Privacy Policy

Last Updated: February 18, 2026 | Governing Law Reference: Delaware, United States

This Privacy Policy explains how Lithyus Music Group, LLC, operating as Lithyus Music Publishing ("Company," "we," "us"), collects, uses, discloses, and protects personal data in connection with the Platform. The names "Lithyus," "Lithyus Music," and "Lithyus Music Publishing" are trademarks and trade names owned by Lithyus Music Group, LLC.

1. Categories of Personal Data Collected

Depending on your use of the Platform, we may collect:

A. Identity and account data

• Name, artist/studio display names, email address, account identifiers
• Password hash and account authentication status
• Country/city/language preferences
• Optional profile details (e.g., bio, phone, profile image)

B. Content and rights-management data

• Uploaded audio files and related metadata (title, genre, album, ISRC-related fields)
• Rights declarations and related licensing/publication information
• Public catalog and private library metadata

C. Communications and support data

• Messages, threads, notifications, support ticket submissions and responses

D. Transactional/service-operation data

• Reservation/session/subscription records, service status and amounts
• Contract and signature records (including signing metadata such as IP at signature event)

E. Technical and security data

• Session and security event data
• IP address, event logs, anti-abuse signals
• Password reset tokens and verification tokens
• Push notification endpoint data and device identifiers (if enabled)

F. Analytics and usage data

• Product analytics events and profile properties
• Performance/navigation telemetry

2. Purpose of Processing

We process personal data to:

1. Provide and operate the Platform;
2. Authenticate users and secure accounts;
3. Enable submissions, deliveries, contracts, messaging, notifications, and support;
4. Detect abuse, fraud, policy violations, and potential rights conflicts;
5. Improve product performance and user experience;
6. Comply with legal obligations, enforce terms, and handle disputes.

3. Legal Basis for Processing (GDPR-Compatible)

Where GDPR applies, we process data under one or more of the following bases:

• Contractual necessity (Art. 6(1)(b)): to provide requested services.
• Legitimate interests (Art. 6(1)(f)): platform security, fraud prevention, analytics, service improvement, and rights protection.
• Legal obligation (Art. 6(1)(c)): compliance with applicable laws and lawful requests.
• Consent (Art. 6(1)(a)): where required, such as certain marketing/notification settings.

You may withdraw consent at any time where consent is the legal basis, without affecting prior lawful processing.

4. Data Retention Periods

We retain personal data only as long as reasonably necessary for the purposes above, including legal, accounting, security, and dispute needs.

Indicative retention logic may include:

• Account/profile records: while account remains active, plus a limited post-closure period where required.
• Security logs and operational records: retained per security/compliance needs.
• Support and dispute records: retained while matters are open and for reasonable follow-up periods.
• Password reset/verification tokens: short-lived and/or invalidated after use or expiry.
• Certain uploaded files and stale records may be purged by housekeeping routines.

Retention can be extended where needed for legal claims, fraud prevention, or regulatory obligations.

5. International Transfers

Your data may be processed in countries other than your country of residence, including by cloud hosting providers and specialized service providers.

When required by law, we use appropriate safeguards for cross-border transfers, such as contractual commitments and equivalent protection mechanisms.

6. User Rights (GDPR, CCPA, PIPEDA-Compatible)

Subject to applicable law, you may request:

• Access to personal data;
• Correction of inaccurate data;
• Deletion of data;
• Restriction of processing;
• Objection to certain processing;
• Data portability (where applicable);
• Withdrawal of consent (where processing is consent-based).

Additional U.S. state privacy rights (including CCPA-style rights)

Eligible residents may have rights to know, delete, and correct personal information and to opt out of certain "sale" or "sharing" practices as defined by law.

Canada (PIPEDA-compatible rights)

Users in Canada may request access and correction and may challenge our compliance with fair information principles.

To exercise rights, contact us at the address in Section 9. We may need to verify your identity before fulfilling requests.

7. Data Security Measures

We use administrative, technical, and organizational safeguards appropriate to the nature of the data and processing risks, including access controls, session security controls, and monitoring.

8. Children's Data Policy

The Platform is not directed to children under 13, and we do not knowingly collect personal data from children under 13 without appropriate legal basis.

If you believe a child has provided personal data in violation of applicable law, contact us so we can review and take appropriate action.

9. Contact Information

For privacy requests or questions:

• Email: infos@lithyusmusic.com
• Subject line suggestion: "Privacy Request"

You may also contact us to appeal rights-request decisions where applicable.

10. Do Not Sell / Share (CCPA-Style Disclosure)

We do not sell personal information for money. We may disclose limited identifiers and usage data to analytics or service providers for business purposes.

If applicable law classifies certain disclosures as "sharing" for cross-context behavioral advertising, you may request to opt out by contacting us.

11. Audio Fingerprinting Clarification

12. Updates to this Privacy Policy

We may update this Privacy Policy periodically. The "Last Updated" date reflects the latest revision. Material updates become effective upon posting, subject to any additional notice requirements under applicable law.