Legal · Updated September 13, 2026

Privacy Policy

This Privacy Policy explains how Audora Music, operated by Metalmedia Group AB, registration number 559084-6662 ("Audora", "we", "us", or "our"), collects, uses, stores, and protects personal data when you use our services.

Audora Music is committed to protecting your privacy and processing personal data in compliance with the EU General Data Protection Regulation (GDPR) and applicable Swedish law.

1. Data Controller

Audora Music is the data controller for personal data processed in connection with user accounts, subscriptions, payments, support, and platform operations.

2. Personal Data We Collect

We collect only the data necessary to operate the service.

2.1 Account & Identity Data

• Full name
• Artist name
• Email address
• Telephone number
• Postal address
• Account credentials

2.2 Payment & Financial Data

• Bank account details
• Payment processor identifiers (e.g. PayPal, Stripe)
• Payment history and payout records

Audora does not store full card details. Payment data is handled by regulated third-party providers.

2.3 Verification & Anti-Fraud Data

Where necessary and proportionate, Audora may collect:

• Identity documentation (only upon request)
• Information related to suspected misuse, fraud, or artificial streaming

Such data is collected only when required and retained for the minimum period necessary.

2.4 Technical & Usage Data

• IP addresses
• Device and browser information
• Log files
• Usage data related to platform activity — inside the app: which sections you open, forms you start and finish, actions the app refused and why, and a daily record of which steps are still open on your account. No IP address or device identifier is kept with these records (see section 4.1)

2.5 Generated Content & Metadata

Audora may process:

• Metadata related to music releases
• Content generated using Audora's tools (e.g. images, media, or other generated assets)
• Associated technical data required to operate and improve the service

3. Purposes & Legal Bases for Processing

4. Analytics & Cookies

Audora uses limited analytics tools (e.g. Google Analytics 4) to understand how the service is used and to improve platform performance.

• Only necessary and analytical cookies are used
• No marketing or retargeting cookies are deployed
• Cookie handling complies with EU consent standards
• The Global Privacy Control (GPC) browser signal is honored — analytics cookies are automatically suppressed when GPC is active

You can manage your cookie preferences at any time using the "Cookie Settings" button in the site footer (available in the app and on app pages). Further details are available in our Cookie Policy.

4.1 Product-usage records (first party)

Separately from analytics cookies, Audora keeps its own record of how the app is used by signed-in artists: which sections are opened, forms started and finished, actions the app refused and why, and a daily record of which steps are still open on each account. These records are stored in Audora's own database in the EU, are never shared with a third-party analytics service, and are processed on the basis of legitimate interest (section 3) to see where artists get stuck and fix it.

You can object at any time under Account Settings → Privacy & Data → Product usage records; existing records are then removed within a day. This switch is independent of the cookie settings above: the Global Privacy Control signal governs cookies, not these records.

5. Data Storage & Location

• All personal data is stored within the European Union
• Audora does not transfer personal data outside the EU/EEA
• Appropriate technical and organizational security measures are applied

6. Data Sharing & Processors

Audora may share data with trusted processors solely to operate the service, including:

• Payment providers (e.g. Stripe)
• Cloud infrastructure & hosting (e.g. Supabase)
• Digital distribution partners (e.g. The Orchard)
• Email delivery (e.g. Resend)
• AI content generation (e.g. OpenAI, Anthropic, Google Vertex AI, Replicate)
• Analytics providers (Google Analytics 4, limited non-marketing use)

All processors are bound by data processing agreements in compliance with GDPR. Audora does not sell personal data. A complete and current list of sub-processors is maintained on our Sub-Processor Registry.

6.1 Connected Social Media Accounts & Google User Data

If you choose to connect a social media account (such as YouTube, TikTok, Facebook, or Instagram) to publish promotional content, Audora accesses only what that feature needs:

• Account identity (channel or profile name, avatar) — read once at connection time so you can see which account posts will go to.
• Publishing on your behalf — content you have created, reviewed, and explicitly approved in Audora is posted to your own connected account, with the visibility you chose. Audora never posts to third-party accounts and never modifies or deletes your existing content.
• Post status — after publishing, Audora reads back the post's processing status to confirm the platform accepted it.

Connected-account handles are shown as follow links on your public artist page when it is enabled.

Access tokens for connected accounts are stored encrypted, used solely to provide the publishing features described above, and deleted when you disconnect the account. You can disconnect at any time in Audora's Social Connections settings, and additionally revoke access from the platform itself (for Google, via your Google Account security settings).

Audora's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6.2 New-Music Alerts on Artist Pages

If you leave your email address on an artist's Audora page, we store it only to send you that artist's release news, and only after you confirm the address by clicking the link we email you (double opt-in). The address belongs to that artist's own alert list — it is not added to Audora's newsletter or used for anything else.

Every alert email carries an unsubscribe link that takes effect on the first click. Sign-ups that are never confirmed are deleted automatically after 14 days, and addresses that have unsubscribed are deleted two years after the opt-out.

7. Retention Periods

Personal data is retained only as long as necessary:

• Account data: for the duration of the account and legal retention periods
• Financial data: as required by accounting and tax law
• Anti-fraud and verification data: retained only while necessary
• Consent records: retained for 7 years, then anonymized automatically
• Product-usage records: daily readiness records for 180 days; in-app usage events for 90 days; aggregate totals that identify nobody for 3 years
• Error reports: 180 days
• Promotion learning signals: 12 months
• Artist-page alert sign-ups: unconfirmed sign-ups are deleted after 14 days; unsubscribed addresses are deleted 2 years after the opt-out
• Inactive accounts: data may be anonymized or deleted after statutory periods

Audora operates automated data retention processes that periodically purge expired data, anonymize old consent records, and execute approved account deletion requests in compliance with applicable retention obligations.

8. Your Rights Under GDPR

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request erasure ("right to be forgotten"), where applicable
• Object to processing based on legitimate interest
• Request restriction of processing
• Data portability
• Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal
• Lodge a complaint with a supervisory authority

9. California & International Privacy Rights

Although Audora is based in Sweden and primarily governed by EU GDPR, we extend certain privacy rights to all users regardless of location.

9.1 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• The right to know what personal information we collect, use, and disclose
• The right to delete your personal information
• The right to opt out of the "sale" or "sharing" of personal information
• The right to non-discrimination for exercising your privacy rights

Audora does not sell your personal data. For more information and to manage your preferences, visit our Do Not Sell or Share My Personal Information page.

9.2 Global Privacy Control (GPC)

Audora honors the Global Privacy Control (GPC) signal. When your browser sends a GPC signal, we automatically disable non-essential analytics cookies and treat the signal as a valid opt-out request under applicable laws including CCPA/CPRA and GDPR.

9.3 Other Jurisdictions

We aim to comply with applicable data protection laws worldwide, including the UK GDPR, Brazil's LGPD, and Canada's PIPEDA. If you have jurisdiction-specific questions, contact support@audora.music.

10. Content Reporting

In accordance with the EU Digital Services Act (DSA), Audora provides a mechanism for reporting potentially illegal or infringing content. You may submit a report through our Content Takedown Request form. Reports are reviewed and actioned in compliance with DSA Article 16 requirements.

11. Security

Audora implements appropriate technical and organizational measures to protect personal data, including:

• Encrypted data transmission
• Access controls
• Secure infrastructure
• Limited internal access on a need-to-know basis

12. Changes to This Policy

Audora may update this Privacy Policy to reflect changes in legal requirements or service functionality. Material changes will be communicated via the platform or email.

13. Language

This Privacy Policy is written in English. Any translated version is provided for convenience only. In case of conflict, the English version shall prevail.