Privacy Policy

At TinyHouseRecords.com, we respect your privacy and are committed to protecting the personal data you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, specifically in compliance with the General Data Protection Regulation (GDPR) for our users within the European Economic Area (EEA).

1. Information We Collect

• Account Information: When you register, we collect your email address, chosen password (stored securely as a cryptographic hash), and your Artist/Stage Name.
• Fan CRM (Listeners): If a listener chooses to "Follow" an artist, we collect their email address strictly with their explicit consent to send automated alerts when that artist uploads a new master.
• Audio & Metadata: We collect the audio files (MP3, WAV), cover art images, track titles, and genre hints you upload to the platform.
• Payment & Tipping Information: If you upgrade to a PRO or Ultra tier, your subscription payment is processed directly by Stripe. For direct tipping, we store the artist's PayPal email address to route listener payments. TinyHouseRecords.com does not store or process raw credit card numbers for subscriptions or tips.
• Usage Data & Technical Identifiers: We collect basic telemetry data, such as stream counts and play history, to provide analytics to our artists. We also process technical network logs, including IP addresses and cookie identifiers, which are classified as personal data under GDPR.

2. Legal Basis for Processing (EEA Users Only)

If you reside in the European Economic Area, our legal basis for collecting and processing your personal data depends on the context of the collection:

• Performance of a Contract: Processing your account registration, handling premium tier upgrades, and routing direct fan tips are necessary to fulfill our contractual commitments to you.
• Consent: When you sign up to follow an artist via our Fan CRM, we rely on your explicit consent to send you automated track notifications. You can withdraw this consent at any time.
• Legitimate Interests: We process usage statistics and server performance telemetry to monitor platform security, protect against fraudulent stream bots, and optimize our AI tagging workflows.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and secure the TinyHouseRecords.com platform.
• To host your audio and stream it to listeners via our global player.
• To process your audio through our AI systems to generate tags, BPM, and mood descriptions.
• To process your subscription payments, manage account tier limits, and route direct fan tips.
• To send automated notifications (Fan CRM) and administrative emails.

4. Sharing & International Data Transfers

We do not sell your personal data to third parties. We share information with trusted processors under Data Processing Agreements (DPAs) strictly to operate our services:

• Payment Processors: We share necessary account identifiers with Stripe (for subscriptions) and PayPal (for tipping) to facilitate financial transactions.
• AI Partners: We transmit your audio metadata and track context to our AI partners (e.g., DeepSeek) strictly for the purpose of generating platform metadata.
• Legal Compliance: We may disclose information if required to do so by law or in response to valid requests by public authorities.

International Transfers: TinyHouseRecords.com is operated and managed from servers located in the United States. If you are accessing the platform from the EU, your personal data will be transferred to and processed in the US. We utilize Standard Contractual Clauses (SCCs) and robust technical security layers to guarantee that your data is afforded an equivalent level of protection to that under the GDPR.

5. Data Retention

We keep your personal data only as long as your account remains active or as needed to provide our streaming services. If you delete a track, the audio file and its AI-generated metadata are purged from our live environments immediately. If you request a complete account deletion, your personal information, hashed credentials, and catalog files will be permanently erased from our databases within 30 days, except where necessary to satisfy legal tax/financial record-keeping mandates.

6. Your GDPR Data Rights

If you are an EU/EEA resident, you have the following data protection rights under the GDPR:

• Right of Access & Portability: You can request a copy of all personal data we hold about you in a clean, structured, machine-readable format.
• Right to Rectification: You can modify or correct any outdated or incorrect profile details inside your portal at any time.
• Right to Erasure ("Right to be Forgotten"): You have the right to request that we completely wipe all your records and files from our production servers.
• Right to Restrict or Object to Processing: You can object to our processing of your telemetry data under legitimate interests, or ask us to temporarily suspend data processing.
• Right to Withdraw Consent: For any features relying on consent (like the Fan CRM tracker), you can revoke permission instantly by unfollowing or managing your settings.

To exercise any of these rights, or if you believe our data handling practices violate the law, you can contact our administrative team. You also maintain the right to lodge an official complaint with a competent Data Protection Supervisory Authority in the EU.

7. Data Security & Encryption

We implement strict industry-standard technical security measures to safeguard your account data and raw master tracks. User authentication passwords are securely salted and hashed using bcrypt. Network connections to our player and portal endpoints are fully encrypted over HTTPS. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute safety.