Privacy Policy

How HYPERPULSE GROUP LTD, the company operating Spilix, collects, uses, shares, and protects your personal data.

1. Who We Are and Scope

Spilix (spilix.co) is operated by HYPERPULSE GROUP LTD, a private limited company incorporated in England and Wales (company number 17573941) ("Spilix", "we"). We are the data controller responsible for the personal data described in this Policy.

This Policy applies to the Spilix website, dashboard, and related services, and should be read together with our Terms of Service and Cookie Policy. If you sign up on behalf of a label or company, it also covers the personal data you give us about your artists and contributors — you are responsible for having the right to share that data with us.

2. Information We Collect

Information you give us:

• Account: email, name, username, password (stored only as a bcrypt hash), country, preferred language, and your confirmation that you are at least 18 years old.

• Sign-in security: if you enable them, passkey public keys (WebAuthn) and the secret used to generate multi-factor authentication codes. Biometric data never leaves your device and is never sent to Spilix.

• Artist and label profile: stage name, bio, avatar, social links, and identifiers such as Spotify ID, Apple Music ID, and IPI/CAE.

• Content: master recordings, cover art, metadata, lyrics, songwriter splits, and contributor details.

• Billing: the payment method type and your transaction history. Card details are entered directly in the Payment Partner's checkout (Link by Stripe, or Dodo Payments) and tokenized there — Spilix never receives or stores full card numbers.

• Payout details: beneficiary name, address, bank account number or IBAN, SWIFT/BIC, and the other bank details needed to pay your royalties.

• Agreement records: when you accept our Terms, we record your name, email, IP address, device, the time, and the version accepted, and generate a PDF Agreement Record that Spilix digitally signs (possibly after the time of acceptance).

• Tax details: tax identification number and proof of tax residence, only where the law or a DSP requires it (Terms, Section 22).

• Support: the messages you send us and any contact details you include.

Information collected automatically:

• Usage and device data: IP address and the approximate country derived from it, browser and operating system, pages visited, dashboard actions, and access timestamps.

• Analytics data through Google Analytics, and ad click and conversion data through Google Ads and Meta, only if you choose "Accept all" in the cookie notice (see Section 9), except that each paid purchase is reported to Meta whatever your choice (see Section 3).

Information from third parties: delivery, streaming, and payment status from DSPs and from our payment and payout providers; public catalog data (for example artist and track statistics) from music data providers.

3. How We Use Information and Legal Bases

We process your personal data for the purposes below. Where the GDPR or a similar law applies, the legal basis is shown in brackets.

• Provide the service — create your account, distribute your releases, show analytics, and collect and pay your royalties [performance of a contract].

• Process payments and payouts through our providers, and keep the financial records the law requires [contract; legal obligation].

• Keep records of the agreements you accept and countersign them digitally [contract; legal obligation].

• Send transactional emails — release status, payout statements, security alerts, and support replies [contract].

• Send marketing emails about Spilix products, features and offers to users who registered an account and accepted the Terms (Section 2); every such email includes an unsubscribe link, and you can turn them off in your account settings [consent; legitimate interest in existing customers].

• Keep the service secure — session management, fraud prevention, abuse detection, and the geographic availability check based on your IP address described in Section 16 of the Terms [legitimate interests; legal obligation].

• Understand how the site is used and improve it, using Google Analytics only if you accept analytics cookies [consent].

• Measure which of our Google Ads and Meta ads lead to sign-ups and purchases, and show Spilix ads to people who have visited our site, using Google Ads and Meta only if you accept advertising cookies — apart from the purchase report to Meta described next [consent].

• Report each paid purchase to Meta, whatever your cookie choice, so we can measure which of our Meta ads lead to purchases and Meta can optimise the delivery of Spilix ads: our server sends the product and amount, your email address and account number in hashed form, and the IP address and browser details of the checkout request — no cookies are set or read for this; you can object to it at any time by emailing privacy@spilix.co (Section 8) [legitimate interests].

• Check copyright and prevent content fraud, by generating an audio fingerprint of the recordings you upload and matching it against the ACRCloud music recognition database to detect matches with recordings owned by others [contract; legitimate interests].

• Comply with tax, accounting, anti-money-laundering, and other legal obligations, and respond to lawful requests from authorities [legal obligation].

We do not make automated decisions that have legal or similarly significant effects on you. The geographic availability check is automated, but it only determines whether Spilix is offered in your country.

4. Who We Share Information With

We share personal data only with the parties below, and only the data each one needs:

• Digital service providers (Spotify, Apple Music, YouTube, Zing MP3, JOOX, Boomplay, and the other stores you select): release metadata, audio, cover art, and the artist details required for distribution.

• Performing and mechanical rights organizations (BMI, ASCAP, GEMA, VCPMC, and others): work information and songwriter splits, if you subscribe to Publishing Admin.

• Stripe and Link (payment processor and Merchant of Record): checkout, subscription, billing address and tax data. Card data goes directly to Stripe and is never seen by Spilix. Link may contact you about your purchase and lets you manage it at link.com; a deletion request made to Link also cancels subscriptions bought through it.

• Dodo Payments (payment processor and Merchant of Record for purchases made through its checkout): checkout and subscription data. Card data goes directly to Dodo and is never seen by Spilix.

• Airwallex (payout provider): beneficiary name, address, and bank details, so that your royalty payouts can be sent.

• Amazon Web Services: database (Aurora PostgreSQL), file storage (S3), content delivery (CloudFront), transactional email (SES), and the key that applies our digital signature to agreement records (KMS, which receives only a fingerprint of the document, never its content).

• ACRCloud (audio recognition): the audio file or audio fingerprint of the recordings you upload, with basic release metadata (title, artist name), to check copyright before distribution. ACRCloud does not receive your account, contact or payment details.

• Google: Google Analytics and Google Ads, only if you choose "Accept all" in the cookie notice. See the Cookie Policy.

• Meta: Meta Pixel and Meta Conversions API. The Pixel, advertising cookies, and sign-up and checkout-start events are used only if you choose "Accept all" in the cookie notice, and include your email address in hashed form, IP address and browser details. For every paid purchase, whatever your cookie choice, our server sends Meta the product and amount, your email address and account number in hashed form, and the IP address and browser details of the checkout request (see Section 3). See the Cookie Policy.

• Music data providers (Soundcharts): we look up public artist and track identifiers to show streaming trends. No account data is sent.

• Internal tooling: operational alerts sent to our team through Discord may include account identifiers and invoice references.

• Authorities, advisers, and successors: when required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets (in which case you will be notified).

Spilix does not sell your personal data and does not share it with third parties for their own marketing.

5. International Transfers

Spilix is operated by HYPERPULSE GROUP LTD, a company incorporated in the United Kingdom. Our infrastructure runs on Amazon Web Services in the United States and in Sydney, Australia. The providers listed in Section 4 may process data in other countries, including the countries in which Stripe, Dodo Payments, Airwallex, ACRCloud, Google, and Meta operate.

When we transfer personal data out of the EEA, the United Kingdom, or Switzerland, we rely on adequacy decisions where available and otherwise on Standard Contractual Clauses or the UK Addendum, together with encryption and access controls.

6. Storage and Security

Data is stored on AWS with encryption at rest and TLS encryption in transit. Passwords are stored only as bcrypt hashes. Audio and image files are stored on S3 with server-side encryption and delivered through CloudFront. Sessions use HttpOnly, Secure cookies, and you can add passkeys and multi-factor authentication to your account.

Access to production data is limited to staff who need it for their role. No system is completely secure and we cannot guarantee absolute security, but we apply these safeguards to protect your data from unauthorized access, loss, or alteration.

7. Data Retention

We keep personal data only for as long as it is needed for the purposes in Section 3. In practice:

• Account, profile, and content data: for as long as your account exists. Distribution is a continuing relationship — your releases stay on DSPs, royalties keep arriving, and we must be able to match them to you — so we do not delete this data on a fixed schedule while your catalog is live or royalties are still owed to you.

• Financial records (invoices, payments, payout statements, and agreement records): for the period required by applicable accounting and tax law, generally up to ten years, even after your account is closed.

• Security and access logs: for the limited period needed for fraud prevention and incident investigation.

• Checkout IP address and browser details kept for reporting a purchase to Meta: up to 8 days after the checkout starts.

When you close your account and ask us to delete your data, we delete or anonymise the personal data we no longer need once your releases have been taken down and any outstanding royalties have been paid. We keep only the records the law requires us to keep, as described above. See Section 8 for how to make a request.

8. Your Rights

Depending on where you live, you have the rights below over your personal data. We honour them for all users regardless of location, subject to the legal limits described in this Policy.

• Access: obtain a copy of the personal data we hold about you.

• Rectification: correct inaccurate or incomplete data. Most account and profile data can be edited directly in your dashboard.

• Erasure: ask us to delete your account and personal data. Releases already delivered may remain on DSPs under your artist name according to the distribution agreements, and we keep the records the law requires (Section 7).

• Restriction and objection: ask us to limit certain processing, or object to processing based on our legitimate interests.

• Portability: receive your account data in a structured, machine-readable format (JSON or CSV), prepared on request.

• Withdraw consent: at any time, for processing based on consent — for example by clearing this site's data in your browser so that the cookie notice appears again, or by using the unsubscribe link in a marketing email.

• Complain: lodge a complaint with your data protection authority. In the United Kingdom this is the Information Commissioner's Office (ICO), with which Spilix is registered; in the EEA, your national supervisory authority.

• California residents (CCPA/CPRA): the rights to know, delete, and correct personal data, to opt out of its sale or sharing (we do not sell it; the purchase report to Meta described in Section 3 may count as "sharing" for cross-context behavioural advertising, and you can opt out of it by emailing privacy@spilix.co), and not to be discriminated against for exercising these rights.

To exercise any right, email privacy@spilix.co from the address on your account. We may ask you to verify your identity. We respond within 30 days, or sooner where the law requires a shorter period, and we will tell you if a complex request needs more time.

9. Cookies, Analytics and Advertising

Spilix sets essential cookies only to run sign-in: spilix_session keeps you signed in, and spilix_trusted lets a device where you ticked "Remember me" skip the login verification code for 30 days. With your consent, we also use Google Analytics 4, which sets analytics cookies and sends usage data — pages viewed, events such as sign-ups and purchases, device and browser information, and a truncated IP address — to Google, and Google Ads and the Meta Pixel, which set advertising cookies that record whether you reached Spilix from one of our ads on Google, Facebook, or Instagram, so we can measure which ads lead to sign-ups and purchases and show Spilix ads to people who visited the site. None of these are loaded until you choose "Accept all" in the cookie notice. To change your choice later, clear this site's cookies and site data in your browser settings: the cookie notice will appear again on your next visit.

We do not sell your personal data. Full details — cookie names, purposes, durations, and the browser storage we use — are in our Cookie Policy.

10. Children

You must be at least 18 to use Spilix, as set out in the Terms. We do not knowingly collect personal data from anyone under 18. If you believe an under-age person has registered, contact privacy@spilix.co and we will delete the account.

11. Data Breaches

If a personal data breach is likely to put your rights at risk, we will notify you and the competent authority without undue delay and within the timeframes required by applicable law, and tell you what we are doing about it.

12. Changes to This Policy

We may update this Policy from time to time. For material changes — new purposes, new categories of third parties, or reduced rights — we will notify you by email and by an in-app notice at least 30 days before they take effect. Minor changes take effect when posted, with the "Last updated" date revised.

13. Contact

For questions about this Policy or to exercise your rights, contact privacy@spilix.co.

Data controller: HYPERPULSE GROUP LTD, a private limited company incorporated in England and Wales. Company number: 17573941. Registered office: 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF, United Kingdom. Registered with the UK Information Commissioner's Office (ICO), registration number 00016310751.