What we do with what you give us

This policy describes how MyMaestro AI Inc., a Delaware corporation that operates the Rooms platform (“Rooms,” “we,” “us,” and “our”), collects, uses, and shares your personal information in connection with our websites, including access.fm, our mobile and desktop applications, and our related services (together, the “Services”).

MyMaestro AI Inc. operates other products under their own privacy policies. This policy governs the Rooms Services, and where it conflicts with another MyMaestro AI Inc. privacy policy, this policy applies to the Rooms Services.

Rooms is a platform where artists and labels operate rooms and fans join them. Two things follow from that, and we state them before anything else.

When you buy something in a room, the artist or label operating that room is the seller. They set the price, they are your counterparty, and they are responsible for what you bought. We operate the platform the sale happens on and take a fee for it. Where the law requires us to be treated as the supplier for sales tax or VAT purposes, we are, and we account for that tax.

When you join a room, or ask for one to open, you are directing us to give that operator your information. That includes your name, your contact details, when you joined, what you buy there, and how you engage there. This is not a side effect. It is what the product does: it lets an artist know who their fans are. We tell you what an operator will receive at the point you join, and joining is how you ask us to provide it.

An operator sees activity in their own room. We do not give one artist’s room your activity in another artist’s room.

Being in a room and being on an operator’s mailing list are two different things. Joining a room does not put you on an operator’s email or SMS list. That is a separate choice, made per room, and you can withdraw it at any time without leaving the room.

Your information passes through two organizations with different purposes, and each answers for its own. This matters, because it decides who you go to when you want something done.

Rooms is responsible for the platform. Your account, your access list, your fan numbers, the rooms you have joined, delivery of what you bought, payments, security, and our own communications with you. We decide how the Services work and we answer for that.

Each operator is responsible for their own room and their own relationship with you. They decide what to put in the room, what to sell, what to say to the fans who opted in to hear from them, and how to use what they learn about their fans — including in their own systems outside Rooms. That is their decision, not ours. In data protection terms, an operator is a separate and independent controller of the fan information they receive, not a service provider processing on our instructions.

We are not, however, indifferent to what they do with it. Every operator is bound, from the moment they create an operator account, by an agreement with us that requires them to use fan information lawfully, forbids them from selling, renting, or transferring it, requires them to honor your opt-outs and erasure requests, and requires them to keep it secure. Those limits travel with the information if they export it.

Where to go. For anything about your account, your purchases, or your access, come to us. For anything about a particular room — what an operator holds, how they are using it, or their messages to you — you can come to us and we will pass it on and require them to act, or you can go to them directly. Both routes work.

An artist or label opening a room may bring the fan records they already hold — for example, a mailing list, purchase records from a prior store, or ticketing records. If you are in those records, we receive that information from the operator rather than from you.

That operator is the controller of those records and remains so. We use what they bring to build and maintain their room’s fan records, and we match it to your Rooms account if you have one or later create one. From the point it is used to run the Services, we are also a controller of it for our own purposes, as described in this policy.

Operators must confirm to us that they already have a relationship with the people in the records they bring, that they collected the information lawfully, and that they have any consents needed to keep contacting them.

In addition to the purposes described above, we use information in the following ways:

• —To provide the Services, including operating rooms, completing purchases, and maintaining your access to what you have bought.
• —To provide operators with the fan records described in this policy.
• —To deliver messages and notifications from the rooms you have joined. The messages you receive through Rooms come from the rooms you joined; you control notifications per room.
• —To send you our own service communications, and, with the choices described below, our own promotional communications.
• —To measure and improve the Services, conduct analytics using information we collect directly, and develop new features.
• —To detect and prevent fraud and abuse, and to secure accounts.
• —To respond to inquiries related to support, employment opportunities, or other requests.
• —For internal administrative purposes and to manage our relationships.
• —To comply with law, including tax, royalty accounting, and reporting obligations.

Our collection and processing of your information is based, in different contexts, upon your consent, our need to perform a contract with you, our legal obligations, and our legitimate interests in conducting our business.

With the artists and labels whose rooms you join

When you join a room, ask for one, or transact in one, the room’s operator receives:

• —Your identity and contact information: name, email address, and location where provided.
• —Your join record: when you joined or asked, your fan number, your entry group, and referrals credited to you.
• —Your purchase history in that room: what you bought, when, and the amount paid.
• —Your engagement in that room: votes cast, notes sent, plays of what you bought, and messages opened.

An operator does not receive your activity in other artists’ rooms, your payment card details, or your connected-account follow list.

The operator decides what they do with this within the limits in our agreement with them, and they answer for those decisions directly. See “Who Is Responsible for What” above.

Sales reporting, and the one thing we cannot undo

An artist or label may choose to report a release for sales-chart eligibility. Where they do, we send the transaction data the chart reporting body requires — which may include purchase details and information used to verify that a purchase is genuine. We tell you before you buy where a release is being reported.

Once that data has been sent, it cannot be recalled. The reporting body holds it as its own controller, under a licence that does not expire, and neither we nor the operator can withdraw it. This means that if you later ask us to delete your information, we can delete our records and require the operator to delete theirs, but we cannot reach data already reported. It is the one place where an erasure request has a hard limit, and we would rather say so plainly than let you discover it afterwards.

We rely on our legitimate interest, and the operator’s, in reporting sales accurately to the body that measures them. If you do not want a purchase reported, do not buy a release that is marked as reported; the marking appears before checkout.

Service providers

We share information with service providers who help us operate the Services — payment processing, hosting and infrastructure, communications delivery, customer support, and analytics performed on our behalf. They act on our instructions and may not use it for their own purposes.

Affiliates and acquisitions

We may share information with our affiliates (e.g., parent organization, sister organization, joint ventures, or other organizations under common control). If another organization acquires, or plans to acquire, our company, operations, or assets, we will also share information with that organization, including at the negotiation stage.

Other disclosures with your consent

We may ask if you would like us to share your information with other unaffiliated third parties who are not described elsewhere in this policy.

Other disclosures without your consent

We may disclose information in response to subpoenas, warrants, or court orders, or in connection with any legal process, or to comply with relevant laws. We may also share your information to establish or exercise our rights, to defend against a legal claim, to investigate, prevent, or take action regarding possible illegal activities, suspected fraud, or safety of person or property, or a violation of our policies, or to comply with your request for the shipment of products or the provision of services by a third-party intermediary.

What we do not do

We do not sell your personal information, and we do not share it with third parties for their own advertising. There is no advertising inside rooms.

Giving an operator your information when you join their room is not a sale. You direct it by joining, we tell you beforehand exactly what they receive, they are the seller of what you buy there, they may only use it within the limits in our agreement with them, and you can stop it by leaving the room or asking us to delete your information.

We measure our own Services and our own communications using technology we operate and data we collect directly. We do not deploy third-party advertising cookies or pixels on the Services by default.

Where an operator chooses to use a third-party marketing or measurement integration in connection with their room, that use is subject to your consent where the law requires it, and it is disclosed at the point it applies.

We honor opt-out preference signals, such as the Global Privacy Control, as required by applicable law. Where a legally required signal is not in effect, we may not respond to other automated browser signals such as “Do Not Track.”

Access to your personal information. You may request access to your personal information by contacting us at the address below. If required by law, upon request, we will grant you reasonable access to the personal information that we have about you.

Changes to your personal information. We rely on you to update and correct your personal information through your account settings. Note that we may keep historical information in our backup files as permitted by law. If the Services do not permit you to update or correct certain information, contact us at the address below.

Deletion of your personal information. You may request that we delete your personal information by contacting us at the address below. When we act on a deletion request, we also notify the operators of rooms you joined, and our agreement requires them to erase your information from their own systems. Three limits apply, and we state them rather than imply them: we must keep certain records the law requires us to keep, on the schedule set out under “Retention”; an operator may keep records their own legal obligations require; and data already sent to a sales-chart reporting body cannot be recalled by anyone.

Notifications. You control notifications per room, and system-level notification settings on your device.

Connected accounts. You can disconnect a connected streaming account at any time in your account settings. Disconnecting stops further collection from that account; it does not undo actions you already took with it.

Messages from artists and labels. Joining a room does not add you to that operator’s email or SMS list. You choose that separately, per room, and you can withdraw it at any time — in your settings, through the unsubscribe link in any email, or by replying STOP to any text. Withdrawing it does not remove you from the room.

Messages from us. You can opt out of our own promotional emails using the link in any such message. Service and transactional messages — receipts, security notices, messages about your purchases — are sent regardless.

Objection to certain processing. You may object to our use of your personal information by contacting us at the address below.

Revocation of consent. Where processing is based on consent, you may revoke it by contacting us at the address below. If you revoke consent, we may no longer be able to provide you some or all of the Services. In some cases, we may limit or deny a request if the law permits or requires us to do so, or if we are unable to adequately verify your identity.

If you live in a state with a comprehensive privacy law, you may have some or all of the following rights, subject to that law’s conditions and exceptions:

• —To know whether we process your personal information, and to access it.
• —To correct inaccuracies in your personal information.
• —To delete your personal information.
• —To obtain a copy of your personal information in a portable format.
• —To opt out of the sale of personal information, the sharing or processing of personal information for targeted advertising, and certain profiling. As stated above, we do not sell personal information or share it for third-party advertising.
• —To limit the use of sensitive personal information, where applicable. We do not collect sensitive personal information as defined by these laws in the ordinary operation of the Services.
• —Not to be discriminated against for exercising these rights.

To exercise any of these rights, contact us at the address below. We may take reasonable steps to verify your identity before acting on a request. Where the law provides for it, you may authorize an agent to submit a request on your behalf, and you may appeal a decision we make on your request by contacting us at the same address.

Because each operator is a separate controller of the fan information they hold, a request made to us reaches our records and, through our agreement with them, theirs. You may also make the request to an operator directly.

California residents may also request details regarding what categories of personal information, if any, we share with third parties or affiliates for their direct marketing.

The Services are not directed to children under 16, and you may not create an account or make a purchase if you are under 16. We do not knowingly collect personal information from anyone under 16. If we learn that we have, we will delete the information and close the account.

If you believe a child under 16 has provided us with personal information, contact us at the address below so that we can take appropriate action.

We keep personal information only as long as we need it for the purposes in this policy or as the law requires. Where a period below is longer than you would expect, it is because a tax authority, a payment scheme, or a royalty obligation sets it rather than because we chose it.

A legal hold — litigation, an investigation, a regulatory request — overrides every period above for the records it covers, for as long as it lasts.

Data reported to a sales-chart reporting body is not covered by this schedule and is not ours to delete. See “Sales reporting, and the one thing we cannot undo.”

If you are a non-U.S. user, by using the Services and providing us with data, you understand and agree that the data you provide may be processed in the United States, where laws regarding the processing of data may be less stringent than the laws of your country.

Residents of the European Economic Area, the United Kingdom, and Switzerland

We do not currently offer the Services to people in the EEA, the UK, or Switzerland. We price in U.S. dollars, we do not localize the Services for those markets, we do not advertise there, and we do not ship there. If you are in one of those places and use the Services anyway, we are not seeking you out.

European data protection law can still apply to some of what happens here — most often because an artist, label, or manager operating a room is established in the EEA, the UK, or Switzerland. Where it does:

MyMaestro AI Inc. is the controller of the personal information described in this policy. Each operator is a separate and independent controller of the fan information they receive, for their own purposes. We are not joint controllers with operators: we each determine our own purposes, and each of us answers for our own.

Our legal bases are performance of our contract with you, our legitimate interests as described in this policy, compliance with legal obligations, and your consent where we ask for it — including for connected accounts and for messages from artists and labels.

Transfers. Where an operator established in the EEA, the UK, or Switzerland gives us fan information, and where we pass personal information to an operator or service provider outside those areas, we do so under the standard contractual clauses, which are incorporated into our agreement with them.

Your rights. You have the right to access the information we process about you, and to request that we correct, modify, erase, or port it, to object to or restrict certain processing, and to withdraw consent where processing is based on it. You also have the right to lodge a complaint with your supervisory authority. To exercise these rights, contact us at the address below.

No method of transmission over the Internet, or method of electronic storage, is fully secure. While we use reasonable efforts to protect your personal information from unauthorized access, use, or disclosure, we cannot guarantee the security of your personal information. In the event that we are required by law to inform you of a breach of your personal information, we may notify you electronically, in writing, or by telephone, if permitted to do so by law.

We have no control over the privacy practices of websites or applications that we do not own, including the sites and services artists and labels operate outside their rooms, and the streaming services you may connect.

We may change our privacy policy and practices over time. To the extent that our policy changes in a material way, the policy that was in place at the time that you submitted personal information to us will generally govern that information unless we receive your consent to the new privacy policy.

If you have any questions, comments, or complaints concerning our privacy practices, please contact us at help@access.fm.

We will attempt to respond to your requests and to provide you with additional privacy-related information.