Privacy Policy

This policy applies to the Luna X Royalties website, authenticated dashboard, support, communications, and related services (the Service). The responsible Luna x Studios entity is the entity identified in the applicable order, service agreement, invoice, or account notice. This may be L'Una Music Group LLC in the United States or L'Una Studios LTDA in Brazil.

It does not govern independent websites, distributors, societies, digital platforms, or other services linked from the Service. Their privacy policies apply to their processing.

We act as a controller or business for information used to operate accounts, secure the Service, communicate with users, manage billing, and comply with law.

When a customer organization uploads royalty reports, contracts, catalog metadata, payee information, or files about artists, writers, rightsholders, employees, or other people, the customer generally determines why that information is processed. For that information, the customer is the controller or business and we act as its processor or service provider, subject to the applicable agreement and law.

If you are represented in a customer's workspace but do not control it, direct requests about the customer's records to that organization first. We will assist it as legally and contractually required.

We collect information that users provide when creating, accepting, or managing an account, including name, email address, phone number, company or artist name, country, role, language, default currency, PRO or society, registration identifiers, profile preferences, and notification choices.

We also process organization membership, assigned role, custom permission overrides, data scope, invitation status, inviter, date added, account status, and related administration records.

We process password hashes, secure session identifiers, CSRF protection tokens, multi-factor authentication configuration, encrypted authenticator secrets, recovery-code hashes, linked sign-in providers, login attempts, active-session details, security-policy settings, and account recovery records.

When Google sign-in is used, Google provides a stable account identifier, verified email address, and basic profile information within the OpenID, email, and profile scopes. We do not receive the user's Google password or request access to Gmail, Drive, contacts, or calendars. Google sign-in is available only to an existing active Luna X Royalties user whose email matches.

Cloudflare Turnstile processes device, browser, network, and challenge-interaction signals on protected forms to prevent automated abuse. Cloudflare states that Turnstile does not access form entries or other page inputs. Security and audit records may include IP address, browser or device information, authentication method, timestamp, success or failure status, and actions taken to protect an account.

Customers may provide royalty statements, transaction rows, source and platform names, territories, usage periods, currencies, gross and net royalties, units or streams, fees, taxes, adjustments, and reconciliation totals.

Catalog information may include artist and participant names, emails, roles, track and release titles, identifiers such as ISRC, ISWC, and UPC, alternate names, ownership or split percentages, effective dates, notes, contracts, and source mappings. Financial records may include participant balances, allocation history, payment amount, currency, date, status, reference, and supporting documents.

When an authorized user searches for or links a Spotify artist, we send the submitted artist name, Spotify URL, URI, or identifier to the Spotify Web API. We may store public Spotify artist information returned by the API, such as Spotify artist ID, name, profile URL, image URL, and any metrics Spotify makes available. This integration uses server credentials and does not access a user's personal Spotify account, private listening activity, playlists, or password.

These records can contain personal information about people who do not have a Luna X Royalties login. Customers must provide required privacy notices, establish a lawful basis, limit access, and avoid uploading unnecessary sensitive information.

We process files uploaded to the workspace, their name, type, size, visibility, uploader, related artist, track, or release, and creation history. Uploaded files may include statements, contracts, split sheets, invoices, payment confirmations, release documents, or other customer-selected materials.

When you request a panel, we collect your name, email, company or catalog name, catalog description, report types, reason for requesting the Service, prior use of similar services, consent record, and basic request-security information. We use this information to assess the request, operate the waitlist, prevent abuse, and contact you about access.

We also collect support messages, account requests, feedback, legal communications, opportunity inquiries, and any attachments or contact details supplied with them. Please do not include confidential or sensitive information that is not needed to address the request.

When the Service is used, we may collect IP address, browser and device type, operating system, referring page, requested URL, timestamps, session activity, errors, approximate location derived from IP address, and interactions such as page views, searches, imports, exports, permission changes, and security events.

If Analytics is accepted, Google Tag Manager and Google Analytics 4 may process page and feature engagement, technical performance, traffic-source and campaign information, pseudonymous browser identifiers, and approximate location. If Marketing is accepted, Meta Pixel receives a standard page-view event and may process URL, referrer, browser, device, campaign, network, and Meta-related identifier information for campaign measurement and attribution. We do not intentionally configure these tools to receive royalty statement contents, participant contact details, split percentages, payment records, or catalog financial values.

We use Google Consent Mode v2 with optional storage denied by default. Google Tag Manager does not load until Analytics or Marketing is accepted, and Meta Pixel does not load until Marketing is accepted. Essential cookies and browser storage support authentication, security, consent choices, theme, language, and navigation preferences. Details, provider IDs, common cookie names, and controls are in our Cookie Policy.

We receive information directly from users; from Owners, administrators, invited users, and customer organizations; from files and reports customers upload; from Google when a user chooses Google sign-in; from Spotify when an authorized user searches for or links a public artist profile; from Cloudflare for form-security verification; from providers that support hosting, communications, analytics, or marketing measurement; and automatically from use of the Service.

Customers may also combine information from distributors, publishers, PROs, CMOs, neighboring-rights organizations, social and UGC platforms, digital service providers, payment records, and public or licensed music metadata. We do not control the privacy practices or accuracy of those original sources.

We use personal information to:

• create accounts, authenticate users through passwords or Google, and maintain secure sessions;
• apply organization roles, permissions, data scopes, and file visibility;
• receive, validate, normalize, reconcile, and process royalty reports;
• match transactions to catalog entities, link shared artist and participant identities, enrich artist records from selected public Spotify profiles, and maintain catalog metadata;
• apply effective-dated splits, calculate allocations, and maintain participant ledgers;
• display balances, payment records, reports, analytics, maps, trends, and exports;
• provide support, send service notices, and respond to inquiries;
• investigate errors, prevent fraud and automated abuse, and protect users and the Service;
• maintain append-only audit and financial-integrity records;
• measure site and feature use where Analytics is accepted and measure campaigns where Marketing is accepted;
• manage billing, contracts, disputes, tax records, and legal obligations;
• improve reliability, mappings, accessibility, features, and user experience; and
• send marketing communications where permitted and chosen.

Where a legal basis is required, we process information as necessary to perform a contract or take requested pre-contract steps; to comply with legal obligations; for legitimate interests such as operating, securing, supporting, and improving the Service; with consent for optional technologies or communications where required; and to establish, exercise, or defend legal claims.

When we process customer-provided records as a processor or service provider, we rely on the customer's documented instructions. The customer is responsible for identifying its legal basis for those records.

The Service automates report parsing, duplicate checks, catalog matching suggestions, currency display, allocation calculations, analytics, and valuation indicators. These outputs depend on supplied data and configuration and are intended for review by authorized users.

We do not use these tools to make solely automated decisions about an individual that produce legal or similarly significant effects on our behalf. Customers decide whether and how to use outputs for contracts, payments, access, funding, or other business actions.

We may disclose information in the following circumstances:

• Within the customer's workspace: to users whose permissions and data scope allow access;
• Infrastructure and operations: to hosting, storage, database, email, support, professional-advisory, and payment or billing providers that support the Service under appropriate obligations;
• Google: for Google sign-in and, after Analytics consent, Google Tag Manager and Google Analytics 4 measurement;
• Cloudflare: for Turnstile verification on protected forms;
• Spotify: for an authorized artist search or profile lookup using the submitted name, URL, URI, or identifier;
• Meta: after Marketing consent, for Pixel page-view and campaign measurement;
• At the customer's direction: for exports, shared files, invited users, integrations, or another action requested by an authorized user;
• Legal and safety: when reasonably necessary to comply with law, valid process, or regulatory obligations; enforce agreements; investigate misuse; or protect rights, safety, and security;
• Corporate transactions: in connection with a financing, merger, acquisition, restructuring, or sale, subject to appropriate confidentiality and notice where required; and
• Professional advisers: to auditors, insurers, accountants, and legal advisers who need the information for their work.

Provider processing is also governed by the provider's terms and privacy policy. We may disclose aggregated or de-identified information that does not reasonably identify a person or customer.

We do not sell royalty statements, catalog data, split records, participant balances, payment records, or uploaded files. We do not use those customer records for cross-context behavioral advertising and do not intentionally send them to Google Analytics or Meta Pixel.

Meta Pixel and some analytics or campaign technologies may involve disclosures treated as a "sale," "sharing," or targeted advertising under certain laws even when no money changes hands. They remain off unless the applicable optional category is accepted. A recognized Global Privacy Control signal keeps Marketing disabled on that browser. You may also change preferences at any time through the cookie control.

Luna x Studios operates internationally, including in Brazil and the United States. Information may be processed in countries with privacy rules different from those where it was collected.

Where required, we use recognized safeguards such as adequacy decisions, contractual clauses, data-processing agreements, transfer impact reviews, consent, or another lawful mechanism. You may contact us for more information about safeguards relevant to your data.

We retain information only as long as reasonably needed for the purposes described, the customer's instructions, and applicable legal obligations. Retention varies by record:

• account and membership data is generally kept while the account is active and for a reasonable period afterward;
• sessions and recovery or OAuth state tokens have short technical expiration periods, while security and audit events may be retained longer to investigate abuse and demonstrate authorized activity;
• royalty statements, transactions, split versions, allocations, balances, and payment records remain while needed for the workspace and any applicable accounting, contractual, tax, dispute, or legal purpose;
• support, billing, and contract records are retained for the relationship and applicable limitation periods; and
• backups may remain isolated until their scheduled overwrite or deletion cycle completes.

When an authorized user deletes an imported report, the active Service deletes that report and its imported transactions. Tracks, artist records, scope grants, and royalty split versions that are orphaned because no other report or retained relationship uses them are also deleted or unlinked. Participant profiles are retained, and an audit record of the deletion, including identifying report metadata and the deletion result, is preserved. Records still used by another report, participant, file, permission scope, or user association remain. Copies may persist temporarily in protected backups and may be retained where required for security, legal claims, accounting, or compliance.

When other retention is no longer justified, we delete, anonymize, or securely isolate the information. A request to delete an account may not require deletion of records that another organization lawfully controls or that must be retained for financial, security, or legal reasons.

We use reasonable technical and organizational safeguards designed for the sensitivity of the information, including organization scoping, server-side authorization, permission and data-scope checks, secure production session cookies, CSRF protection, scrypt password hashing with unique salts, optional authenticator-based multi-factor authentication, encrypted authenticator secrets, one-way recovery-code protection, session revocation, Cloudflare Turnstile, audit logging, and restricted file retrieval.

No system is completely secure. Customers should use least-privilege roles, review user access and activity logs, require multi-factor authentication for privileged and financial roles, protect exported files, and promptly suspend users who no longer need access. Contact [email protected] if you believe information may have been compromised.

Users can update certain profile and notification information in the dashboard. Owners and authorized administrators can manage roles, data scopes, invitations, and account status. Users can review active sessions, revoke sessions, manage multi-factor authentication, and disconnect Google sign-in.

You can change optional cookie choices through the cookie-preference control. Withdrawing Analytics or Marketing consent prevents future optional loading on that device and sends updated denied consent states to Google, but it may not automatically remove identifiers already stored by a provider; browser controls can remove site data. Global Privacy Control keeps Marketing disabled where the signal is available. You may unsubscribe from marketing messages, but we may still send security, transactional, service, and legal communications.

Depending on your location and the context, you may have rights to request confirmation of processing, access, correction, deletion, anonymization, restriction, portability, information about disclosures, objection, withdrawal of consent, or review of certain automated decisions. You may also have the right to appeal a denied request and complain to a privacy authority.

Residents covered by United States state privacy laws may have rights to know or access categories and specific pieces of information, correct inaccuracies, delete information, obtain a portable copy, and opt out of sale, sharing, or certain profiling. We will not discriminate against a person for exercising a privacy right.

Brazilian data subjects may exercise applicable rights under the LGPD, including confirmation, access, correction, anonymization, blocking or deletion, portability, information about sharing, consent withdrawal, and review where provided by law. People in the EEA, United Kingdom, or Switzerland may exercise applicable GDPR rights and object to processing based on legitimate interests.

Rights are subject to legal exceptions. We may verify identity and authority before responding. An authorized agent may submit a request where law permits, but we may require evidence of authorization. If the information is controlled by a customer organization, we may direct the request to that customer and assist it.

During the preceding 12 months, the categories of personal information described in this policy may have included identifiers and contact data; account and commercial information; internet or network activity; approximate geolocation; professional or employment-related information; financial and royalty information; audio or visual profile content if provided; and inferences generated for analytics or security.

Sources are described in Section 8, purposes in Section 9, and disclosure categories in Section 12. We do not use or disclose sensitive personal information to infer characteristics or for purposes outside those reasonably expected for the Service.

The Service is intended for music professionals and organizations and is not directed to children. Users must be at least 18. We do not knowingly collect personal information directly from children through account registration. If a customer lawfully includes information about a minor artist or beneficiary in its records, the customer is responsible for required authority, notices, and safeguards.

We may update this policy to reflect changes in the Service, law, or our practices. We will post the revised date and provide additional notice of material changes where required. Earlier versions may be retained for reference.

To exercise a privacy right or ask a privacy question, email [email protected]. For account support, email [email protected]. Please identify the relevant organization and do not send passwords, recovery codes, or unnecessary financial records by email.

You may also use the contact information for the applicable contracting entity in the Imprint. We will respond within the period required by applicable law.