RHYTOPIA Privacy Policy

RHYTOPIA is a music and creative-economy platform that lets creators upload, transform, publish, and monetize original work. For the purposes of applicable data protection law, RHYTOPIA is the controller of personal data described in this policy, except for payment data processed directly by our Merchant of Record, Paddle, which acts as a controller for its own customer and fraud data.

You can reach us about privacy matters at legal@rhytopia.app, and about account or billing support at support@rhytopia.com. We aim to respond to substantiated requests within thirty (30) days.

We collect the minimum data required to operate the Platform. Depending on which features you use, this includes:

We process personal data to: provide and maintain the Platform (accounts, uploads, streaming, studios); attribute content and route royalties using fingerprinting; process subscriptions and payouts; detect fraud, abuse, and copyright violations; communicate service updates and security notices; and improve the Platform through aggregated, de-identified analytics.

We do not sell your personal data. We do not use your uploads or content to train generative AI models - the Non-AI Content Agreement in our Terms of Use is incorporated by reference here.

Where the GDPR or similar laws apply, our legal bases are: performance of a contract (operating your account and delivering features you use); legitimate interests (fraud prevention, content attribution, security logging, and product improvement, balanced against your rights); consent (optional communications and non-essential cookies, where used); and compliance with legal obligations (tax, accounting, and lawful requests).

We share personal data only with the categories of recipients below, and only to the extent needed to run the Platform:

We keep personal data only as long as needed for the purposes above: account data for the life of your account and a short post-deletion window for backup expiry; transaction and invoice records for the statutory retention periods applicable to tax and accounting; security and moderation logs for a rolling period proportionate to risk. When you delete your account, we delete or de-identify your personal data subject to those legal retention duties.

We protect data with encryption in transit (TLS), hashed credentials, scoped database roles, signed webhook verification, and rate limiting. No system is perfectly secure; we also maintain an internal incident-response process.

Subject to applicable law, you have the right to access your personal data, to rectify or erase it, to restrict or object to processing, to data portability, and to withdraw consent at any time where processing is based on consent. You may also lodge a complaint with your local supervisory authority.

To exercise any right, email legal@rhytopia.app from the address on your account. We will verify your identity before acting on a request and will never discriminate against you for making one.

We use a small number of cookies and equivalent storage strictly to keep you signed in, remember interface preferences (such as theme), and protect against abuse. We do not run third-party advertising trackers on the Platform. You can clear or block these via your browser, though blocking them may break sign-in and core features.

The Platform is not directed at children under 16, and you must be at least 16 to hold an account under our Terms of Use. If we learn that we hold personal data for a child under 16, we will delete it promptly.

We may update this policy as the Platform evolves. Material changes will be announced in the Platform or by email to your account address. The version and effective date at the top of this page always reflect the current policy.

Questions? Contact legal@rhytopia.app.