1. Who we are

Labelmaster (“Labelmaster”, “we”, “our”) provides a B2B platform for record labels, distributors, and artist-services teams to deliver releases to DSPs, reconcile royalties, and manage catalog operations. This policy explains how we handle personal data when you use the platform, our website, or tools hosted on your own custom domain.

For the purposes of GDPR / UK GDPR we act as a data processor for catalog data you upload (artists, contributors, payees), and as a data controller for the account data of users who log in to the platform.

2. What we collect

Account data — name, work email, company, role, password hash, locale, timezone.
Catalog data — everything you upload: products, tracks, artists, contributors, UPCs/ISRCs, artwork, audio files, royalty statements.
Usage data — audit events, IP address, browser, build version, resource path accessed, timestamp.
Billing data — company legal name, VAT/tax ID, billing address. Payment card details are handled by our payment processor and never stored on our servers.
Support data — messages you send us, attachments you share, call recordings (with consent).

3. How we use it

Run the platform — deliveries, analytics, royalty runs, share links.
Authenticate users and enforce permissions.
Provide support, troubleshoot bugs, and investigate abuse.
Bill your account and comply with tax/accounting rules.
Send operational emails (receipts, security alerts, release notifications). Marketing emails are opt-in and include an unsubscribe link in every message.
Improve product quality using aggregated, de-identified metrics.

We do not train third-party AI models on your catalog data. We do not sell personal data.

4. Who we share data with

We share only what is required to deliver the service:

DSPs and ingestion partners — Spotify, Apple Music, YouTube Music, TikTok, and the other partners listed on labelmaster.app/#partners receive DDEX metadata + audio + artwork required to ingest a release.
Sub-processors — cloud hosting, email delivery, error tracking, customer-support tooling, payment processor. The current list is available on request.
Authorities — when required by law, court order, or a valid subpoena. We push back on overbroad requests.

5. International transfers

Data may be processed in the EU, UK, or US depending on which sub-processor stores it. For transfers out of the EEA/UK we rely on the European Commission’s Standard Contractual Clauses or an adequacy decision where available.

6. Retention

Account + catalog data is retained for the life of your subscription plus 30 days to allow export. Audit logs are retained for 24 months. Billing records are retained for 7 years to meet accounting rules. Backups are rotated on a 30-day cycle.

7. Your rights

You can request access to, correction of, or deletion of the personal data we hold about you. You can object to or restrict certain processing, and you can request a machine-readable copy for portability. Email privacy@labelmaster.app — we reply within 30 days.

8. Security

TLS 1.2+ in transit, AES-256 at rest. Password hashing with Argon2. SSO + 2FA available on Business and Enterprise plans. Role-based permissions and a full audit log on every action. We run penetration tests annually and disclose confirmed breaches to affected customers within 72 hours.

9. Cookies

We use first-party cookies for authentication (session id) and preferences (theme, locale). We do not embed third-party advertising cookies on the logged-in product. The marketing site may set a privacy-preserving analytics cookie.

10. Children

Labelmaster is not directed to children under 16. We do not knowingly collect personal data from them.

11. Changes to this policy

Material changes are announced via in-app notice and email at least 30 days before they take effect. Older versions are archived and available on request.

12. Contact

Privacy questions: privacy@labelmaster.app.
Data-protection officer: same address, attn. DPO.
Postal: Labelmaster — Attn. Privacy, 1 Mercer Way, London SE1, UK.