Epirus Privacy Policy

Effective date: {{EFFECTIVE_DATE}} Last updated: {{LAST_UPDATED}}

Not yet legal advice, and not yet reviewed. This policy was written from the Epirus database schema and source code by a writer who is not a lawyer. It has not been reviewed by qualified counsel or by a privacy professional. It describes what the system actually does today, table by table, but it is not legal advice and must be reviewed — and verified against the live system — by a qualified privacy lawyer before Epirus publishes it or relies on it. Sections marked [COUNSEL] need that review most.

The short version

• We collect what the product needs to work: who you are, what you released, what you played, what you bought, what you earned, and what you said.
• We do not sell your personal information, and we do not share it for cross-context behavioural advertising. There is no ad network in Epirus, no advertising tracker, and no third-party analytics SDK.
• We never see your Face ID or Touch ID data. It never leaves your device. There is no biometric data in our systems at all.
• We never see your bank account or card number. Those go to Stripe.
• What you type into the AI contract writer is sent to OpenAI. Do not put secrets in it.
• Deleting your account deletes most things, but not everything. A released track with other people's earnings attached cannot simply vanish. Section 11 says exactly what survives and why.
• You have real rights over your data, and Section 12 says how to use them, wherever you live.

Table of contents

1. Who is responsible for your data
2. Scope
3. What we collect — the actual list
4. What we do NOT collect
5. Where the data comes from
6. Why we use it, and our legal basis
7. Cookies, local storage and analytics
8. Who we share it with
9. International transfers
10. How long we keep it
11. Deleting your account, and what survives
12. Your rights
13. California and other US state privacy rights
14. Children and young people
15. Security
16. Data breaches
17. Automated decisions and profiling
18. Public information, and what other people can see
19. Changes to this policy
20. How to contact us

1. Who is responsible for your data

1.1 The data controller is {{LEGAL_ENTITY_NAME}}, a {{ENTITY_TYPE_AND_JURISDICTION}}, of {{REGISTERED_ADDRESS}} ("Epirus", "we", "us").

1.2 Contact for privacy matters: {{PRIVACY_EMAIL}} Data Protection Officer / privacy lead: {{DPO_NAME_AND_CONTACT}} EU Article 27 representative: {{EU_REPRESENTATIVE}} UK representative: {{UK_REPRESENTATIVE}}

1.3 One important note about roles. Where you sell something on Epirus, you are also a controller of your buyers' data for your own purposes — fulfilling the order, keeping your tax records, answering their questions. Section 8.6 covers what that means for you.

2. Scope

This policy covers the Epirus website, the iPhone and iPad app, the Mac app, and our APIs. It does not cover third-party services you reach from Epirus — a linked YouTube video, an external radio stream, Stripe's own onboarding pages — which have their own policies.

3. What we collect — the actual list

This is not a generic list. It is what the Epirus database actually holds, described by what it is for.

3.1 Account and identity

3.2 Content you create

Tracks, albums, videos, podcasts and episodes, beats, playlists, posts, stories, comments, track comments, product listings, service listings, events, live streams, and any file you upload — together with their metadata, artwork, descriptions and upload records (tracks, albums, videos, podcasts, episodes, beats, playlists, posts, stories, comments, post_comments, track_comments, products, services, events, live_streams, file_uploads, branding_assets, recording_projects, competition_entries).

3.3 What you do on Epirus

3.4 Messages and live chat

Direct messages and their attachments, read receipts, reactions, replies, deletions, conversation settings, blocked users, and live-stream chat (messages, conversations, conversation_settings, message_reactions, message_deletions, blocked_users, live_stream_chat).

Direct messages are not end-to-end encrypted. We can access them and will where we must — a safety report, a legal request, keeping the service running.

3.5 Money

3.6 Points, collectibles and governance

EXP balances and every EXP transaction with its reason (exp_wallets, exp_transactions, exp_rules, epx_*); EIP balances and grants (eip_balances, eip_grants); creator coin holdings (coin_holdings, creator_coin_ledger); collectibles you created, hold or transferred, with provenance and any on-chain reference (efts, eft_ownership, eft_mints, eft_offers, eft_provenance, eft_activity); governance proposals and votes (governance_proposals, governance_votes, board_seats); competitions, entries, wagers and predictions (competitions, competition_entries, competition_wagers, competition_bets, exp_wagers, challenge_claims, leaderboard).

3.7 Agreements and rights records

Contracts you draft, send, receive and sign, including the full contract text, the description you typed, the terms, the parties, the signature flags and timestamps, and any hash or transaction reference written to a ledger (contracts, music_contracts, collab_contracts, library_contracts, contract_templates); splits and collaborator records (collaborations, collaboration_members, track_collaborators, track_credits, beat_royalty_configs, beat_license_templates); track registrations with audio and metadata hashes (track_registry).

3.8 Support, safety and moderation

Support tickets and their message threads (support_tickets, support_ticket_messages); reports you file about content or people, including your identity as the reporter (content_reports, reports); records of administrative action (admin_audit_log).

3.9 Device and technical

We use IP addresses for security, abuse prevention, fraud detection, rate limiting and rough country-level context. We do not build an advertising profile from them.

3.10 AI feature inputs and outputs

3.11 Linked external accounts

If you connect them: your Apple Music artist identifier and the date you linked it, and your YouTube channel identifier (profiles.apple_music_artist_id, profiles.youtube_channel_id, youtube_artists).

3.12 Special category data

We do not ask for, and do not want, data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation, or criminal convictions. If you put such information into a bio, a post, a lyric, a message or a support ticket, you have chosen to make it public or to give it to us, and we process it on the basis of that manifest choice or your explicit consent. Please do not put it in a support ticket unless it is genuinely necessary.

4. What we do NOT collect

Stating the negatives plainly, because they matter more than most of the list above.

4.1 No biometric data — none, ever. Face ID and Touch ID are features of your Apple device. The scan is captured, stored and matched entirely on the device, inside Apple's Secure Enclave. Apple does not make it available to apps, and Epirus does not ask for it. All the app ever receives is a yes-or-no answer from the operating system.

We do not collect, capture, purchase, receive through trade, store, transmit, disclose, redisclose, sell, lease or otherwise profit from any biometric identifier or biometric information, as those terms are used in the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, the Washington biometric statute, Colorado's biometric provisions, or any similar law. There is no biometric retention or destruction schedule because there is nothing to retain or destroy. The web version of Epirus cannot use Face ID or Touch ID at all — browsers do not expose them.

4.2 No bank account numbers or card numbers. Payment details go directly to Stripe. We store Stripe's identifiers and the amounts, and nothing that could be used to charge a card or debit an account.

4.2a Government identity documents. We do not ask for, collect or store a passport, driving licence, national identity card or any image of one. Where identity has to be verified for a payout, Stripe performs that check under its own privacy policy and does not pass the documents to us. Our record of your age is the date you told us, not a document.

4.3 No precise device location tracking. We do not collect continuous or background GPS. The only coordinates we hold are the ones attached to an address you deliberately saved.

4.4 No advertising identifiers, no ad networks, no cross-site tracking pixels, no third-party analytics SDK. There is no Google Analytics, no advertising tag, and no data broker relationship in Epirus.

4.5 No reading of your device's contacts, photo library, calendar or microphone except where you actively use a feature that needs it (picking a photo to upload, going live) and grant the operating system permission for that use.

4.6 No sale of personal information. See Section 13.

5. Where the data comes from

5.1 From you — everything you type, upload, buy, sell, play and send.

5.2 From your use of the Service — plays, watch progress, likes, searches, timestamps, device and log data.

5.3 From other members — if someone names you in a split, sends you a contract, tags you in a credit, gifts you a subscription, books your service, reports you, or messages you.

5.4 From service providers — Stripe tells us whether your payout account is verified, whether a payment succeeded, and when a chargeback is filed. Apple tells us whether a push was accepted. Suno tells us when a generation finished.

5.5 From public sources you point us at — a YouTube channel or an Apple Music artist page you link to your profile.

6. Why we use it, and our legal basis

For members in the EU, the UK and other GDPR-style jurisdictions, the table below states the Article 6 legal basis for each purpose. Members elsewhere: this is a plain statement of purpose regardless of whether the GDPR applies to you.

6.1 Our legitimate interests, stated. Where we rely on legitimate interests, the interests are: running a music platform that works, paying creators accurately, keeping fraud and abuse out, understanding which features people use, and defending ourselves. We have considered your interests against ours in each case, and you can object — see Section 12.

6.2 Withdrawing consent. Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that already happened.

7. Cookies, local storage and analytics

7.1 Epirus is deliberately light here, and this section describes what is actually implemented rather than a generic cookie policy.

7.2 First-party analytics only. Product usage events are recorded into our own analytics_events table with a session identifier. That data goes nowhere else. There is no Google Analytics, no Meta pixel, no advertising tag, no session-replay tool and no third-party analytics SDK in the product.

7.3 Consent banner. Because we set no advertising or third-party tracking cookies, most of what we use falls within the strictly-necessary and functional exemptions under the EU ePrivacy Directive and the UK PECR. [COUNSEL] Whether the first-party product analytics in 7.2 requires prior consent for EU/UK visitors is a judgment call that depends on how granular the events are; a consent mechanism may still be required. This needs a specific answer before EU launch.

7.4 Do Not Track and Global Privacy Control. We do not engage in cross-context behavioural advertising, so there is nothing for a Do Not Track signal to switch off. Where the law requires us to treat a Global Privacy Control signal as an opt-out request, we honour it.

8. Who we share it with

We do not sell your personal information. We share it in these situations, and no others.

8.1 Service providers

Each is bound by a data processing agreement, may only use the data to provide the service to us, and may not use it for its own purposes. [COUNSEL] Confirm a signed DPA and, where relevant, an SCC/IDTA transfer mechanism is in place with each of these before publication, and that OpenAI's API terms with zero-retention or 30-day-retention settings are configured as this policy implies.

8.2 Other members

Your public profile, releases and public activity are visible to everyone. Where you transact with someone, they see what the transaction requires — a seller sees the buyer's name and shipping address, a booking provider sees the client name and email, and a contract counterparty sees your name and signature record. See Section 18.

8.3 When you report someone

We share what we need to with the reported member and, where necessary, with law enforcement. We do not routinely disclose the reporter's identity, but we may where it is necessary to act on the report or where the law requires it. We cannot promise anonymity.

8.4 Copyright complainants

When we receive a DMCA notice, we forward it — including the complainant's name and contact details — to the member who posted the material, as the DMCA contemplates. When we receive a counter-notice, we forward that, including the counter-notifier's name and address, to the complainant.

8.5 Legal and safety

We disclose where we believe in good faith it is necessary to comply with a law, subpoena, warrant, court order or regulatory request; to enforce our Terms; to detect or prevent fraud or a security issue; or to protect the rights, property or safety of anyone. Where we are permitted to tell you about a legal request, we try to.

8.6 If you are a seller

When you sell something, we give you the buyer information you need to fulfil it. You then become a controller of that data in your own right. You must use it only to fulfil the order and meet your legal obligations, keep it secure, not add the buyer to a marketing list without their consent, and delete it when you no longer need it. Misusing buyer data is a breach of the Terms.

8.7 Corporate transactions

If Epirus is acquired, merged, reorganised or wound up, data may transfer to the successor, subject to this policy. We will tell you if control of your data changes.

8.8 Aggregated and anonymised data

We may publish or share statistics that cannot identify anyone — total plays, genre trends, platform totals. This is not personal data and this policy does not restrict it.

9. International transfers

9.1 Epirus operates from the United States — our database, authentication and file storage are hosted in the AWS us-west-2 region in Oregon — and our providers operate globally. Your data may be processed in the United States and elsewhere, including countries whose data protection law differs from your own.

9.2 Where we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on one of:

• the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum where the UK is involved;
• an adequacy decision, where one covers the destination;
• the EU–US Data Privacy Framework and its UK Extension, where the recipient is certified;
• a derogation under Article 49 where necessary — for example, where a transfer is necessary to perform the contract you asked for.

9.3 We carry out transfer impact assessments where required. You can ask us for a copy of the safeguards used for a specific transfer at {{PRIVACY_EMAIL}}.

10. How long we keep it

We keep personal data only as long as we need it for the purpose we collected it, or as long as the law requires.

Where a period is not fixed, we apply the criteria: how long the account is active, how long a legal obligation runs, and how long a claim could still be brought.

11. Deleting your account, and what survives

11.1 How. Ask at {{PRIVACY_EMAIL}} or support@epirus.club, or use the deletion route in your account settings. We will confirm your identity, tell you what will happen to released work and outstanding splits, and then do it. We aim to complete deletion within 30 days.

11.2 What is deleted. Your profile, avatar and cover image, bio and links, unreleased and ungated content you own outright, playlists, likes, saves, follows, search history, listening and watch history, radio history, story views, draft contracts, push tokens, device records, product analytics tied to you, and your access to the Service.

11.3 What survives, and why. We will not pretend a released record can be unmade. It cannot, and the reasons are other people.

11.4 EXP, EIP and coins end with the account. They have no cash value and are not paid out. See the Terms.

11.5 Cash balance. A remaining US-dollar balance is paid to your connected payout account before deletion, less anything you owe.

11.6 An alternative. If your concern is visibility rather than existence, ask us about deactivating instead — hiding your profile while leaving splits and licences intact. It solves most of what deletion is usually reached for, without breaking other people's earnings.

11.7 Legal basis for what survives. Retaining the above is necessary to comply with a legal obligation (Art. 6(1)(c)), to perform contracts with other members (Art. 6(1)(b)), and for our and others' legitimate interests in exercising and defending legal claims (Art. 6(1)(f)) — which is an express exception to erasure under Article 17(3) GDPR.

12. Your rights

These rights are strongest if you are in the EU, the UK or Switzerland, but we apply the substance of them to everyone, wherever you live, except where the law prevents us.

12.1 You can ask us to:

12.2 How. Email {{PRIVACY_EMAIL}}, or use the data tools in your account settings. We will respond within 30 days (one month), extendable by two further months for complex requests, and we will tell you if we need the extension.

12.3 Verification. We need to be sure it is you. We may ask you to confirm from the email on your account, or to provide additional confirmation for a high-risk request. We will not ask you for more than we need, and we will not create an account just to verify you.

12.4 Cost. Free, unless a request is manifestly unfounded or excessive — in which case we may charge a reasonable fee or refuse, and we will explain why.

12.5 Authorised agents. You can use an authorised agent. We will ask for proof of their authority and may ask you to confirm directly.

12.6 No retaliation. We will never deny you service, charge you a different price, or give you a worse experience because you exercised a privacy right.

12.7 Complaints. Please come to us first — {{PRIVACY_EMAIL}} — but you do not have to. You can complain to:

• EU: the data protection authority in your country of residence, work, or where the issue occurred. Our lead authority is {{LEAD_SUPERVISORY_AUTHORITY}}.
• UK: the Information Commissioner's Office, ico.org.uk.
• Switzerland: the Federal Data Protection and Information Commissioner.
• US states: your state Attorney General.

13. California and other US state privacy rights

This section applies to residents of California, and — where a comparable law grants the same right — Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with a comprehensive privacy law.

13.1 Categories collected in the last 12 months, using the CCPA/CPRA vocabulary:

13.2 Sources, purposes and disclosures are in Sections 5, 6 and 8. Retention is in Section 10.

13.3 We do not sell personal information, and we do not share it for cross-context behavioural advertising — as "sell" and "share" are defined in the CPRA — and we have not done so in the preceding 12 months. We do not sell or share the personal information of anyone we know to be under 16. There is nothing to opt out of, but if you send us an opt-out request or a Global Privacy Control signal we will record and honour it anyway.

13.4 We do not use or disclose sensitive personal information for any purpose other than those permitted by CPRA § 1798.121(a) — performing the service, security, fraud prevention, and the like. You therefore have no "limit the use of my sensitive personal information" right to exercise here, and we would honour a request regardless.

13.5 Your rights — to know, access, correct, delete, port, opt out of sale/sharing, limit sensitive-PI use, and not be retaliated against — are exercised the same way as Section 12.2: {{PRIVACY_EMAIL}}. California residents may also use {{CA_PRIVACY_REQUEST_ROUTE}}.

13.6 "Shine the Light". California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. We make none.

13.7 Notice at collection. This policy is our notice at collection. We collect the categories above, for the purposes above, retained for the periods above, and we neither sell nor share them.

14. Children and young people

14.1 Epirus is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. We do not knowingly permit an under-13 account.

14.2 If we learn we have collected personal information from a child under 13 without verifiable parental consent, we delete it promptly, subject to records we must keep. Parents or guardians who believe a child has given us data should write to {{PRIVACY_EMAIL}} with enough detail to find the account; we will act quickly and without requiring a formal process.

14.3 The minimum age for an Epirus account is 13. Where you live sets a higher digital-consent age, that applies.

14.4 We do not sell or share the personal information of anyone under 16, and we do not use anyone under 18's data for targeted advertising or profiling with legal or similarly significant effects.

14.5 For accounts belonging to minors above the floor, see the Terms on payouts, signing and parental involvement.

We ask for your date of birth once, when you set up your profile. It is the first thing the setup asks, before your name or your picture, so that if the Service is not available to you we have collected as little about you as possible before finding out.

What we do with it:

• We store the date itself, and the date you answered.
• We derive two things from it: whether you are old enough to use Epirus at all, and whether you are over 18. The second one matters because payouts, selling and contracts work differently for a minor — see the Terms, Section 3.
• No other member can see it. It is never shown on your profile and never returned by any public query. It is not stored on your profile at all — it lives in a separate table that signed-out visitors hold no access to and that other members cannot read, because your profile itself is public by design and a birthday on it would have been public too.
• We do not use it for advertising, audience segmentation, birthday marketing, or any purpose other than the two above.

If you tell us you are below the minimum age, we record that a check was failed and we do not set the account up. We keep that record specifically so that the same account cannot immediately try again with a different date — not to build a profile of you.

You cannot change it yourself once it is set. A date of birth that can be edited on demand is not an age check. If yours is wrong, contact support and they will correct it after confirming it is really your account.

[COUNSEL] Collecting a date of birth strengthens the COPPA position considerably — it moves the Service from an unverified attestation to a recorded answer with a refusal trail. It does not by itself amount to "age assurance" or "age verification" as those terms are used in the UK Age Appropriate Design Code, or in the state age-verification statutes now in force, several of which contemplate documentary or inferential verification for some categories of content. Whether Epirus needs to go further than a self-reported date is a question about the content on the platform and the jurisdictions it serves, and it needs counsel. Note also that a date of birth is itself sensitive personal information under several state privacy laws — collecting it creates obligations as well as discharging them.

15. Security

15.1 We protect data with: encryption in transit (TLS) and at rest; row-level security in the database, so a member's queries can only reach rows they are entitled to; scoped access tokens; secrets held server-side and never shipped to the browser; server-side enforcement of content gates, so a gated stream is never sent to someone who has not paid; presigned, time-limited upload URLs; rate limiting; and an audit log of administrative action.

15.2 Access to member data by our staff is limited to those who need it, and administrative actions are logged.

15.3 Payment card data never touches our systems. Biometric data never touches our systems.

15.4 No system is perfectly secure. We cannot guarantee absolute security, and you have a part in it: use a strong unique password, keep your device locked, and never give your password to anyone — we will never ask you for it.

16. Data breaches

16.1 If a personal data breach occurs, we will investigate immediately and contain it.

16.2 Where required, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, as GDPR Article 33 requires.

16.3 Where a breach is likely to result in a high risk to your rights and freedoms, or where US state breach notification law requires it, we will notify you directly without undue delay, describing what happened, what data was involved, what we have done, and what you should do.

16.4 We maintain an internal record of breaches whether or not they are notifiable.

17. Automated decisions and profiling

17.1 We use automated processing for: recommendations and feed ranking; spam, fraud and play-inflation detection; EXP and EIP awards; and the engagement score that weights the merit component of artist payouts.

17.2 The payout score is the one that matters to you financially. It is calculated from real engagement on your work and is itemised on every payout, so you can see how the number was reached rather than being asked to trust it. If you think a payout figure is wrong, you can ask a human to review it — open a support ticket, and a person will look at the calculation and explain or correct it.

17.3 We do not make decisions producing legal or similarly significant effects about you based solely on automated processing without human involvement, except where automated fraud or abuse detection results in a restriction — in which case you can appeal and get a human review, as Section 10.5 of the Terms sets out.

17.4 You have the right to obtain human intervention, express your point of view, and contest a decision.

18. Public information, and what other people can see

18.1 Public by default: your display name, username, avatar, cover image, bio, location text, links, genres, roles, verification badge, follower and following counts, releases, public posts, public playlists, comments, live streams, and your governance proposals and votes.

18.2 Visible to specific people: direct messages (the recipient), transaction details (your counterparty), splits and contracts (the named parties), booking details (the provider), and your name on a credit (anyone who sees the release).

18.3 Private: your email address, your addresses, your payment and payout records, your wallet balances, your search and listening history, your support tickets, your drafts, and your reports.

18.4 Anything you make public can be copied, screenshotted, cached by search engines and archived by third parties. We cannot pull it back from those places. Think before you post.

19. Changes to this policy

19.1 We may update this policy. The "Last updated" date at the top changes when we do.

19.2 For material changes — a new category of data, a new purpose, a new recipient — we will give notice by email or in the Service at least 30 days before they take effect, and where the law requires consent for the change, we will ask for it rather than assume it.

19.3 We keep prior versions and will provide one on request.

20. How to contact us

We answer privacy mail in the order it arrives, and a person reads all of it.

Reminder: this policy has not been reviewed by a lawyer or a privacy professional, and its factual claims must be re-verified against the live system before publication. Both are required before it is relied upon.