Privacy Policy

1. Data We Collect

We collect only what we need to provide the service. Data falls into four categories:

User information

• First and last name
• Email address
• Account details (password — stored irreversibly, never kept in plain text; registration date, account status, language and notification preferences)
• Phone, address, city, country
• Identity and payment data: Turkish national ID and passport numbers are NOT collected (this field has been removed from the platform and previously entered records have been deleted). Collected: billing/payment address including postal code, IBAN, account holder, bank name, invoicing details. These are required for royalty payments and legal obligations, and are only requested at the contract/payment stage.

Artist information

• Stage name (artist/project name)
• Biography
• Social media links (Instagram, SoundCloud, Spotify, YouTube)
• Profile images
• Musical work details (discography, genre, ISRC/UPC codes, release dates)

Content information

• Demo files (MP3/WAV)
• Audio recordings (masters)
• Cover artwork
• Release information (distribution metadata, credits — songwriter, producer, performer, featured artist)
• Lyrics and promotional text

Technical information

• IP address (in administrative and security action logs)
• Device information (browser type, operating system; on mobile, device model and app version)
• Session information (so you can see your active devices and sign them out), login attempts, two-factor authentication settings
• Application usage data (which screens are used, performance/error data)
• Share-link traffic: how often your release links are viewed and clicked. We do not store IP addresses here — only a daily-rotating, irreversible hash, used solely to avoid counting the same visit twice.

No account is needed to submit a demo. That flow collects only: artist/project name, email address, genre, a social link, a short description and your audio file.

2. Mobile Applications

Through our mobile applications, technical data such as application usage, device information, performance data and user preferences may be processed in order to provide our services.

• The app uses the same authentication infrastructure as the web to access your account; session data is stored securely on your device.
• Mobile applications do not use cookies; device-based local storage and similar technical methods are used instead (see the Cookie Policy).
• The app uses no advertising ID and runs no third-party advertising or analytics SDK.
• Sensitive permissions such as location, contacts or photo library are used only when you explicitly grant them, and only for that action (for example, choosing cover artwork).
• The app stores' own data practices (Google Play, App Store) apply in addition; download and purchase data is processed by the store and reaches us only as aggregate statistics.

3. Why We Collect It

• Creating a user account and managing it
• Providing artist services (dashboard tools, profile, discography)
• Demo review processes and responding to you
• Release operations — distributing approved works, allocating ISRC/UPC codes
• Presenting statistics — showing you streaming and share-link data
• Platform development — debugging, performance measurement, improving service quality
• Security — preventing abuse and detecting unauthorised access
• Communication — sending notifications about releases, contracts, payouts and messages
• Calculating royalties and making payments
• Meeting legal obligations such as tax and accounting

4. Retention

• Account and release data: for as long as your account is active.
• Financial records (royalties, invoices, payouts): for the retention period required by law — even after you close your account.
• Demo submissions: may be deleted once the review process and the related operational and legal retention need have come to an end.
• Security and audit records: retained for the period prescribed by legislation and necessary for the relevant purpose — namely maintaining security, preventing misuse and providing evidence.
• Backups: regular backups are taken to ensure continuity of service. Deletion of a record does not mean it disappears instantly from existing backups; backups are rotated within their own cycles.

5. Third-Party Services

We use a small number of external services. The list below reflects actual usage; there is no advertising network, no analytics tracking cookie and no sale of data. Which data is transferred to which country is tabulated in detail in the KVKK Disclosure Statement.

Services your browser contacts directly (your IP address reaches the provider during these requests):

• Cloudflare CDN: the interface icon font (Font Awesome) is loaded from Cloudflare. This request is made on the Platform's pages, including this document. Typefaces, by contrast, are served from our own server, so no request is made to any external service for fonts.
• jsDelivr CDN: only for the chart and QR components on dashboard screens.
• Spotify image server: only where an artist profile photo comes from Spotify, in order to display it.
• Discord image server: only if you linked your Discord account, in order to display your avatar.

Services we send data to from our server (your IP address does not reach the provider in these requests):

• Email delivery: your email address and the message content are used to send notifications. Our email infrastructure runs on our own domain.
• Discord (team notifications): used to send internal notifications to our team. ⚠️ When you submit a demo, your artist/project name, email address, the country and city you entered, and your social media link are sent to this notification channel.
• AI provider: used by the press-release draft tool in the admin panel. The text sent may include the artist name, the track title, genre and release date. No contact details, identity data or bank data are sent.
• Translation service: used to translate contract templates. Personal data fields (name, address, postal code, phone, IBAN) are masked before the text is sent and restored locally after translation — so no personal data reaches the translation service.
• Spotify Web API: only to fetch an artist profile photo, and only if you provided your Spotify link. The only information sent is the public Spotify artist identifier.
• Distribution services: where a recording is sent for distribution, the recording itself and its metadata (artist name, credits, ISRC/UPC) are delivered to the relevant distribution service. This transfer is made only for that recording and only as part of the distribution process.
• Hosting: the Platform runs on a server located in Türkiye.

No other external service — such as an error-tracking provider or a payment processor — is currently used. Should such a service be introduced, this policy and the KVKK Disclosure Statement will be updated.

6. Security

• Passwords are stored irreversibly; plain-text passwords are never kept, no member of staff can see your password, and it cannot be shown back to you.
• All traffic to the Platform is served over an encrypted connection.
• Sessions end automatically after a reasonable period; you can view and sign out your active sessions from the Settings area.
• Secrets relating to two-factor authentication are stored encrypted.
• Files you upload are validated by type and stored so as to be protected against unauthorised access.
• Access to the administration interface is separated into permission levels according to staff role; not every member of staff can access every type of data.
• Master recordings are not publicly accessible; the public side of the Platform offers only a short preview.

Note: the technical implementation details of our security measures are not published, in order to prevent that information from being misused.

7. Your Rights

You may ask us to tell you what data we hold, provide a copy, correct it, delete it, or object to processing. From Settings in the artist dashboard you can export your data or submit a deletion request. If you live in Türkiye, see the KVKK Disclosure for your statutory rights and how to exercise them.

8. Children's Data

The platform is not designed for people under 18. If you are a minor, you need the consent of a parent or guardian before creating an account or submitting a work.

9. Changes and Contact

This policy may be updated to reflect changes in law or in the platform; material changes are published on this page. Questions:

• Email: info@lunovia.com.tr
• Web: lunovia.com.tr