and retention periods, see our Cookie Policy. You may withdraw or change your consent at any time using the preferences link in the site footer (labeled Cookie Preferences or Your Privacy Choices, depending on your location). We honor the Global Privacy Control signal in supported browsers.

4.1. Do Not Track signals

Do Not Track (DNT) Signals: Rightstune does not currently alter its tracking or data collection practices in response to browser-initiated Do Not Track signals. We do, however, honor the Global Privacy Control (GPC) signal where supported, and you can manage tracking via Cookie Preferences.

5. Sharing of Your Information

We may disclose personal information that we collect or you provide:

• To our subsidiaries and affiliates
• To collection societies and music licensing organizations to register your works and collect royalties
• To contractors, service providers, and other third parties we use to support our business, including:
  • Stripe - identity verification (Stripe Identity), payment processing, and fraud prevention
  • Trolley - global royalty payouts, beneficiary management, and AML/CFT sanctions screening
  • Track1099 (Avalara) - collection and validation of IRS tax forms (W-9, W-8BEN/BEN-E)
  • SignWell - electronic signature of Letters of Direction and related documents, including signing audit trails
  • Twilio - delivery of SMS one-time codes when you enable SMS two-factor authentication
  • Google reCAPTCHA - spam and abuse prevention on certain marketing forms
  • Muso - music credits and artist/profile catalog data used to search for and register works
  • Spotify - public track and artist metadata used to search for and register works (Rightstune does not connect to your personal Spotify listening account)
  • Jotform - registration forms and AI-powered support chat on our marketing site
  • HubSpot - non-essential website analytics on our public marketing pages (only with your consent where required)
• To fulfill the purpose for which you provide it
• For any other purpose disclosed by us when you provide the information
• With your consent
• To comply with any court order, law, or legal process
• To enforce our terms of service and other agreements
• If we believe disclosure is necessary to protect the rights, property, or safety of Rightstune, our clients, or others

Transactional emails (password resets, verification codes, LOD confirmations, and similar account notices) are sent by Rightstune using our own mail infrastructure, not by a third-party email service provider.

6. Data Security

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. All information you provide to us is stored on secure servers behind firewalls.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Services, you are responsible for keeping this password confidential.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted through our Services.

7. Your Choices About Our Collection, Use, and Disclosure of Your Information

We strive to provide you with choices regarding the personal information you provide to us. You can:

• Update your account information through your client portal
• Opt-out of marketing emails by following the unsubscribe instructions in the emails
• Request access to, correction of, or deletion of your personal information by contacting us
• Manage or withdraw cookie consent via Cookie Preferences (see our Cookie Policy)

8. Data Retention

We will retain your personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Biometric data: Facial geometry processed through Stripe Identity is retained by Stripe for fraud prevention for no longer than one year, after which Stripe securely deletes biometric identifiers. Rightstune does not receive or store raw biometric templates. If you decline biometric scanning, you may complete identity verification through our manual human-review process instead.

Payment and tax records: Trolley is legally required under AML/CFT regulations to retain payment and beneficiary logs for up to five years. When you request account deletion, we archive (rather than delete) your Trolley recipient profile to preserve required transaction history while restricting further payouts.

Signed Letters of Direction: Completed LOD PDFs and related signing audit information are retained by Rightstune as part of your account and administration records, and may also be retained by SignWell in accordance with SignWell's retention practices, for as long as needed for administration, society filings, and legal or accounting requirements.

9. International Data Transfers

Your personal information may be transferred to and processed in countries other than the country in which you are resident. These countries may have data protection laws that are different from the laws of your country. We have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Privacy Policy.

10. Children's Privacy

Our Services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are under 13, do not use or provide any information on our Services. If we learn we have collected or received personal information from a child under 13, we will delete that information.

11. Changes to Our Privacy Policy

We may update our Privacy Policy from time to time. If we make material changes to how we treat our users' personal information, we will notify you through a notice on our website home page or via email.

The date the Privacy Policy was last revised is identified at the top of the page. You are responsible for periodically visiting our website and this Privacy Policy to check for any changes.

12. Contact Information

To ask questions or comment about this Privacy Policy and our privacy practices, contact us at:

Rightstune
Email: max@rightstune.com or on Instagram @Rightstune