SongBounty Privacy Policy

Effective date: March 15, 2026 Last updated: April 24, 2026

---

1. Introduction

This Privacy Policy explains how Biz Solution Inc. ("SongBounty," "we," "us," or "our"), which operates the SongBounty brand and service, collects, uses, discloses, and safeguards information when you:

• Visit songbounty.com or any SongBounty subdomain (the "Site");
• Submit an audit request, free scan request, or contact form;
• Purchase or subscribe to a SongBounty plan (AUDIT, PROTECT, MONITOR, or Enterprise);
• Upload a music catalog, ISRCs, ISWCs, or related metadata for analysis;
• Access a SongBounty client portal, dashboard, or report (once available); or
• Communicate with us by email or other channels.

SongBounty provides music-catalog royalty audit and monitoring services for self-published songwriters, recording artists, managers, and small catalogs. Our service is designed for professional use and is not directed to children under 13.

By using our Site or Services, you agree to this Policy. If you do not agree, please do not use the Service.

---

2. Who this Policy applies to

• Site visitors — anyone browsing songbounty.com.
• Audit requesters — users who submit the audit intake form or free-scan form.
• Clients — individuals or entities that enter a paid engagement with SongBounty.
• Authorized users — team members or representatives a client invites to access their workspace.

Third parties whose professional data appears in a client's catalog (e.g. co-writers, publishers, producers named in split sheets) are discussed in §6 ("Third-party data you share with us").

---

3. Information we collect

3.1 Information you provide directly

Audit intake / free-scan form (submitted via songbounty.com):

• Full name
• Email address
• Role (Songwriter, Artist, Publisher, Manager, Other)
• Plan of interest (Free scan, AUDIT, PROTECT, MONITOR, Enterprise)
• Catalog size range
• Spotify artist URL or YouTube channel URL
• Catalog file (CSV, XLS, or XLSX — up to 10MB)
• Optional message

Account information (once the client portal launches):

• Login email and password (hashed — we never store plaintext passwords)
• Account profile details (display name, artist/project name, PRO affiliation, IPI number if supplied)
• Billing name, billing address, tax ID if applicable

Payment information (once paid plans launch):

• SongBounty does not store, process, or transmit credit card numbers. All card transactions will be handled by a PCI DSS Level 1 certified third-party payment processor. We receive only tokenized references, last-four digits, card brand, and billing ZIP from the processor for receipt display and fraud prevention. The specific processor will be named here, and added to our sub-processor list, before any charges are taken.

Communications:

• Emails, support tickets, and any content you send us (including catalog attachments and reply threads).

3.2 Information about your catalog and musical works

To deliver an audit we process professional music metadata you or your representatives provide, including:

• Song titles, recording titles, version identifiers
• ISRC (International Standard Recording Code)
• ISWC (International Standard Musical Work Code)
• Songwriter, composer, producer, and featured artist names
• Publisher and label names
• Writer/publisher splits and ownership percentages
• Territory and registration scope
• PRO affiliations (ASCAP, BMI, SESAC, GMR, foreign societies)
• IPI / CAE numbers
• Release dates, UPCs, album metadata
• Streaming platform URLs (Spotify, Apple Music, YouTube, Deezer, etc.)

This data is generally professional information about musical works, not personal information about consumers. Where the data identifies an individual (for example, a songwriter's legal name tied to their IPI), we treat it as personal information under applicable law.

3.3 Information collected automatically

• Log data: IP address, browser type, user agent, device type, referring URL, pages visited, timestamps. Captured by our web host and in our submission handler for rate-limiting and abuse prevention.
• Analytics: We use Google Analytics 4 (GA4) to measure aggregate Site usage. GA4 sets cookies and collects a pseudonymized client ID, approximate city-level geolocation, and interaction events. We do not enable Google Signals, advertising features, or cross-device tracking on GA4.
• Cookies and similar technologies: See §12.

3.4 Information we receive from third parties

To enrich and validate your catalog, our audit pipeline queries third-party music-data APIs and returns results into our system. These services return metadata about your works (not about you personally). See §5 for the full sub-processor list.

---

4. How we use your information

We use the information we collect to:

• Deliver the Service — run audits, generate reports, monitor catalogs for new UGC and derivatives, detect unclaimed royalties, produce Fix-It recommendations.
• Communicate with you — send audit results, account notices, confirmations, transactional emails, and (with your consent) marketing emails.
• Process payments — via a PCI DSS-compliant payment processor (once paid plans launch).
• Prevent abuse and fraud — rate-limit form submissions, detect bots (we use a honeypot field), investigate suspicious activity.
• Improve the Service — aggregate usage analytics, debug errors, measure feature adoption. We do not use your catalog data to train machine-learning models that benefit other customers.
• Comply with law — respond to subpoenas, tax and accounting requirements, DMCA notices, and lawful requests from regulators or PROs.

4.1 Legal bases (for users in the EEA / UK)

Where the GDPR or UK GDPR applies, we process personal data under one of the following legal bases:

• Contract — to deliver the Services you have requested or purchased.
• Legitimate interests — to secure the Site, prevent fraud, and improve the product (balanced against your rights).
• Consent — for non-essential cookies and marketing emails.
• Legal obligation — for tax, accounting, and lawful requests.

---

5. How we share information (sub-processors and third parties)

We share information only as described below. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

5.1 Service sub-processors

We publish our current sub-processor list at songbounty.com/subprocessors. Material additions are announced at least 30 days in advance via email to active clients, who may object in writing before the change takes effect.

5.2 Professional advisors

We may share information with accountants, auditors, and attorneys bound by confidentiality, where reasonably necessary.

5.3 Business transfers

If SongBounty is involved in a merger, acquisition, or asset sale, personal information may be transferred as part of that transaction. We will notify affected clients before information becomes subject to a different privacy policy.

5.4 Legal and safety

We may disclose information when we believe in good faith that disclosure is necessary to (i) comply with law or valid legal process, (ii) enforce our Terms, (iii) protect the rights, property, or safety of SongBounty, our clients, or the public, or (iv) investigate fraud or security issues.

5.5 With your direction

We may share information at your direction — for example, when you ask us to register works with a PRO on your behalf, deliver a report to a co-writer, or integrate with a third-party tool you have authorized.

---

6. Third-party data you share with us

When you upload a catalog, it typically contains information about third parties — co-writers, publishers, producers, featured artists, and other collaborators. You represent that you have the right to share that information with us for audit purposes, and you are responsible for honoring any notice, consent, or confidentiality obligations you owe those third parties. On written request from you (or from a third party with a verifiable claim), we will correct or remove inaccurate third-party information.

---

7. Machine learning and automated processing

SongBounty uses rule-based software, music-industry APIs, and purpose-built machine-learning models to perform audits. Specifically, we use ML models to:

• Enrich catalog metadata (e.g. reconciling titles, ISRCs, and ownership across data sources);
• Predict sync-licensing potential and flag sync opportunities;
• Detect derivatives and UGC use of your works.

These models are operated either in-house or through the specialized music-data sub-processors listed in §5.1 (for example, ACRCloud for audio fingerprinting). We do not send your catalog data to general-purpose large language model providers such as OpenAI, Anthropic, or Google Gemini. If that ever changes, we will update this Policy before the feature launches and notify active clients.

We do not use automated processing to make decisions that produce legal or similarly significant effects about you without human involvement.

---

8. Data retention

We generally retain information only for as long as is needed to deliver the Service, honor contractual commitments, and meet legal, tax, or accounting obligations. Our target retention periods are:

You may request earlier deletion at any time (see §10). We may retain a minimal record of the fact of deletion, plus any information we are legally required to keep. Actual retention in a given case may be longer where an active legal hold, dispute, or regulatory obligation applies, or shorter where you direct us to delete sooner.

---

9. Security

We implement administrative, technical, and physical safeguards designed to protect your information, including:

• TLS/HTTPS encryption for data in transit;
• Encryption at rest for production databases and report storage;
• Role-based access controls and least-privilege principles for staff;
• Credential management via environment variables and secret stores — never committed to source control;
• Rate limiting and bot mitigation on public forms;
• Regular dependency patching and security review of third-party APIs.

No system is perfectly secure. If we become aware of a security incident that affects your personal information, we will notify you and applicable regulators as required by law — targeting notification within 72 hours of becoming aware for GDPR-eligible incidents and within the timeframes required under applicable US state law.

---

10. Your rights and choices

Depending on where you live, you may have the following rights:

• Access — request a copy of the personal information we hold about you.
• Correction — request that inaccurate information be corrected.
• Deletion — request that we delete your personal information, subject to legal exceptions.
• Portability — receive your data in a machine-readable format (CSV or JSON) for catalog and account data.
• Opt-out of marketing — unsubscribe from marketing emails via the link in every message.
• Opt-out of "sales" or "sharing" — SongBounty does not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of. We honor Global Privacy Control (GPC) signals as an opt-out preference signal.
• Non-discrimination — we will not deny service, charge different prices, or provide lower service quality for exercising your rights.

10.1 California residents (CCPA / CPRA)

California does not exempt business-to-business personal information. California residents have the rights above, plus the right to limit the use of sensitive personal information. We do not knowingly process sensitive personal information as defined by the CPRA. To exercise rights, email contact@songbounty.com. We will verify your identity before responding.

10.2 EEA, UK, and Swiss residents (GDPR / UK GDPR)

You have the rights above, plus the right to lodge a complaint with your local supervisory authority. International transfers of your data to the United States rely on Standard Contractual Clauses (SCCs) and supplemental safeguards where required.

10.3 How to exercise your rights

Email contact@songbounty.com from the address associated with your account. We respond within 30 days (extendable by 60 days for complex requests, with notice). Authorized agents may submit requests with verifiable proof of authority.

---

11. International data transfers

SongBounty is based in the United States and our primary infrastructure is located in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States and other countries where our sub-processors operate. Where required, we rely on Standard Contractual Clauses and other lawful transfer mechanisms.

---

12. Cookies and similar technologies

We use a small number of cookies and similar technologies:

Where required by law (EEA, UK, California, and other applicable jurisdictions), we present a cookie consent banner when you first visit the Site, allowing you to accept, reject, or customize non-essential cookies. You can change your choice at any time via the "Cookie preferences" link in the Site footer.

You can also control cookies via your browser settings and opt out of GA4 using Google's browser opt-out extension.

---

13. Children's privacy

The Service is not directed to children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact contact@songbounty.com and we will delete it.

---

14. Third-party links

The Site and reports may contain links to third-party websites (for example, Spotify, YouTube, ASCAP, BMI, and the MLC). We are not responsible for the privacy practices of those sites. Review their policies before providing information.

---

15. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will notify you by email (if we have your address) or by a prominent notice on the Site at least 14 days before the change takes effect. The "Last updated" date at the top of this Policy always reflects the latest revision.

---

16. Contact us

Biz Solution Inc. Attn: Privacy — SongBounty Email: contact@songbounty.com

This Policy is governed by the laws of the State of Wyoming, without regard to conflict-of-laws principles, except where a mandatory consumer-protection law of your jurisdiction provides otherwise.