1. Information covered
We may collect identity and contact information; order, transaction, coupon, refund, and dispute records; audio, lyrics, artwork, credits, reference artists, genre, goals, and release context; rights attestations and permission choices; report and support communications; and limited device, browser, IP, security, and usage information. The connected payment processor—not us—should receive full card details.
2. Sources
Information comes from you, a person authorized to submit for you, checkout and CRM providers, support communications, and ordinary website/security technology. We do not intentionally purchase sensitive music-submission data from data brokers.
3. Purposes
We use information to process and document orders; verify eligibility and rights; provide, quality-check, and improve the purchased service; communicate status and support; prevent fraud and abuse; secure systems; maintain accounting, tax, consent, and dispute records; enforce agreements; and comply with law. Marketing email or SMS requires separate consent or another lawful basis and must include applicable opt-out controls.
4. Service providers and disclosure
Necessary information may be disclosed to providers supporting CRM and workflow management (currently HighLevel/Go Fast Digital), payment processing, website hosting, email, analytics/security, professional advice, and private file storage. We may also disclose information to comply with law, protect rights and safety, investigate fraud, or complete a merger, financing, sale, or reorganization subject to appropriate safeguards.
5. No sale of songs or bundled optional rights
We do not sell your submitted music. Purchase does not automatically authorize public display, promotion, testimonials, listener testing, public libraries, or model training. Each optional use requires separate, specific, unselected consent that may be declined without losing the purchased diagnostic.
6. Ownership and limited access
You retain ownership of your music and lyrics. Access should be limited to personnel and providers who need it to fulfill, secure, support, or lawfully administer the service. HighLevel should store customer, order, consent, and status records; private audio should be stored separately behind randomized object names and expiring access links.
7. Retention
The planned default is deletion of source audio and working copies within 30 days after report delivery, unless a clarification remains open, you request earlier deletion where feasible, or law requires preservation. Upload links should expire within 24 hours and download links should be short-lived. Transaction, consent, report-delivery, security, tax, accounting, and dispute records may be retained for the period reasonably necessary for those purposes and applicable limitation periods. Final schedules must be documented and technically tested.
8. Security and incident response
The planned controls include encrypted transmission, private storage, presigned expiring links, least-privilege access, strong account authentication, activity logging, file-type and size validation, malware screening where available, backups of business records, deletion testing, and a written incident-response process. No system is perfectly secure. Do not email unreleased masters or use a public upload link. We will investigate and provide legally required notices if a qualifying incident occurs.
9. Your choices and requests
Depending on your location, you may request access, correction, deletion, portability, or information about processing and disclosures, and may appeal or complain to a regulator. We may verify identity, retain records needed for legal obligations or defenses, and deny requests where law permits. You may opt out of promotional communications without affecting service messages.
10. Children
The service is for adults 18 and older. We do not knowingly collect submissions from children. Contact us if you believe a child submitted information.
11. United States processing
The founding service is operated for United States customers and information may be processed in the United States. International sales should remain disabled until location-specific privacy, consumer, tax, and transfer requirements are reviewed.
12. Changes and contact
We will post material changes with a new effective date and obtain new consent where required. Planned privacy contact: support@ismysongahit.com. The address, legal operator, and mailing address must be active and displayed before live collection begins.