Privacy policy

This Privacy Policy explains how Yellowcake Music Group Inc. ("Yellowcake", "we", "us") collects, uses and shares personal information. It covers:

• our website at yellowcakemusicgroup.com;
• our artist and label dashboard, which we use to provide record label, music distribution and royalty services ("Distribution Services");
• our pre-save and artist subscription pages, which let fans connect a streaming account so that releases are saved to their library and artists are followed ("Fan Services").

Together these are the "Services". Yellowcake is the controller of the personal information described here. Questions can be sent to legal@yellowcakemusicgroup.com.

Summary

• Fans: when you pre-save or subscribe, we receive basic profile details from the streaming service you connect, along with a token that lets us save releases and follow artists for you. We use these only to carry out what you asked for. We do not sell this data or share it with advertisers.
• Artists and labels: we collect the account, catalogue, royalty, payment and tax details we need to distribute your music and pay you.
• Analytics: we use Google Analytics to understand how the site is used. We do not use advertising pixels or targeted advertising.
• No sale: we do not sell personal information. We do not "share" it for cross-context behavioural advertising.
• Your rights: you can disconnect a streaming account at any time, and you can ask us to access, correct or delete your data. See Your rights.

1. Information we collect

What we collect depends on whether you are a fan using our Fan Services, an artist or label using our Distribution Services, or a website visitor.

• Fans: Streaming account ID, display name, email address (where the service provides it), country, and the access and refresh tokens that let us act on your behalf. Where it comes from: The streaming service you connect (Spotify, Apple Music or Tidal) or Google Sign-In.
• Fans: Which releases you pre-saved, which artists you subscribed to, and the date of each action. Where it comes from: Your use of our pre-save and subscription pages.
• Artists and labels: Name, business name, email, phone, postal address, username and password (stored hashed). Where it comes from: You, when you register or contact us.
• Artists and labels: Release metadata, audio, artwork, contributor and rights information, and royalty and sales statements. Where it comes from: You, and the streaming and download stores we deliver to.
• Artists and labels: Payee details, bank or payout details, tax forms (such as W-9 or W-8BEN), tax identification numbers, and identity documents where needed to verify you. Where it comes from: You and our payment provider, Tipalti.
• Everyone: IP address, browser and device type, pages viewed, referring page, approximate location derived from IP. Where it comes from: Collected automatically, including through Google Analytics.

Sensitive information. For artists and labels, tax identification numbers (for example, a US Social Security Number or EIN), government ID and payout account details are sensitive information. We collect them only to meet tax reporting obligations, verify identity, prevent fraud and pay royalties. We never collect sensitive information from fans.

We do not collect special-category data, such as information about racial or ethnic origin, religion, health or sexual orientation.

2. How we use information and our legal bases

The legal bases below apply if you are in the UK or EEA. They are set by the UK GDPR and the EU GDPR.

• Fulfilling pre-saves, follows and artist subscriptions you request: Consent, given when you connect your streaming account. You can withdraw it at any time
• Creating and managing artist and label accounts: Performance of a contract
• Delivering releases to stores, collecting revenue, and calculating and paying royalties: Performance of a contract
• Tax reporting, identity verification and meeting other legal duties: Legal obligation
• Customer support and service messages, such as release status and statements: Performance of a contract or legitimate interests
• Security, fraud and stream-manipulation prevention, and rights and copyright compliance: Legitimate interests (protecting our services, artists and partners) and legal obligation
• Website analytics to improve the Services: Consent, collected through our cookie banner where required
• Defending legal claims and responding to lawful requests: Legal obligation or legitimate interests

We do not use your information to make automated decisions that have legal or similarly significant effects on you.

Emails. We send artists and labels service messages about their account, releases and statements, and these cannot be turned off while the account is open. If we send marketing emails, each one has an unsubscribe link. We do not send marketing emails to fans unless they have opted in.

3. Pre-saves and streaming account connections

When you connect Spotify, Apple Music or Tidal, that service asks you to approve specific permissions. We only request the permissions needed to:

• save the release to your library when it comes out;
• follow the artist, or add the release to a playlist, where the page says so;
• read your basic profile (ID, display name, email and country) so we can link the pre-save to you and avoid duplicates.

We do not use these permissions to read your listening history, control playback or change anything you did not ask for.

Tokens. We store the access and refresh tokens the streaming service gives us, encrypted, so that we can complete the save on release day. For an artist subscription, we also use them to save future releases from that artist until you unsubscribe.

Turning it off. You can disconnect at any time by removing Yellowcake from the connected apps in your Spotify, Apple or Tidal account settings, or by emailing us. Once access is revoked or you unsubscribe, we stop acting on your account and delete your tokens.

Your use of a streaming service remains subject to that service's own privacy policy.

Artist-branded pages. Pre-save and subscription pages may carry an artist's or label's name and branding. Yellowcake runs these pages, and this policy applies to them.

Google user data. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

4. Who we share information with

We share personal information only with the recipients below, and only for the purposes described.

• Streaming services (Spotify, Apple Music, Tidal): To carry out the pre-saves and follows you request
• Digital stores and platforms we deliver to: To distribute releases. This includes artist and contributor names and other rights metadata
• Amazon Web Services: Hosting and storage
• Tipalti: Collecting payee and tax details, and paying royalties
• Google (Sign-In and Analytics): Account login and website analytics
• Professional advisers, such as lawyers and accountants: Legal, tax and accounting services
• Authorities, courts and rights bodies: Where the law requires it, or to respond to copyright or infringement claims
• A buyer or successor business: If we are involved in a merger, sale or financing, subject to this policy

Our service providers may use the information only on our instructions. We do not sell personal information, and we do not share it for targeted advertising. In the past 12 months, we have not sold or shared any category of personal information for those purposes.

Aggregated data. We may share aggregated or de-identified statistics, such as the total number of pre-saves for a release or the countries they came from, with the artist or label whose release a campaign promotes. These statistics do not identify you, and we do not try to re-identify them.

5. Cookies and analytics

We use two kinds of cookies.

• Essential cookies keep you logged in, keep the site secure and remember your consent choices. The Services need them to work.
• Analytics cookies come from Google Analytics. They tell us how visitors use the site, for example which pages are viewed and where visitors arrive from. Where the law requires it, we set them only with your consent.

We do not use advertising, retargeting or social media tracking pixels.

You can change your choice at any time through the cookie banner or your browser settings. You can also opt out of Google Analytics at tools.google.com/dlpage/gaoptout.

We do not currently respond to browser Do-Not-Track signals, because no common standard exists. We do honor Global Privacy Control signals where the law requires it.

6. International transfers

We are based in the United States, and our systems are hosted on AWS. Your information may therefore be processed outside the country where you live. When we transfer personal information from the UK or EEA, we rely on safeguards the law accepts. These include the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, or an adequacy decision such as the EU-US and UK-US Data Privacy Framework where the recipient is certified. You can ask for a copy of the relevant safeguards by emailing us.

7. How long we keep information

• Fan streaming tokens: Until the pre-save is complete, or until you unsubscribe or revoke access, whichever comes later
• Fan pre-save and subscription records: While the subscription is active, and up to 24 months after the last activity, for campaign reporting
• Artist and label account data: While the account is open, then deleted or anonymised. Some data is kept longer where the law requires it
• Royalty, payment and tax records: 7 years after the relevant tax year
• Analytics data: 14 months (the Google Analytics setting)

When we no longer need information, we delete or anonymise it. If that is not yet possible, for example while a backup is still in rotation, we isolate it from further use until it can be deleted.

8. Security

We protect personal information with technical and organisational measures. These include encryption in transit and at rest, encrypted storage of streaming tokens, access controls limited to the staff who need access, and logging. No system is completely secure, but we will notify you and the regulators where the law requires it if a breach affects your information.

9. Children

Our Distribution Services are for adults aged 18 or over, or for minors acting through a parent or guardian who holds the account. Our Fan Services are not directed at children under 13, or under 16 in the UK and EEA. Streaming services set their own minimum ages. If we learn that we have collected information from a child below these ages without valid consent, we will delete it. Contact legal@yellowcakemusicgroup.com if you believe this has happened.

10. Your rights

UK and EEA. You have the right to:

• access your information;
• correct it;
• have it erased;
• restrict or object to how we process it;
• receive it in a portable format;
• withdraw consent at any time. Withdrawal does not affect processing that has already taken place.

You can also complain to the UK Information Commissioner's Office (ico.org.uk/make-a-complaint, 0303 123 1113) or to your local EEA data protection authority. We would appreciate the chance to resolve your concern first.

United States. Depending on your state, you may have the right to:

• know what personal information we process, and access it;
• correct it;
• delete it;
• obtain a copy of it;
• limit our use of sensitive personal information;
• not be discriminated against for using these rights.

We do not sell personal information, use it for targeted advertising, or profile you in ways that produce legal effects, so there is nothing to opt out of. If we decline your request, you can appeal by replying to our decision. If the appeal is denied, you may contact your state attorney general.

How to make a request. Email legal@yellowcakemusicgroup.com. We will confirm your identity before acting, using the email address linked to your account or streaming connection. An authorised agent must provide signed permission from you. We respond within one month in the UK and EEA, and within 45 days in the US.

11. Changes to this policy

We will update this policy when our practices or the law change, and revise the date at the top. If a change is material, we will tell you by email or with a notice on the Services before it takes effect.

12. Contact us

Yellowcake Music Group Inc.
30 N. Gould St STE R, Sheridan, WY 82801, United States
legal@yellowcakemusicgroup.com

‍