Privacy Policy

1. Data Controller

The data controller responsible for the processing of your personal data is YourLabel, operating the music distribution platform accessible at yourlabel.app(“Platform”, “Service”, “we”, “us”, or “our”).

For all matters relating to your personal data, including exercising your rights under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable national data protection legislation, you may contact us at [email protected].

2. Personal Data We Collect

We collect and process the following categories of personal data, limited to what is strictly necessary for the provision of the Service (the principle of data minimisation, GDPR Article 5(1)(c)):

We do not collect special category data as defined in GDPR Article 9 (health data, racial or ethnic origin, biometric data for identification, etc.). Identity documents are collected solely for anti-fraud and regulatory compliance verification and are not processed for biometric profiling.

3. Lawful Basis for Processing

Each processing activity carried out by YourLabel is grounded in one of the lawful bases enumerated in GDPR Article 6(1). We do not process your data without a documented legal basis.

4. Purposes of Processing

We process your personal data exclusively for the following purposes:

• Account management — creating, authenticating, and maintaining your user account.
• Identity verification — verifying your identity and eligibility to use the Service, as required by our distribution partners and internal anti-fraud policies.
• Music distribution — delivering your releases to the digital stores and streaming platforms you select, including transmitting your name, artist name, and release metadata as required by each store.
• Royalty administration — receiving royalty reports from distribution partners, crediting earnings to your dashboard, and processing withdrawal requests.
• Service communications — sending you transactional notifications about your account (verification outcomes, release status changes, payout confirmations). We do not send unsolicited marketing emails.
• Security and fraud prevention — logging authentication activity, detecting suspicious behaviour, and protecting the integrity of the Platform.
• Legal compliance — retaining financial records as required by applicable tax and accounting laws.

We will not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects, as prohibited by GDPR Article 22 without explicit consent.

5. Third-Party Processors & Data Recipients

We engage the following third-party data processors under binding Data Processing Agreements (DPAs) as required by GDPR Article 28. Each processor acts only on our documented instructions.

Digital stores and streaming platforms to which we distribute your music act as independent data controllers in respect of your content once delivered to them. Their respective privacy policies govern the use of your data on their platforms.

We do not sell your personal data to any third party, nor do we share it for advertising, marketing analytics, or data brokerage purposes.

6. International Transfers of Personal Data

Some of our processors are based outside the European Economic Area (EEA). Where personal data is transferred to a third country, we ensure that an appropriate safeguard under GDPR Chapter V is in place:

• Standard Contractual Clauses (SCCs) — adopted under European Commission Decision 2021/914 — govern transfers to processors in the United States and other non-adequate third countries.
• Adequacy decisions — where the European Commission has recognised the destination country as providing an adequate level of protection (GDPR Article 45).

Distribution of your music to global stores necessarily involves transfer of your artist name and release metadata worldwide. This transfer is strictly necessary for the performance of the contract between us (GDPR Article 49(1)(b)) and is limited to the metadata required by each store.

7. Retention Periods

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with GDPR Article 5(1)(e).

8. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights. We will respond to all verified requests within 30 calendar days (extendable by a further 60 days in complex cases, with notice to you) as required by GDPR Article 12(3).

9. Cookies & Local Storage

We use only strictly necessary cookies and browser storage mechanisms. No consent is required for these under the ePrivacy Directive Article 5(3) as they are essential to provide the service you have requested.

We do not use advertising cookies, third-party tracking cookies, analytics platforms (Google Analytics, Meta Pixel, etc.), or any technology designed to track you across websites.

10. Technical & Organisational Security Measures

We implement appropriate technical and organisational measures pursuant to GDPR Article 32 to ensure a level of security appropriate to the risk, including:

• Encryption in transit — all data exchanged between your browser and our servers is encrypted via TLS 1.2+ (HTTPS enforced; HSTS max-age 31,536,000 seconds).
• Encryption at rest — files stored in Cloudflare R2 are encrypted at rest using AES-256.
• Password security — passwords are hashed using bcrypt with a per-user salt. We never store plaintext passwords.
• Access control — row-level security (RLS) policies on the database ensure each user can access only their own data. Admin access is role-restricted and logged.
• Rate limiting — authentication endpoints are rate-limited (5 attempts per 15 minutes per IP) to mitigate brute-force attacks.
• Content Security Policy (CSP) — HTTP security headers are enforced including CSP, X-Frame-Options (DENY), and Permissions-Policy.
• Least privilege — service accounts and API tokens are scoped to the minimum permissions required for each function.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it (GDPR Article 33), and notify affected data subjects without undue delay where required by GDPR Article 34.

11. Children

The Service is directed exclusively at individuals aged 18 and over. We do not knowingly collect personal data from persons under the age of 18. If we become aware that we have inadvertently collected personal data from a minor, we will take immediate steps to delete such data.

If you believe that a minor has submitted data to us, please contact [email protected]immediately and we will investigate and remediate within 72 hours.

12. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time to reflect changes in our processing activities, legal obligations, or regulatory guidance. Material changes — i.e. changes that affect your rights or our legal bases — will be communicated to you:

• Via email to your registered address, at least 14 days before the change takes effect.
• Via a prominent notice in your dashboard on next login.

Non-material changes (corrections, clarifications, formatting) may be made without prior notice. The “Last updated” date at the top of this page reflects the most recent revision. Continued use of the Service after the effective date of a revised Policy constitutes your acceptance of the changes.