Privacy Policy

How HYPERPULSE GROUP LTD, the company wey dey run Spilix, dey collect, use, share, and protect your personal data.

1. Who We Are and Scope

Na HYPERPULSE GROUP LTD dey run Spilix (spilix.co), a private limited company wey dem register for England and Wales (company number 17573941) ("Spilix", "we"). We na the data controller wey responsible for the personal data wey this Policy describe.

This Policy dey apply to the Spilix website, dashboard, and related service, and you suppose read am together with our Terms of Service and Cookie Policy. If you sign up on behalf of label or company, e also dey cover the personal data wey you give us about your artist and contributor — na you responsible to get the right to share that data with us.

2. Information We Collect

Information wey you give us:

• Account: email, name, username, password (dem dey store am only as bcrypt hash), country, preferred language, and your confirmation say you don reach at least 18 years old.

• Sign-in security: if you enable dem, passkey public key (WebAuthn) and the secret wey dem dey use generate multi-factor authentication code. Biometric data no dey ever comot your device and dem no dey ever send am to Spilix.

• Artist and label profile: stage name, bio, avatar, social link, and identifier like Spotify ID, Apple Music ID, and IPI/CAE.

• Content: master recording, cover art, metadata, lyrics, songwriter split, and contributor details.

• Billing: the payment method type and your transaction history. You dey enter card details directly for the Payment Partner checkout (Link by Stripe, or Dodo Payments) and dem dey tokenize am there — Spilix no dey ever receive or store full card number.

• Payout details: beneficiary name, address, bank account number or IBAN, SWIFT/BIC, and the other bank details wey dem need to pay your royalty.

• Agreement record: when you accept our Terms, we dey record your name, email, IP address, device, the time, and the version wey you accept, and we dey generate PDF Agreement Record wey Spilix dey digitally sign (e fit be after the time of acceptance).

• Tax details: tax identification number and proof of tax residence, only where law or DSP require am (Terms, Section 22).

• Support: the message wey you send us and any contact details wey you include.

Information wey dem dey collect automatically:

• Usage and device data: IP address and the approximate country wey dem derive from am, browser and operating system, page wey you visit, dashboard action, and access timestamp.

• Analytics data through Google Analytics, and ad click and conversion data through Google Ads and Meta, only if you choose "Accept all" for the cookie notice (see Section 9), except say dem dey report each paid purchase to Meta whatever your choice be (see Section 3).

Information from third party: delivery, streaming, and payment status from DSP and from our payment and payout provider; public catalog data (for example artist and track statistics) from music data provider.

3. How We Use Information and Legal Bases

We dey process your personal data for the purpose wey dey for down. Where GDPR or similar law apply, we dey show the legal basis for bracket.

• Provide the service — create your account, distribute your release, show analytics, and collect and pay your royalty [performance of contract].

• Process payment and payout through our provider, and keep the financial record wey law require [contract; legal obligation].

• Keep record of the agreement wey you accept and countersign dem digitally [contract; legal obligation].

• Send transactional email — release status, payout statement, security alert, and support reply [contract].

• Send marketing email about Spilix product, feature and offer to user wey register account come accept the Terms (Section 2); every such email get unsubscribe link, and you fit off dem for your account settings [consent; legitimate interest for existing customer].

• Keep the service secure — session management, fraud prevention, abuse detection, and the geographic availability check wey dey based on your IP address wey Section 16 of the Terms describe [legitimate interest; legal obligation].

• Understand how people dey use the site come improve am, dey use Google Analytics only if you accept analytics cookie [consent].

• Measure which of our Google Ads and Meta ad dey lead to sign-up and purchase, and show Spilix ad to people wey don visit our site, dey use Google Ads and Meta only if you accept advertising cookie — apart from the purchase report to Meta wey we describe next [consent].

• Report each paid purchase to Meta, whatever your cookie choice be, so we fit measure which of our Meta ad dey lead to purchase and Meta fit optimise the delivery of Spilix ad: our server dey send the product and amount, your email address and account number for hashed form, and the IP address and browser details of the checkout request — dem no dey set or read any cookie for this; you fit object to am anytime when you email privacy@spilix.co (Section 8) [legitimate interest].

• Check copyright come prevent content fraud, by generating audio fingerprint of the recording wey you upload come match am against the ACRCloud music recognition database to detect match with recording wey another person own [contract; legitimate interest].

• Comply with tax, accounting, anti-money-laundering, and other legal obligation, and respond to lawful request from authority [legal obligation].

We no dey make automated decision wey get legal or similar significant effect on you. The geographic availability check na automated, but e dey only determine whether dem dey offer Spilix for your country.

4. Who We Share Information With

We dey share personal data only with the party wey dey for down, and only the data wey each one need:

• Digital service provider (Spotify, Apple Music, YouTube, Zing MP3, JOOX, Boomplay, and the other store wey you select): release metadata, audio, cover art, and the artist details wey dem need for distribution.

• Performing and mechanical rights organization (BMI, ASCAP, GEMA, VCPMC, and others): work information and songwriter split, if you subscribe to Publishing Admin.

• Stripe and Link (payment processor and Merchant of Record): checkout, subscription, billing address and tax data. Card data dey go directly to Stripe and Spilix no dey ever see am. Link fit contact you about your purchase and e dey let you manage am for link.com; deletion request wey you make to Link go also cancel subscription wey you buy through am.

• Dodo Payments (payment processor and Merchant of Record for purchase wey you make through im checkout): checkout and subscription data. Card data dey go directly to Dodo and Spilix no dey ever see am.

• Airwallex (payout provider): beneficiary name, address, and bank details, so dem fit send your royalty payout.

• Amazon Web Services: database (Aurora PostgreSQL), file storage (S3), content delivery (CloudFront), transactional email (SES), and the key wey dey apply our digital signature to agreement record (KMS, wey dey receive only fingerprint of the document, never im content).

• ACRCloud (audio recognition): the audio file or audio fingerprint of the recording wey you upload, with basic release metadata (title, artist name), to check copyright before distribution. ACRCloud no dey receive your account, contact or payment details.

• Google: Google Analytics and Google Ads, only if you choose "Accept all" for the cookie notice. See the Cookie Policy.

• Meta: Meta Pixel and Meta Conversions API. The Pixel, advertising cookie, and sign-up and checkout-start event, dem dey use am only if you choose "Accept all" for the cookie notice, and e dey include your email address for hashed form, IP address and browser details. For every paid purchase, whatever your cookie choice be, our server dey send Meta the product and amount, your email address and account number for hashed form, and the IP address and browser details of the checkout request (see Section 3). See the Cookie Policy.

• Music data provider (Soundcharts): we dey look up public artist and track identifier to show streaming trend. Dem no dey send any account data.

• Internal tooling: operational alert wey dem send to our team through Discord fit include account identifier and invoice reference.

• Authority, adviser, and successor: when law require am, to protect our right, or in connection with merger, acquisition, or sale of asset (for that case dem go notify you).

Spilix no dey sell your personal data and no dey share am with third party for their own marketing.

5. International Transfers

Na HYPERPULSE GROUP LTD, a company wey dem register for the United Kingdom, dey run Spilix. Our infrastructure dey run on Amazon Web Services for the United States and for Sydney, Australia. The provider wey dem list for Section 4 fit process data for other country, including the country wey Stripe, Dodo Payments, Airwallex, ACRCloud, Google, and Meta dey operate.

When we dey transfer personal data comot the EEA, the United Kingdom, or Switzerland, we dey rely on adequacy decision where e dey available and if not, on Standard Contractual Clauses or the UK Addendum, together with encryption and access control.

6. Storage and Security

Dem dey store data on AWS with encryption at rest and TLS encryption in transit. Dem dey store password only as bcrypt hash. Dem dey store audio and image file on S3 with server-side encryption and deliver am through CloudFront. Session dey use HttpOnly, Secure cookie, and you fit add passkey and multi-factor authentication to your account.

Access to production data dey limited to staff wey need am for their role. No system dey completely secure and we no fit guarantee absolute security, but we dey apply these safeguard to protect your data from unauthorized access, loss, or alteration.

7. Data Retention

We dey keep personal data only for as long as e dey needed for the purpose for Section 3. For practice:

• Account, profile, and content data: for as long as your account dey exist. Distribution na relationship wey dey continue — your release dey stay for DSP, royalty dey keep enter, and we must fit match dem to you — so we no dey delete this data on fixed schedule while your catalog dey live or dem still dey owe you royalty.

• Financial record (invoice, payment, payout statement, and agreement record): for the period wey applicable accounting and tax law require, generally up to ten years, even after dem close your account.

• Security and access log: for the limited period wey dem need for fraud prevention and incident investigation.

• Checkout IP address and browser details wey dem keep to report purchase to Meta: up to 8 days after the checkout start.

When you close your account come ask us to delete your data, we dey delete or anonymise the personal data wey we no need again once dem don take down your release and dem don pay any outstanding royalty. We dey keep only the record wey the law require us to keep, as we describe for up. See Section 8 for how to make request.

8. Your Rights

Depending on where you dey live, you get the right wey dey for down over your personal data. We dey honour dem for all user no matter the location, subject to the legal limit wey this Policy describe.

• Access: get copy of the personal data wey we hold about you.

• Rectification: correct data wey no correct or wey no complete. Most account and profile data, you fit edit am directly for your dashboard.

• Erasure: ask us to delete your account and personal data. Release wey dem don deliver already fit remain for DSP under your artist name according to the distribution agreement, and we dey keep the record wey the law require (Section 7).

• Restriction and objection: ask us to limit certain processing, or object to processing wey dey based on our legitimate interest.

• Portability: receive your account data for structured, machine-readable format (JSON or CSV), wey we dey prepare on request.

• Withdraw consent: anytime, for processing wey dey based on consent — for example when you clear this site data for your browser so the cookie notice go show again, or when you use the unsubscribe link for marketing email.

• Complain: lodge complaint with your data protection authority. For the United Kingdom na the Information Commissioner's Office (ICO), wey Spilix register with; for the EEA, na your national supervisory authority.

• California resident (CCPA/CPRA): the right to know, delete, and correct personal data, to opt out of im sale or sharing (we no dey sell am; the purchase report to Meta wey Section 3 describe fit count as "sharing" for cross-context behavioural advertising, and you fit opt out of am when you email privacy@spilix.co), and say dem no go discriminate against you because you exercise these right.

To exercise any right, email privacy@spilix.co from the address wey dey your account. We fit ask you to verify your identity. We dey respond within 30 days, or sooner where the law require shorter period, and we go tell you if complex request need more time.

9. Cookies, Analytics and Advertising

Spilix dey set essential cookie only to run sign-in: spilix_session dey keep you signed in, and spilix_trusted dey allow device where you tick "Remember me" skip the login verification code for 30 days. With your consent, we also dey use Google Analytics 4, wey dey set analytics cookie and send usage data — page wey you view, event like sign-up and purchase, device and browser information, and truncated IP address — to Google, and Google Ads and the Meta Pixel, wey dey set advertising cookie wey dey record whether you reach Spilix from one of our ad on Google, Facebook, or Instagram, so we fit measure which ad dey lead to sign-up and purchase come show Spilix ad to people wey visit the site. None of these dey load until you choose "Accept all" for the cookie notice. To change your choice later, clear this site cookie and site data for your browser settings: the cookie notice go show again on your next visit.

We no dey sell your personal data. Full details — cookie name, purpose, duration, and the browser storage wey we dey use — dey inside our Cookie Policy.

10. Children

You must be at least 18 to use Spilix, as the Terms set am out. We no dey knowingly collect personal data from anybody wey never reach 18. If you believe say under-age person don register, contact privacy@spilix.co and we go delete the account.

11. Data Breaches

If personal data breach fit put your right for risk, we go notify you and the competent authority without undue delay and within the timeframe wey applicable law require, come tell you wetin we dey do about am.

12. Changes to This Policy

We fit update this Policy from time to time. For material change — new purpose, new category of third party, or reduced right — we go notify you by email and by in-app notice at least 30 days before dem take effect. Minor change dey take effect when we post am, with the "Last updated" date wey we revise.

13. Contact

For question about this Policy or to exercise your right, contact privacy@spilix.co.

Data controller: HYPERPULSE GROUP LTD, a private limited company wey dem register for England and Wales. Company number: 17573941. Registered office: 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF, United Kingdom. E don register with the UK Information Commissioner's Office (ICO), registration number 00016310751.