The data controller is UPCOMINGSOUNDS S.R.L., registered in Romania under CUI 54564122 and Trade Registry number J2026027621002, registered office: Str. Nerva Traian, nr. 27-33, Birou 6, Scara B, Etaj 1, Sector 3, Bucharest, Romania.

Contact for privacy matters: privacy@upcomingsounds.com · General support: support@upcomingsounds.com

This policy explains what personal data we collect on upcomingsounds.com (the "Platform"), why, who receives it, how long we keep it, and your rights. It applies to artists, curators, visitors, newsletter subscribers, and people we contact about the Platform (Section 9).

Account and identity. Name, email address, password (stored hashed), account role (artist/curator), profile details (biography, photos, links, genres, languages), and account status. If you sign in with a social account (Google, Facebook, X/Twitter, or Spotify), we receive the identifiers and profile information you authorise that provider to share (such as name, email, and avatar).

Curator applications and verification. Application details for your curator type (playlist, YouTube, influencer, radio, blog, label, and others), your social and playlist links, references, and feature selections. Curators must verify a phone number by SMS one-time code. Verification records (including our separate "verified curator" decisions) are kept with your account.

Music and submissions. Tracks and audio you upload, track metadata, campaign and offer records, curator feedback and submitted work, ratings, and messages exchanged on the Platform. Submitted audio is processed by our in-house audio-analysis tooling, which examines track metadata only (it does not fingerprint or otherwise recognise audio content) to generate submission and quality signals shown to you and to administrators. Uploaded audio is not sent to any external analysis service.

Payments, wallet, and payouts. Purchase history, wallet (USC) balances and transactions, subscription records, invoices, and refund records. Card payments are processed by Stripe and PayPal; we do not receive or store your full card number or CVV. Curators who request payouts provide payout details, which we store: PayPal email; Wise email or bank details (account holder, account number, sort code, IBAN, BIC/SWIFT); or Revolut handle, IBAN, or email. These details are used only to pay you and to meet financial-record obligations.

External stats and profile claims (artists). If you use the external-stats or profile-claim features, you submit links and proof relating to your accounts on other platforms (for example streaming or social profiles). We review and store the submitted proof and our verification decision.

Communications. On-site messages between users, support tickets, and support chat conversations. Our chat includes an AI assistant provided using OpenAI's services: messages you send to the AI assistant are processed by OpenAI to generate replies. Please do not put sensitive personal data (payment details, identity documents, health information) into chat.

Referrals, promotions, and gift cards. Referral links and codes you use or share, who referred whom, reward status, promo-code redemptions, incentive and gift-card records.

Newsletter. If you subscribe, your email address and subscription status. Signup uses a double opt-in confirmation link; every newsletter includes an unsubscribe link, and one-click unsubscribe is supported.

Technical and usage data. IP address, device and browser information, pages and actions on the Platform (including via our analytics event system), language and currency preferences, and approximate location and timezone derived from your IP address using IPinfo. Security and activity logs are kept for accounts and administrative actions.

Cookies and similar technologies. As described in Section 10 and our Cookie Policy.

Where processing is based on consent, you may withdraw it at any time; withdrawal does not affect past processing.

Artist and curator public profiles display the information you publish there — name/stage name, photo, biography, links, tracks, and platform statistics (such as response rate and average response time for curators). Public profiles may be indexed by search engines and may be displayed on other websites through our embeds and widgets (for example an artist or track embed, or a curator widget). Anything you make public should be treated as public. Private account data (email, phone, payout details, wallet) is never shown on public profiles.

Other users receive the information needed for the features you use together: for example, a curator receiving your submission sees your artist profile and track; an artist sees the curator's profile, feedback, and delivered work; marketplace counterparties see order-relevant details and your on-site messages.

We share data only as needed to operate the Platform:

• Payments: Stripe and PayPal (purchases, subscriptions, refunds, chargebacks).
• Payouts: PayPal, Wise, and Revolut, using the payout details you provide.
• Email delivery and events: Amazon SES, Mailgun, and Postmark deliver our email and report delivery/open/bounce events back to us through webhooks.
• AI support chat: OpenAI processes chat messages to generate assistant replies.
• Geolocation: IPinfo processes IP addresses to derive approximate location/timezone.
• Analytics and advertising (consent-based, see Section 10): Google Analytics; Meta and TikTok advertising measurement (including server-side conversion events) only where you have consented to advertising cookies.
• Embedded media: Spotify, YouTube, and SoundCloud content loaded on Platform pages receives your IP and browser information when it loads.
• Sign-in providers: Google, Facebook, X/Twitter, Spotify, when you choose social sign-in.
• SMS verification: our SMS provider, Amazon Web Services (Amazon SNS), receives your phone number to deliver one-time codes.
• Hosting and infrastructure providers that store and serve the Platform.
• Our staff and administrators, under Section 6.
• Authorities, courts, auditors, and professional advisers where the law requires or permits.

We do not sell your personal data.

Our administrators review applications, tracks, work, disputes, and payouts, and can see the operational data needed for those tasks (including activity and refund logs). For support and troubleshooting, authorised administrators may open a logged support session inside your account ("portal" access) to see what you see and diagnose problems. This access is limited to authorised staff, is recorded in our activity logs, and is used for support, moderation, security, and legal compliance — not for our own transactions in your name, except actions you have asked us to take or that our Terms describe (such as cancelling a campaign on an approved refund request).

Some providers above are based outside the European Economic Area (including in the United States). Where data is transferred internationally, we rely on adequacy decisions or standard contractual clauses (or equivalent safeguards) as applicable, and on the providers' published data-protection terms.

• Account data: for the life of your account and thereafter only as long as needed for legal, accounting, or dispute purposes.
• Financial and payout records: for the periods required by accounting and tax law.
• Messages, feedback, and transaction history: for the life of the account and any legally required period afterwards; they form the record of work and payments between users.
• Marketing contacts (users/subscribers): until you opt out, and prospect/marketing data no longer than three years from the last meaningful contact.
• Outreach leads (Section 9): until you object or opt out, our messages bounce, or three years from collection or last meaningful contact, whichever is earliest; opt-out (suppression) records are kept as long as needed to honour the opt-out.
• Chat conversations: for as long as needed to provide support and resolve disputes, then deleted or anonymised.
• Security and activity logs: for a limited period proportionate to security and audit needs.

We operate an outreach programme (internally called "GARY") that invites music curators and artists to join the Platform.

• What we hold: professional contact details collected from publicly available sources — for example your name or stage name, work email address, social or playlist profile links, role, and genre focus.
• Why (legal basis): our legitimate interests in telling relevant music professionals about a service directed at them. We only contact people whose public professional activity makes the Platform relevant to them.
• Every outreach email identifies us and includes a working opt-out link. Opting out is immediate and permanent for that programme; you may also object at any time by contacting privacy@upcomingsounds.com, and we will stop and delete or suppress your record.
• We never buy contact lists from data brokers and never sell lead data. Lead data is not merged into a user account unless the person registers, at which point Sections 2–8 apply.

We use strictly necessary cookies/storage for sign-in, security, and preferences. Optional analytics (Google Analytics and our own event system) and optional advertising measurement (Meta and TikTok, including server-side events, setting identifiers such as _fbp, _fbc, _ttp) run only with your consent, managed through Cookie settings on any page; both categories start off, refusal does not block use of the site, and consent choices are stored for 180 days. Full details, names, and durations are in our Cookie Policy.

Subject to applicable law, you have the right to: access your data; correct inaccurate data; erase data where retention is no longer justified; restrict or object to processing (objection to direct marketing is absolute and always honoured); portability of data you provided, where applicable; and withdraw consent at any time. You may also lodge a complaint with a supervisory authority — in Romania, the ANSPDCP — or with your local authority.

To exercise a right, contact privacy@upcomingsounds.com. We respond within the legal deadline (normally one month). Some data must be retained despite an erasure request where the law requires it (for example financial records) or where it is the record of a transaction with another user; we will explain if that applies.

The Platform is for users 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

We apply technical and organisational measures proportionate to the data we hold, including hashed passwords, access controls, logging of administrative actions, and encrypted connections. No system is perfectly secure; if we become aware of a breach affecting your data in a way the law requires us to report, we will notify you and the competent authority as required.

We may update this policy. Material changes will be notified by email or a prominent Platform notice before they take effect, and the effective date above will be updated. Where a change requires new consent, we will ask for it; continued use alone is not consent to optional processing.