Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account and identity information: your email address (used for sign-in verification codes), phone number and country calling code when you use phone replacement or recovery, display name, and, for artists, profile details such as biography, artwork, banner images, and photos.
• Authentication credentials: passkey (WebAuthn) public key credentials, which are cryptographic keys, not biometric data — your device, not Audestra, verifies your fingerprint, face, or PIN. Native listener apps also send Apple App Attest or Google Play Integrity signals so we can tell a genuine app from automated traffic.
• Payment information: if you choose an optional paid feature when offered, our payment processor handles card information. We may receive transaction and account status records needed to provide that feature. Card numbers remain with the processor.
• Invitation information: join links, QR codes, and, where supported, NFC tag identifiers and settings used to help listeners access an artist’s catalog.
• Listening and usage activity: playback and feature activity used to operate the Service, protect accounts, and provide artists with the analytics available in Studio; app version and platform information; and general diagnostic information if crash reporting is enabled on a device. We do not ship a third-party crash SDK in the listener apps today.
• Catalog reports: if you report published artist content, we store the target, reason, optional note, and your account id for moderation review. Artists do not see reporter identity in analytics.
• Offline download metadata: which tracks and assets are downloaded to a device and their storage size, so we can enforce storage allowances and invalidate downloads when access changes.
• Device and session information: device identifiers, session tokens, and IP address, used for authentication, security, and abuse prevention.
• Bot-protection signals: when you request a sign-in or recovery code from Studio or the listener website, Cloudflare Turnstile may collect technical signals such as IP address and browser characteristics to distinguish human visitors from automated traffic. Native listener apps use Apple App Attest or Google Play Integrity instead of Turnstile.
• Notification tokens: if you enable notifications, a token used to deliver them.

2. How We Use Information

We use the information described above to:

• Authenticate you and keep your account secure, including detecting and preventing fraud or abuse.
• Operate personal music distribution features, including catalog publishing, invitation and access controls, streaming, offline playback where supported, catalog synchronization, and artist analytics.
• Communicate with you about your account, security notices, and material changes to the Service or these policies.
• Maintain, troubleshoot, and improve the Service, including through aggregated or de-identified usage analysis.
• Moderate User Content and enforce our Terms and Conditions, including by removing content we deem inappropriate for any reason.
• Comply with legal obligations.

3. How We Share Information

We do not sell your personal information. We share information only as follows:

• With infrastructure and communications providers (for example, cloud hosting, email delivery, and bot-protection vendors) who process information on our behalf under contractual confidentiality and security obligations.
• With the artist or organization whose catalog you join, limited to the profile details and listening or usage metrics made available in Studio. We do not provide your email address or raw device identifiers to artists through the Service.
• When required to comply with a legal obligation, protect the rights and safety of Audestra or others, or investigate suspected fraud or abuse.
• In connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy continuing to apply to the information transferred.

4. Artist rights and legal records

Artists or their representatives may provide names and contact details of rights holders, writers, publishers, administrators, and other representatives, including people who do not have Audestra accounts. They may also provide ownership or control shares, permissions, restrictions, territory details, agreement versions, and supporting records. We use this information to document authority, assess catalog eligibility, administer the Service, respond to changes and complaints, and meet legal obligations.

We may share relevant records with service providers, authorized reviewers, professional advisers, counterparties, or authorities as reasonably necessary for rights administration or legal compliance. Private rights evidence is not public catalog metadata. We retain these records while needed to administer rights, accounts, claims, and applicable recordkeeping obligations, and restrict access to them.

If an artist has supplied information about you and you do not have an Audestra account, contact audestra@ajilus.com to ask about access, correction, or deletion. We may verify your identity or authority, and applicable legal exceptions continue to apply.

5. Cloudflare Turnstile

Studio and the listener website use Cloudflare Turnstile in invisible mode when you request a sign-in or recovery code, and Studio uses the same protection on the Studio access request form. Turnstile runs in the background and does not show a checkbox. As a condition of that mode, we reference Cloudflare's Turnstile Privacy Addendum, which describes how Cloudflare processes the technical signals it collects: https://www.cloudflare.com/turnstile-privacy-policy/.

6. Data Storage and Security

The Service is hosted on cloud infrastructure located in the United States. We use encryption in transit for all API and media traffic, and we do not store verification codes or passkey private keys — passkey private keys never leave your device.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you as required by applicable law.

7. Data Retention

We retain account and usage information for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. After an account is deleted, we disable sign-in and revoke sessions and notification endpoints, and remove or disassociate account data where operationally possible. We may retain transaction records, security events, content complaint records, and aggregated or de-identified analytics when needed for legal, security, dispute-resolution, or reporting purposes. We may also delete User Content that we remove under our Terms and Conditions.

8. Your Choices and Rights

You can review and update profile information and account security settings available in the Service. Signed-in listeners can delete their account from Profile in the iOS app or the Android app. The same instructions are published at https://audestra.com/delete-account.html without requiring sign-in. To request access to, correction of, or deletion of your personal information if you cannot use in-app deletion, contact us at audestra@ajilus.com; we will verify your identity before acting on the request and respond within a reasonable time.

Depending on where you live, you may have additional rights under applicable privacy law, such as the right to data portability or to lodge a complaint with a supervisory authority. Contact us to exercise these rights.

9. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us at audestra@ajilus.com so we can delete it.

10. International Users

The Service is operated from and primarily intended for users in the United States. If you access the Service from outside the United States, your information will be processed in the United States, which may have different data protection laws than your country of residence.

11. Changes to this Policy

We may update this Privacy Policy from time to time. We will update the effective date above and, for material changes, provide reasonable notice through the Service.

12. Contact

You may contact us to request access to, correction of, or deletion of information, subject to verification and applicable legal exceptions. Questions about this Privacy Policy can be sent to audestra@ajilus.com.