Privacy Policy

1 Introduction

This Privacy Policy describes the privacy practices of Compozly, LLC ("Compozly," "we," "us," or "our"), a Delaware limited liability company. We operate the Compozly platform (a marketplace, portfolio builder, storefront, and discovery engine connecting human music Composers with Creators) accessible at compozly.com and its subdomains (collectively, the "Platform").

This Policy applies to all personal information we collect through the Platform, including when you register for an account, upload music, purchase a license, commission a custom composition, or simply browse our website. By using the Platform, you agree to the collection and use of information as described in this Policy.

This Policy should be read alongside our Terms of Service, which govern your use of the Platform. Capitalized terms used but not defined here have the meanings given in the Terms of Service.

Quick Summary. We collect the information needed to run the Platform, connect Composers with Creators, and process payments. We do not sell your personal information. We use third-party analytics and advertising tools (listed in Section 4) that require your consent in certain jurisdictions. You have rights to access, correct, and delete your data, described in Sections 6-9.

2 Information We Collect

2.1 Information You Provide Directly

• Account registration: Name, email address, username, password. If you use Google Sign-In, we receive your name, email, and profile photo from Google.
• Composer profile: Biography, location, genres, professional credits, profile photo, audio tracks, track metadata (titles, descriptions, tags, BPM, instruments, moods), portfolio links, and any other information you choose to include on your public profile.
• Creator profile: Name, email, and any project brief information you submit when posting a project or initiating a Custom Commission.
• Payment and financial information: When you subscribe to a paid plan or purchase a license, payment is processed by Stripe, Inc. Compozly does not store your full payment card details. We receive transaction confirmation, the last four digits of your card, billing name, and billing address from Stripe. Composers who receive earnings must connect a Stripe account; Stripe collects banking and identity verification information directly.
• Tax information: Where required by law, we may collect your tax identification number (e.g., SSN, EIN, or VAT number) and related documentation (W-9, W-8BEN) for tax reporting purposes.
• Communications: Messages you send to other Users via the Platform's messaging system, support requests, feedback, and any correspondence with our team.
• Custom Commission materials: Project briefs, revision notes, delivered audio files, and related project communications.

2.2 Information We Collect Automatically

When you visit or use the Platform, we and our third-party service providers automatically collect certain information:

• Device and browser information: IP address, browser type and version, operating system, device type, screen resolution, and language settings.
• Usage data: Pages visited, time spent on pages, links clicked, search queries entered, audio tracks played, features used, and navigation paths through the Platform.
• Session data: Login timestamps, session duration, and interaction patterns (including mouse movements, clicks, and scroll depth captured by session recording tools; see Section 4).
• Referral data: The URL of the website or search engine that referred you to the Platform.
• Cookies and tracking technologies: As described in detail in Section 4.

2.3 Information from Third Parties

• Google Sign-In: If you authenticate using Google OAuth, we receive your Google account name, email address, and profile photo, subject to the permissions you grant.
• Stripe: We receive payment confirmation and limited financial metadata from Stripe when you complete transactions.
• Analytics and advertising partners: Our third-party tools (listed in Section 4) may provide us with aggregated or de-identified information about Platform usage and advertising campaign performance.
• Publicly available information: We may combine information you provide with publicly available information (such as your publicly listed music credits) to maintain the accuracy of your profile.

2.4 Audio Content

Audio files uploaded to the Platform are stored on our servers and may be processed for technical purposes (e.g., waveform generation, format transcoding, streaming optimization). We do not analyze audio content for biometric identification or voice recognition. Metadata associated with audio files (titles, tags, BPM, instruments) is treated as User Content and governed by the Terms of Service.

3 How We Use Your Information

We use the personal information we collect for the following purposes:

3.1 Providing and Operating the Platform

• Creating and managing your account; authenticating your identity at login
• Displaying your Composer profile to Creators browsing the marketplace
• Facilitating transactions, including processing subscription payments and Marketplace Track purchases through Stripe
• Calculating and remitting Composer earnings after deducting the applicable Platform Fee
• Supporting Custom Commission workflows including escrow management, messaging, and delivery
• Powering the Discovery Engine: surfacing Composer profiles to Creators based on genre, style, location, and project fit
• Enabling the embed player and providing embeddable audio to third-party sites

3.2 Communications

• Sending transactional emails: account confirmations, payment receipts, project updates, and security alerts. These are sent regardless of your marketing preferences.
• Sending marketing and promotional emails, including newsletters, product announcements, and special offers, subject to your opt-in preferences and applicable law. You may opt out at any time.
• Responding to support requests and inquiries.

3.3 Improving the Platform

• Analyzing usage patterns and product metrics to understand how the Platform is used and where improvements can be made
• Conducting A/B testing, usability research, and feature development
• Diagnosing technical issues and monitoring Platform performance

3.4 Personalization

• Recommending Composers or tracks based on browsing and listening behavior
• Displaying relevant content and features based on your account type (Composer vs. Creator) and subscription tier

3.5 Advertising

• Displaying targeted advertisements on third-party platforms (e.g., Meta, Google) to users who have visited Compozly, based on cookie and pixel data, subject to your consent preferences
• Measuring the effectiveness of our advertising campaigns

3.6 Legal Compliance and Safety

• Complying with applicable laws, regulations, and legal processes (including subpoenas, court orders, and law enforcement requests)
• Enforcing the Terms of Service and this Privacy Policy
• Detecting and preventing fraud, abuse, spam, and unauthorized access
• Protecting the rights, safety, and property of Compozly, our users, and the public

3.7 Lawful Bases (GDPR)

For users in the European Economic Area, our processing of personal data rests on the following lawful bases under GDPR Article 6:

• Contract performance: operating the Platform, processing payments, managing accounts
• Legitimate interests: improving services, detecting fraud, sending transactional communications, conducting analytics
• Legal obligation: tax reporting, law enforcement compliance, DMCA obligations
• Consent: marketing emails, non-essential cookies (analytics, advertising, session recording)

4 Cookies & Tracking Technologies

We use cookies, pixels, and similar tracking technologies to operate the Platform, analyze usage, and deliver targeted advertising. This section describes each tool in use, its category, and its purpose.

4.1 Cookie Categories

• Essential cookies: Strictly necessary to operate the Platform. These cannot be disabled. They support login sessions, security tokens, and core functionality.
• Analytics cookies: Help us understand how visitors use the Platform: which pages are visited, where traffic comes from, and how features are used. Requires your consent in the EU and certain US states.
• Marketing / advertising cookies: Used to deliver relevant advertisements on third-party platforms and to measure ad performance. Requires your consent in the EU and California.
• Session recording cookies: Capture mouse movements, clicks, and page interactions to help us improve usability. Considered sensitive under GDPR. Requires your consent.

4.2 Third-Party Tracking Tools in Use

4.3 Managing Cookies

You may control cookies through the following mechanisms:

• Consent banner: Use the "Manage Cookie Preferences" option presented on your first visit and available in the site footer to accept or reject individual cookie categories.
• Browser settings: Most browsers allow you to block or delete cookies. Note that blocking essential cookies may prevent the Platform from functioning correctly.
• Opt-out tools: You may opt out of Google Analytics data collection at tools.google.com/dlpage/gaoptout. You may opt out of Meta advertising targeting at facebook.com/adpreferences. You may opt out of Hotjar at hotjar.com/legal/compliance/opt-out.
• Do Not Track / Global Privacy Control: We honor the Global Privacy Control (GPC) signal. If your browser transmits a GPC signal, we will treat it as a request to opt out of the sale or sharing of personal data. We do not currently respond to browser-level Do Not Track (DNT) signals, which lack a uniform standard.

5 How We Share Your Information

We do not sell your personal information. We share information only as described below.

5.1 Public Profile Information

Composer profiles are publicly visible on the Platform by default. This includes your display name, biography, location, genre tags, professional credits, and uploaded audio tracks. You control the content of your profile. Creators browsing the Platform or accessing a profile link will see this information.

5.2 Between Composers and Creators

When a Creator initiates a Custom Commission or contacts a Composer through the Platform, certain information is shared between the parties as necessary to complete the project, including project briefs, contact details shared via the Platform's messaging system, and delivered audio files. This sharing is governed by the Project Agreement and the Terms of Service.

5.3 Service Providers and Sub-processors

We share personal information with third-party companies that perform services on our behalf. These service providers are contractually obligated to process your information only as directed by Compozly and in accordance with this Policy. Our key service providers include:

• Stripe, Inc.: Payment processing, Stripe Connect for Composer payouts, and tax documentation collection
• Google LLC: Analytics (Google Analytics 4), tag management (Google Tag Manager), and user authentication (Google Sign-In / OAuth 2.0)
• Meta Platforms, Inc.: Advertising and retargeting (Meta Pixel)
• Hotjar Ltd.: Session recording and heatmaps
• Mixpanel, Inc.: Product analytics
• Mautic (self-hosted): Email marketing and lifecycle communications (operated by Compozly on our own infrastructure)
• Web hosting provider: Cloud infrastructure and content delivery

5.4 Advertising Partners

We share certain information with advertising platforms (including Meta) to run targeted advertising campaigns. This may include hashed email addresses and behavioral data derived from cookies with your consent. This constitutes "sharing" personal data under California's CPRA. See Section 7 for your opt-out rights.

5.5 Professional Advisors

We may share your information with lawyers, accountants, auditors, and insurers as necessary in connection with professional services they provide to Compozly.

5.6 Legal Compliance and Safety

We may disclose personal information to government authorities, law enforcement, or other third parties when we believe in good faith that disclosure is required or permitted by law, including to comply with subpoenas, court orders, and lawful regulatory requests; to enforce our Terms of Service; to protect the rights, safety, and property of Compozly or others; or to report suspected crimes involving minors to the National Center for Missing and Exploited Children (NCMEC).

5.7 Business Transfers

If Compozly is involved in a merger, acquisition, asset sale, bankruptcy, or corporate reorganization, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Platform before your information is transferred and becomes subject to a different privacy policy, and we will use reasonable efforts to require the acquiring entity to honor this Policy.

5.8 DMCA Notices

If you submit a DMCA takedown notice, we may share that notice with the User who uploaded the allegedly infringing content. If that User submits a counter-notice, we may share the counter-notice with you. This is required by the DMCA process.

5.9 Aggregated and De-identified Data

We may share aggregated, anonymized, or de-identified information (which cannot reasonably be used to identify you) publicly or with third parties for any lawful purpose, including research, marketing, and industry reporting.

6 Your Privacy Rights (All Users)

Regardless of where you are located, you have the following rights with respect to your personal information on Compozly:

• Access and correction: You may review and update your account information at any time through your account settings. If you need help correcting information we hold that you cannot update yourself, contact us at legal@compozly.com.
• Account deletion: You may close your account through your account settings or by contacting us. Account closure will result in deletion of your profile, uploaded tracks, and associated data, subject to the retention exceptions in Section 12.
• Marketing opt-out: You may opt out of marketing emails at any time by clicking the unsubscribe link in any marketing email or adjusting your email preferences in account settings. You will continue to receive transactional and service-related emails.
• Cookie preferences: You may manage cookie consent settings as described in Section 4.3.
• Data portability: Upon request, we will provide you with a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format where technically feasible.

To exercise any of these rights, contact us at legal@compozly.com or through the Help Center. We will verify your identity before processing your request and will respond within thirty (30) days.

7 California Residents (CCPA / CPRA)

This section applies to residents of California and supplements the rest of this Policy. It is provided pursuant to the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), effective January 1, 2023.

7.1 Categories of Personal Information Collected

In the past twelve months, Compozly has collected the following categories of personal information:

• Identifiers (name, email address, IP address, account username)
• Commercial information (transaction history, subscription plan, licensing purchases)
• Internet or electronic network activity (browsing behavior, Platform usage, session recordings)
• Audio and visual information (uploaded music tracks, profile photos)
• Professional or employment-related information (music credits, career information on Composer profiles)
• Financial information (payment method details, earnings data, processed via Stripe)
• Inferences drawn from personal information (interest-based ad profiles created with Meta Pixel)

7.2 Your CCPA / CPRA Rights

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, our business purpose, and the third parties with whom we have shared it.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain legal exceptions (e.g., completing transactions, complying with legal obligations, preventing fraud).
• Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Portability: You have the right to receive a copy of your personal information in a portable, usable format.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit Compozly's use of sensitive personal information (such as financial data and precise geolocation) to what is necessary to provide the requested services.
• Right to Non-Discrimination: Compozly will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you services, charge different prices, or provide a different quality of service because you exercised a privacy right.

7.3 Do Not Sell or Share My Personal Information

To opt out of the sharing of your personal information with Meta for advertising purposes, you may:

• Click the "Do Not Sell or Share My Personal Information" link in the website footer;
• Use the cookie preference center to disable Marketing cookies; or
• Submit a request to legal@compozly.com with the subject line "CPRA Opt-Out Request."

We will process your opt-out request within fifteen (15) business days. We will not re-enroll you in sharing without your explicit consent.

7.4 Authorized Agents

California residents may designate an authorized agent to submit privacy rights requests on their behalf. The agent must provide written proof of authorization. We may still require you to directly verify your identity before processing the request.

7.5 Exercising Your California Rights

Submit requests to legal@compozly.com or via the Help Center. We will verify your identity using the email address associated with your account. We will respond within forty-five (45) days, with one possible thirty (30) day extension with notice.

7.6 California Shine the Light

Under California's "Shine the Light" law (Civil Code § 1798.83), California residents may request information about disclosures of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes without your consent.

8 EU / EEA Residents (GDPR)

This section applies to individuals located in the European Economic Area (EEA), United Kingdom, and Switzerland and is provided pursuant to the General Data Protection Regulation (GDPR) and applicable national data protection laws.

8.1 Data Controller

Compozly, LLC is the data controller for personal information processed through the Platform. Contact details are provided in Section 17.

8.2 Your GDPR Rights

You have the following rights under the GDPR:

• Right of access (Article 15): Request a copy of the personal data we hold about you.
• Right to rectification (Article 16): Request correction of inaccurate or incomplete personal data.
• Right to erasure / "right to be forgotten" (Article 17): Request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent, or where processing is unlawful.
• Right to restriction of processing (Article 18): Request that we limit how we use your data in certain circumstances.
• Right to data portability (Article 20): Receive your personal data in a structured, machine-readable format and transmit it to another controller.
• Right to object (Article 21): Object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we have compelling legitimate grounds.
• Right not to be subject to automated decision-making (Article 22): You have the right not to be subject to decisions based solely on automated processing that produce significant legal effects. The Discovery Engine uses algorithmic ranking to surface Composer profiles; this represents personalization, not a decision with significant legal effect. You may contact us to discuss your profile's placement.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at legal@compozly.com. We will respond within one (1) month of receipt. We may request proof of identity before processing your request. Requests are free of charge unless they are manifestly unfounded or excessive.

8.3 Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with your local supervisory authority. A list of EEA data protection authorities is available at edpb.europa.eu. We encourage you to contact us first so we can resolve your concern directly.

8.4 Data Protection Officer

Compozly has designated a Data Protection Officer responsible for overseeing GDPR compliance. The DPO may be contacted at legal@compozly.com with the subject line "DPO Inquiry."

9 US State Privacy Rights

Residents of states with comprehensive privacy laws, including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and others, have rights similar to those described in Section 7, including the right to access, correct, delete, and obtain a copy of personal data; the right to opt out of targeted advertising, the sale of personal data, and profiling for significant decisions; and the right to appeal a decision regarding your privacy rights request.

To exercise these rights, submit a request to legal@compozly.com. We will respond within the timeframe required by your state's applicable law and will not discriminate against you for exercising these rights.

Appeal process: If we decline your request, you have the right to appeal. Submit your appeal to legal@compozly.com with the subject line "Privacy Rights Appeal." We will review and respond within sixty (60) days. If your appeal is denied, you may contact your state's Attorney General.

Nevada Residents

Nevada residents have the right to opt out of the sale of certain covered personal information. Compozly does not sell personal information as defined under Nevada law. If this changes, we will update this Policy and provide an opt-out mechanism. You may submit a preemptive opt-out request at any time to legal@compozly.com.

10 International Data Transfers

Compozly, LLC is headquartered in the United States. If you access the Platform from outside the US, your personal information is transferred to and processed in the United States, where data protection laws may differ from those of your country.

EU/EEA/UK/Swiss Transfers. For transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland to the United States, Compozly relies on the European Commission's Standard Contractual Clauses (SCCs) (Module 1 and Module 2 as applicable, updated June 2021) as the legal mechanism for such transfers under GDPR Article 46. We have incorporated the 2021 SCCs into our data processing agreements with applicable sub-processors.

We no longer rely on the EU-U.S. Privacy Shield or Swiss-U.S. Privacy Shield frameworks, which were invalidated. We note the EU-U.S. Data Privacy Framework entered into force in July 2023; we will assess and update our transfer mechanisms as this framework develops.

You may request a copy of the relevant SCCs by contacting us at legal@compozly.com.

11 Children's Privacy

Minimum age requirement: You must be at least 13 years old to use the Platform. Users between 13 and 18 years of age may only use the Platform with the involvement and consent of a parent or legal guardian, who agrees to be bound by these Terms of Service and this Privacy Policy on the minor's behalf.

COPPA compliance. Compozly does not knowingly collect personal information from children under 13 years of age in violation of the Children's Online Privacy Protection Act (COPPA). If we learn that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will promptly delete that information.

Parental requests. If you are a parent or legal guardian and believe your child under 13 has provided personal information to Compozly without your consent, please contact us at legal@compozly.com. We will investigate and delete the information upon verification.

Minimum age in other jurisdictions. Some jurisdictions set a higher minimum age for digital services (e.g., 16 in certain EU member states). If you are in such a jurisdiction and under the locally required minimum age, please do not use the Platform without a parent or guardian's involvement.

12 Data Retention

We retain your personal information for as long as your account is active, or as needed to provide the services described in this Policy, unless a longer retention period is required or permitted by law.

• Account data: Retained for the life of your account. Upon account deletion, your profile, public listings, and uploaded content will be removed from the Platform within thirty (30) days, subject to the exceptions below.
• Transaction records: Financial records, payment history, and tax documentation are retained for a minimum of seven (7) years to comply with applicable tax and accounting laws.
• Communications and support records: Retained for up to three (3) years following your last interaction with our support team.
• Email marketing data: Retained until you opt out. Upon opt-out, your marketing preferences are recorded and you are removed from active sends, but a suppression record is maintained to honor your opt-out.
• Security and fraud logs: IP address logs and security event records may be retained for up to twelve (12) months for fraud detection and security purposes.
• Analytics data: Aggregated, de-identified analytics data may be retained indefinitely. Individual-level analytics data is subject to the retention settings of the respective tool (e.g., Google Analytics default retention periods).
• Legal hold: Where Compozly receives legal process pertaining to your account, or where we have a good-faith belief that your account was involved in wrongdoing, we may retain relevant data beyond these periods to comply with legal obligations or to assert or defend legal claims.

When data is no longer required, it is securely deleted or irreversibly anonymized.

13 Data Security

Compozly uses technical, organizational, and physical security measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction. Our security practices include:

• Encryption of personal data in transit using TLS/SSL;
• Encryption of sensitive data at rest;
• Access controls limiting employee access to personal data on a need-to-know basis;
• Regular security assessments of our Platform and infrastructure;
• Use of PCI-DSS-compliant payment processing via Stripe (we do not store raw payment card data).

Despite these measures, no information system is completely secure. We cannot guarantee the absolute security of your data. You are responsible for maintaining the confidentiality of your account credentials, using a strong unique password, and notifying us immediately at legal@compozly.com if you suspect unauthorized access to your account.

14 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Compozly will:

• Notify regulators: Report the breach to the applicable supervisory authority (including EU data protection authorities where required) within 72 hours of becoming aware of it, where feasible, in accordance with GDPR Article 33. We will also notify relevant US state authorities within the timeframe required by applicable state law.
• Notify affected individuals: Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly (without undue delay once the breach has been confirmed and its scope is understood) via email to your registered address, or via a prominent notice on the Platform if email notification is not practicable.

Our breach notifications to you will describe, in plain language: the nature of the breach; the approximate number of individuals and records affected; the likely consequences of the breach; the measures taken or proposed to address it; and contact information for further questions.

To report a potential security vulnerability or suspected breach, contact us at legal@compozly.com with the subject line "Security Issue."

15 Third-Party Services & Links

The Platform may contain links to third-party websites, embedded content, or integrations with third-party services (such as Stripe, Google, and social media platforms). This Privacy Policy applies only to Compozly's own data practices. When you leave our Platform or interact with a third-party service, that party's own privacy policy governs your information.

We encourage you to review the privacy policies of any third-party services you use in connection with Compozly, particularly:

• Stripe Privacy Policy
• Google Privacy Policy
• Meta Privacy Policy
• Hotjar Privacy Policy
• Mixpanel Privacy Policy

Compozly is not responsible for the privacy practices of third parties and has no control over how they collect, use, or share your information.

16 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Post the revised Policy on this page with an updated "Last Updated" date;
• Send an email notification to the address associated with your registered account at least thirty (30) days before the changes take effect, where the changes materially reduce your rights or protections.

Your continued use of the Platform after the effective date of the revised Policy constitutes your acceptance of the changes. If you do not agree to the updated Policy, you should stop using the Platform and may close your account.

Prior versions of this Privacy Policy are available upon request by contacting legal@compozly.com.

17 Contact Us

For any questions, requests, complaints, or concerns relating to this Privacy Policy or our data practices, please contact:

This Privacy Policy is Version 2.0, last updated May 19, 2026. It supersedes all prior versions.