PRIVACY NOTICE

1. WHO WE ARE

ReggaeVerse OS, operating from Ghana, decides how and why your personal data is processed on this platform and is therefore the controller. Contact us at privacy@reggaeverseos.com.

2. WHAT WE COLLECT AND WHY

• Account data (name, artist name, email, password hash, avatar, bio, links, location, influences) — to create and operate your account and public profile. Legal basis: performance of contract.
• Content data (uploads, tracks, stems, artwork, listings, project files, milestones, posts, comments, messages) — to provide collaboration, marketplace and streaming features. Legal basis: contract.
• Transaction data (order references, plan, entitlement status, purchase history) — to grant access to what you bought and to support you. Legal basis: contract and legal obligation. Card and billing details are collected and processed by Paddle, not by us.
• Usage and telemetry (pages viewed, plays, searches, feature usage, approximate location from IP, device and browser identifiers, log data) — to run, secure and improve the service. Legal basis: legitimate interests.
• Support and communications (messages you send us, abuse reports) — to answer you and handle disputes. Legal basis: legitimate interests and contract.
• AI Studio data (prompts, generated outputs, session history) — to deliver the feature and enforce our AI Policy. Legal basis: contract and legitimate interests.
• Marketing (email newsletters, release and event alerts, push notifications) — sent with your consent, withdrawable at any time.
• Security data (auth events, fraud signals, moderation records) — to prevent fraud, abuse and unauthorised access. Legal basis: legitimate interests and legal obligation.

3. WHO WE SHARE WITH

• Merchant of Record: Paddle.com Market Ltd — sale of memberships and listings, subscription management, payments, tax compliance, invoicing, refunds and chargebacks.
• Hosting, database, storage and auth providers operating our infrastructure.
• AI model providers processing Studio prompts through our AI gateway.
• Email and push notification providers delivering transactional and opted-in messages from notify.reggaeverseos.com.
• Analytics and error-monitoring providers helping us keep the platform stable.
• Other members, where you publish publicly or share within a collaboration project — your public profile, published releases, listings and posts are visible to anyone.
• Professional advisers (legal, accounting) and authorities where required by law or to protect rights and safety.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

4. INTERNATIONAL TRANSFERS

We operate globally, and our providers may process data in the EEA, the UK, the United States and other countries. Where data leaves the UK/EEA we rely on adequacy decisions or Standard Contractual Clauses (plus the UK Addendum where applicable), with supplementary technical measures such as encryption in transit and at rest. You can request details of the safeguards used.

5. RETENTION

• Account and profile data: for the life of your account, then deleted or anonymised within 90 days of closure.
• Content and uploads: until you delete them; residual backup copies purge within 30 days.
• Transaction and tax records: up to 7 years, as required by accounting and tax law.
• Security and moderation logs: up to 24 months.
• Support correspondence: up to 24 months after resolution.

6. YOUR RIGHTS

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, withdraw consent, and avoid solely automated decisions with legal effect. EU/EEA and UK residents may complain to their supervisory authority; we respond to requests within one month. California residents may exercise CCPA/CPRA rights, including the right to know, delete, correct and opt out of sale/sharing (we do neither), without discrimination. Ghanaian users may exercise rights under the Data Protection Act, 2012 (Act 843). Email privacy@reggaeverseos.com; we may verify your identity before acting. See also Global Sales & Jurisdiction.

7. SECURITY

We use encryption in transit and at rest, row-level access controls on our database, scoped and time-limited signed URLs for paid downloads, least-privilege service credentials, and logging and monitoring. No system is perfectly secure; if a breach affects your rights we will notify you and the relevant regulator as required by law.

8. CHILDREN

The platform is not intended for anyone under 18. If we learn we hold data from a child we delete it.

9. COOKIES

See our Cookie Notice for the cookies and similar technologies we use and how to manage them.

10. CHANGES

We will post updates here and, for material changes, notify you by email or in-app before they take effect.