Privacy Policy

Last updated: April 2026

1. Introduction

This Privacy Policy explains how Sonovy (“we”, “us”, “our”) collects, uses, shares, and protects personal data when you use our music distribution platform, websites, and related services (collectively, the “Service”).

By creating an account or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree, please do not use the Service.

2. Information We Collect

We collect the following categories of personal data:

  • Account information: name, email address, phone number, password, and your role on the platform (artist, label, sub-user).
  • Identity and verification data: identification documents, tax identification number, address, and date of birth where required by law or for royalty payouts.
  • Banking and payment data: bank account details, IBAN, payment provider identifiers, and tax forms required to disburse royalties.
  • Content and metadata: sound recordings, music videos, artwork, lyrics, ISRC/UPC codes, contributor information, and any other material you upload to the Service.
  • Usage and technical data: IP address, browser and device information, log data, pages visited, and actions taken within the Service.
  • Communications: messages, support requests, feedback, and email correspondence you send us.

3. How We Use Your Information

We process your personal data to:

  • Provide, operate, and maintain the Service, including delivering your content to digital service providers (DSPs) such as Spotify, Apple Music, YouTube, and others.
  • Calculate, report, and pay royalties owed to you and your collaborators.
  • Verify your identity, prevent fraud, and comply with anti-money-laundering and tax obligations.
  • Communicate with you about your account, distribution status, payments, and platform updates.
  • Improve, secure, and analyze the Service through aggregated usage data.
  • Comply with legal obligations and respond to lawful requests from authorities.

4. Sharing of Information

We share personal data with the following categories of recipients, only to the extent necessary to operate the Service:

  • Digital Service Providers (DSPs): Spotify, Apple Music, TikTok, YouTube, Beatport, Tencent, and other platforms where your content is distributed. These platforms act as independent controllers of the data they receive.
  • Payment processors: Iyzico, Stripe, and similar providers used to process subscription payments and royalty disbursements.
  • Cloud and infrastructure providers: Hetzner Object Storage, Amazon Web Services, and other vendors that host the Service and store content.
  • Professional advisors: auditors, accountants, and legal counsel under confidentiality obligations.
  • Authorities: tax administrations, law enforcement, and regulators when legally required.

We do not sell your personal data to third parties.

5. Data Storage and Security

We host the Service on infrastructure located primarily in the European Union (Hetzner data centers). We use industry-standard safeguards including TLS encryption in transit, encryption at rest where applicable, role-based access controls, and audit logging.

No system is fully secure. While we work to protect your information, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

6. International Data Transfers

Because music distribution is a global service, your content and certain personal data are transmitted to DSPs and partners located outside your country of residence, including outside the European Economic Area and Türkiye. Where transfers occur, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

7. Your Rights

Subject to applicable law (including the EU General Data Protection Regulation and the Turkish Personal Data Protection Law / KVKK), you have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate or incomplete data.
  • Request deletion of your data, subject to legal retention requirements.
  • Object to or restrict certain processing activities.
  • Receive a copy of your data in a portable format.
  • Withdraw consent where processing is based on consent.
  • Lodge a complaint with the competent supervisory authority.

To exercise these rights, contact us at [email protected].

8. Cookies and Similar Technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service, and measure usage. Some cookies are strictly necessary; others require your consent. You can manage cookie preferences through your browser settings or the cookie banner shown on our website.

9. Data Retention

We retain personal data for as long as your account is active and for the period required to fulfil the purposes described in this Policy, including legal, accounting, royalty, or reporting obligations. Royalty and tax records are typically kept for at least the minimum period required by applicable tax law.

When data is no longer needed, we delete or anonymize it.

10. Children’s Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If we learn that we have collected personal data from a minor without verifiable parental consent, we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the Service or by email. The “Last updated” date at the top of this page indicates when the Policy was most recently revised.

12. Contact Us

If you have questions about this Policy or wish to exercise your rights, contact us at:

[email protected]