Privacy

• This policy follows the UK GDPR and the Data Protection Act 2018, and the EU GDPR for users in the EU.
• Moonlight Records [to be confirmed: UK company name, Companies House number and registered address] is the data controller for the data described below.
• Contact for anything about your data: [to be confirmed: privacy email].
• Registration with the ICO (the UK data protection regulator), and an EU representative where the law requires one: [to be confirmed: ICO registration number and EU representative].

When you send a demo link: your artist name, email, the link to your track and your message, if you write one.

When you request an account: your artist name, email, country, links to your music and social profiles, and what you tell us about yourself.

If you have an account: your email, artist name, profile links, audio files, track titles and notes. Your password is stored only as a hash, so nobody can read it.

If a track is selected for release: your legal name, country, phone (optional), credits, the legal names and splits of the people you credit, your answers about samples and AI, the artwork, the master file, and which version of the Release Agreement you accepted and when.

If you set a payout method: the method, and your PayPal or Wise email. Bank account details are not stored in the portal.

When you visit the site: page views and preview plays per day. These counts store no cookies, no IP address and nothing that identifies you.

Details about the people you credit come from you. You confirm that you told them and that they agreed.

• Reviewing your demo and replying to you: steps you ask us to take, by sending it, before any agreement.
• Running your account, releasing tracks, crediting, keeping agreement records and paying you: performing the agreement between you and the label.
• Accounting, tax and requests from public authorities: our legal obligations.
• Securing the site, detecting fake streams and fraud, and handling rights complaints: the label's legitimate interests, balanced against your rights.
• Where we rely on your consent, you can withdraw it at any time by email. Withdrawing does not affect what we did before.

• Only the label team. Audio files you upload can be played only by you and the label.
• When we release a track, the distributor (currently Spilix) and the music stores receive what they need to publish it: the audio, artwork, artist names, credits and songwriters' legal names.
• Infrastructure providers: our hosting provider ([to be confirmed: name]) and email delivery service ([to be confirmed: name, once email is switched on]). They process data only so the site and its emails work.
• The payout service you choose, such as PayPal or Wise, when we send you money.
• Public authorities, when the law requires it.
• We do not buy or sell personal data.

• The distributor, music stores and infrastructure providers may be outside the UK and the EU, so release data may be transferred to other countries.
• Where a country is not recognised as giving equivalent protection, we use valid safeguards, such as standard contract clauses (the UK IDTA or the EU SCCs), and transfer only what the release needs.
• You can ask for a copy of the safeguards we use.

• Demo links and account requests that are not selected: 12 months after the decision.
• Account data: while the account is active.
• Release details, agreement records and statements: for the term of the agreement, then for as long as UK accounting and tax law requires.
• System backups: up to 14 daily and 8 weekly copies, plus the 10 latest, then deleted automatically.

• To know how your data is used, and to get a copy of it.
• To ask us to correct, delete or restrict it, and to object to uses based on our legitimate interests.
• To receive the data you gave us in a machine-readable format, so you can move it elsewhere.
• To withdraw your consent at any time.
• Artists can edit their profile and delete demos that are still waiting, right in the portal. Send other requests to [to be confirmed: privacy email]. We check your identity and reply within one month. Complex requests can take up to two more months; if so, we tell you why within the first month.
• Some data cannot be deleted while we still owe you money, need it for our accounts or have an agreement running. If so, we tell you why.
• You can complain to the ICO in the UK, or to the data protection authority where you live. Please tell us first, so we can put it right straight away.

• Logged-in users get one cookie that keeps them logged in.
• The public site uses no tracking or advertising cookies. A few choices, such as sound and pausing motion, are saved in your own browser.

• We do not take data directly from anyone under 16. A parent or guardian sends it for them and uses their rights for them.
• If we find we have data from a child under 16 without a parent's or guardian's consent, we delete it.

• Passwords are stored as hashes. Audio files open only for someone logged in with the right access. Data is backed up daily.
• If a data breach puts users at risk, we report it to the regulator within 72 hours of finding out, and tell the people affected without delay when the risk is high.

The date at the top shows the latest version. Changes to why we use data, or to who receives it, are announced in the portal before they apply.