Privacy Policy

This Privacy Policy explains how [COMPANY LEGAL NAME, e.g. PubCat LLC] (“PubCat,” “we,” “us”) collects, uses, shares, and protects personal information when you use the PubCat website and services (the “Service”). It is part of our Terms of Service. The Service is operated from the United States and is intended for adults 18 and older.

Information you give us

• Account: email address and name, received from the sign-in method you choose (email, Google, or Apple).
• Writer profile: legal and professional names, PRO affiliation, IPI/CAE number, country, genres, bio, and current publisher.
• Contact card: contact email, phone, website, and manager name and email.
• Catalog: song titles, artists, recording identifiers (such as ISRCs), work identifiers, and split sheets, including co-writer names, shares, and identifiers you enter.
• Identity verification: images of a government-issued photo ID and of your face, plus the document type and issuing country (see Section 4).
• Publisher accounts: organization name, team members, plan, and billing history. Card details go directly to our payment processor; we never receive or store full card numbers.
• Communications: messages you send us.

Information collected automatically

• Technical and log data: IP address, browser and device type, pages and features used, search queries, and timestamps, used for security, abuse prevention (including rate limiting), and troubleshooting.
• Cookies: we use cookies that are necessary to sign you in and keep your session secure, and first-party cookies that remember how you arrived (for example, the ad campaign or link that brought you to PubCat) so we can measure which channels bring writers to the Service. Advertising cookies and pixels from Meta, TikTok, and Google load only if you allow them (Section 6).

Information from other sources

We compile publicly available and licensed music industry data (for example, published song and recording metadata, rights-registry listings, and public streaming or view counts). This data can include the names of writers, artists, and publishers as they appear in those sources.

If you give us information about another person, such as a co-writer or manager, you confirm that you have the right to do so.

• to provide, operate, and maintain the Service, including your catalog and matching it against royalty and industry data;
• to verify writers' identities and prevent impersonation and fraud;
• to show your information to publishers when you have chosen to share your catalog (Section 5);
• to process subscriptions, credits, and payments;
• to send service messages, such as verification decisions and notices that a publisher unlocked your profile;
• to secure the Service, enforce our Terms, and comply with law; and
• to analyze and improve the Service, using aggregated or de-identified information where practical.

We do not sell your personal information for money. If you allow advertising cookies, we share limited sign-up events with advertising platforms to measure and improve our ads (Section 6); you can turn this off at any time. We do not use your information to train third-party AI models.

To become discoverable to publishers, writers submit a photo of a government ID and a photo of their face. We collect these images only with your written consent, given when you submit them, and use them only to verify your identity.

• A trained member of our team compares the images by eye. We do not scan face geometry, create facial templates or other biometric identifiers, or use automated facial recognition.
• Images are uploaded directly to encrypted, access-restricted storage and are viewable only by authorized reviewers.
• We never sell, lease, trade, or otherwise profit from these images, and we do not disclose them except to our hosting provider as a processor, or when required by law.
• Retention: images are permanently deleted once a verification decision is made and in any event no later than 30 days after upload, and never later than the time allowed by applicable law. We keep only the outcome (approved or rejected, date, document type, and issuing country).

You may withdraw consent before a decision by contacting [privacy@yourdomain.com], and we will delete the images.

• With publishers, at your direction. If you are verified and turn on catalog sharing, subscribed publishers can see limited, anonymized information about your catalog. If a publisher unlocks you, we disclose your profile, contact card, and catalog to that publisher. Publishers are independent businesses that use this information under their own responsibility; we cannot retrieve it after it is disclosed. We tell you which organizations unlocked you on your profile.
• Writers from PubCat's previous service. If you registered songs with PubCat's previous service, your song catalog and the email address you registered with may be listed to subscribed publishers as an unverified writer, and a publisher who unlocks that listing receives your email and catalog. To have your listing removed, email [privacy@yourdomain.com]. If you sign up again with the same email, your songs move into your new account and the listing ends; from then on your account's sharing settings apply.
• Service providers that process data on our behalf under contract, including cloud hosting, identity/sign-in, and email (Microsoft Azure), payments (Stripe), and music metadata lookup (song search queries are sent to a third-party music catalog provider).
• Legal and safety: when we believe disclosure is required by law or legal process, or needed to protect the rights, property, or safety of PubCat, our users, or others, or to investigate fraud or abuse.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your consent or at your direction.

We advertise PubCat on Meta (Facebook and Instagram), TikTok, and Google (including YouTube). To learn which ads bring songwriters to the Service, and to let those platforms show our ads to people more likely to find them useful, we measure a few steps of the sign-up journey: creating an account, adding your first song, and verifying your ID (for publishers: starting a trial or subscription).

• First-party measurement: when you arrive from an ad or link, we record the campaign tags and ad click identifier in a first-party cookie and connect them to your account when you sign up. This stays with us.
• Only if you allow advertising cookies: we load the Meta Pixel, TikTok Pixel, and Google tag, and we send the events above to those platforms from our servers (Meta Conversions API, TikTok Events API, and Google Analytics Measurement Protocol). Each event includes the event name and time, an event identifier, the ad click identifier, your browser's IP address and user agent, and your email address and account identifier in hashed (SHA-256) form, which the platforms use to match the event to their users. We never send your songs, catalog, contact card, royalty information, or ID images.
• The platforms process this information under their own privacy policies, and this can be “sharing” for cross-context behavioral advertising or “targeted advertising” under U.S. state laws. You can opt out at any time below, and we honor Global Privacy Control browser signals as an opt-out.

We keep personal information for as long as your account is active and as needed to provide the Service, then for as long as reasonably necessary for the purposes in this Policy, such as resolving disputes, preventing fraud, enforcing agreements, and meeting legal, tax, and accounting obligations (for example, billing and unlock records). ID and face images follow the shorter schedule in Section 4. When information is no longer needed, we delete or de-identify it; residual copies in backups are deleted on the backup schedule.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, role-based access controls, and separate restricted storage for identity documents. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your sign-in credentials secure. If we learn of a security breach affecting your personal information, we will notify you as required by law.

• Profile and catalog: view and edit them at any time in the Service.
• Catalog sharing: turn it off at any time on your profile. This stops new unlocks but does not affect information publishers already received.
• Emails: service messages are part of the Service; we do not send marketing email without your consent.
• Account deletion: writers can permanently delete their account under My Profile → Delete account; anyone can also email [privacy@yourdomain.com]. Deletion is subject to the retention exceptions in Section 7.

Depending on where you live (including California, Colorado, Connecticut, Virginia, and other U.S. states), you may have the right to know, access, correct, delete, or obtain a copy of your personal information, and to opt out of sale, sharing for targeted advertising, or certain profiling. We do not sell personal information for money or engage in such profiling; to opt out of sharing for advertising, use the control in Section 6 or send a Global Privacy Control signal. To exercise any other right, email [privacy@yourdomain.com]. We will verify your request using information associated with your account, you may use an authorized agent where the law allows, and you may appeal a denial by replying to our decision. We will not discriminate against you for exercising your rights. We treat Global Privacy Control signals as an opt-out where required.

We process information in the United States, where data protection laws may differ from those in your country. If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your information to perform our contract with you, on the basis of your consent (for identity images and catalog sharing, which you may withdraw), for our legitimate interests in operating and securing the Service, and to comply with legal obligations. You may have rights to access, rectify, erase, restrict, or object to processing, to data portability, and to lodge a complaint with your local supervisory authority. Where required, we use appropriate safeguards such as standard contractual clauses for transfers.

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us information, contact [privacy@yourdomain.com] and we will delete it.

We may update this Policy from time to time. If a change is material, we will notify you by email or in the Service before it takes effect. The effective date above shows when it last changed.

Questions or requests: [privacy@yourdomain.com] · [COMPANY LEGAL NAME, e.g. PubCat LLC], [MAILING ADDRESS]