At DistroVibe ("DistroVibe", "we", "us", or "our"), we take your privacy and the security of your personal, financial, and catalogue data with utmost seriousness. This Privacy Policy explains how we collect, process, disclose, and protect your information when you access our website, use our creator dashboard, API, mobile applications, or engage with our digital music distribution network (collectively, the "Services").
Data Controller & Privacy Contact
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), DistroVibe acts as the Data Controller of your personal data. If you have questions regarding this policy, our data practices, or wish to exercise your statutory rights, you may contact our designated Privacy Office at:
By accessing the Services, registering an account, or submitting audio masters and metadata, you acknowledge that you have read, understood, and accept the processing of your data as detailed in this Privacy Policy.
1. Information We Collect
1.1. Information You Provide Directly
Full legal name, email address, phone number (for 2FA), and government ID metadata verified via AES-256 safeguards.
Artist monikers, track titles, ISRC/UPC codes, artwork, lyrics, contributor splits, and publisher details.
Payment recipient details, bank coordinates, and region-specific tax compliance declarations processed via Polar.sh.
Ticket records, copyright clearance notices, dispute communications, and correspondence history.
1.2. Information Collected Automatically
We automatically collect Technical & Telemetry Data (including IP addresses, browser agents, operating system parameters, session timestamps, and device fingerprints) to administer Two-Factor Authentication, enforce geographical compliance, and prevent malicious access.
1.3. Information from DSPs and Ingestion Partners
Aggregated and granular stream counts, geographic performance, listener demographics, and royalty settlement manifests from Spotify, Apple Music, YouTube, and other DSPs.
Stream anomaly flags, artificial traffic notices, DDEX ingestion logs, and copyright matching reports from our backend partners.
2. Legal Bases for Processing (UK GDPR Article 6)
Under the UK GDPR, we are required to establish a lawful legal basis for each processing activity. We process your personal data under the following legal grounds:
Processing necessary to execute our contracts with you, including delivering audio recordings and metadata to DSPs, maintaining user dashboards, calculating royalty shares, executing revenue splits, and facilitating payouts via Polar.sh.
Processing necessary to comply with applicable UK and international statutory requirements, such as reporting financial earnings to HM Revenue & Customs (HMRC), maintaining financial audit trails, and executing anti-money laundering (AML) / KYC identity checks.
Processing necessary for our legitimate commercial interests, provided these are not overridden by your fundamental rights. This includes monitoring for artificial streaming/bot manipulation, protecting platform cybersecurity, investigating copyright infringement, and improving product features.
Where you have provided explicit opt-in consent, such as subscribing to product newsletters, artist marketing features, or fan broadcast broadcasts (VibeMail). You may withdraw consent at any time via dashboard preferences.
4. Data Retention & Anti-Fraud Security
4.1. Retention Periods
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, tax, accounting, or reporting obligations (generally 6 to 7 years for financial records under UK corporate law).
Anti-Fraud Record Retention: If an account is suspended or terminated for streaming fraud, copyright infringement, or malicious activity, DistroVibe reserves the right to retain identifying metadata, device fingerprints, and banned IP records indefinitely to safeguard platform integrity and prevent repeat violations.
4.2. Cryptographic Security Standards
We employ enterprise-grade security controls, including TLS 1.3 encryption in transit, AES-256 encryption at rest for sensitive identity numbers, role-based access control (RBAC), and multi-factor authentication (2FA).
5. International Data Transfers (IDTA / SCCs)
Safeguards for Cross-Border Data Transfers
Because DistroVibe distributes Content to digital service providers worldwide, your personal data and catalogue metadata may be transferred to and stored in jurisdictions outside the United Kingdom and European Economic Area (EEA), including the United States.
When we transfer personal data outside the UK, we ensure a similar degree of protection is afforded by implementing approved statutory safeguards, including:
- The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs) with third-party service providers.
- Transfers to countries officially recognized by the UK Secretary of State as offering an adequate level of data protection under UK Adequacy Regulations.
6. Your UK Privacy Rights & ICO Complaint Right
Under UK GDPR and the Data Protection Act 2018, you possess the following statutory rights regarding your personal data:
Right of Access (DSAR)
Request confirmation and a structured copy of personal data we hold about you.
Right to Rectification
Request correction of inaccurate, incomplete, or outdated personal records.
Right to Erasure ('Right to be Forgotten')
Request deletion of your data following complete catalogue takedown (subject to statutory financial retention requirements).
Right to Restrict Processing
Request temporary freezing of processing while an accuracy or legal dispute is reviewed.
Right to Data Portability
Receive your account data in a structured, commonly used, and machine-readable format.
Right to Object
Object at any time to processing based on legitimate interests or direct marketing.
Right to Lodge a Complaint with the ICO
If you are a UK resident, you have the statutory right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the opportunity to resolve your concerns directly before you approach the ICO, so please contact privacy@distrovibe.com in the first instance.
7. Children's Privacy
DistroVibe Services are strictly not directed to children under thirteen (13) years of age. We do not knowingly collect personal data from children under 13. Users between 13 and 18 years of age may access the platform only under the direct supervision of a verified parent or legal guardian.
8. Changes to This Privacy Policy & Contact
We may update this Privacy Policy periodically to reflect changes in our legal obligations, technology, or platform features. We will notify you of material changes by updating the "Last Updated" date at the top of this policy and posting an announcement on your creator dashboard.
London, United Kingdom