Legal
Privacy Policy
Last Updated: March 6, 2026
1. Data Protection Officer
Name: Gyeongjin Park · Title: CEO & Founder · Email: support@rawtrak.com For any privacy-related inquiries, access requests, or deletion requests, please contact us at the above email.
2. Information We Collect
Information You Provide: Email address, name (or stage name), music metadata (track title, artist name, album name, genre, lyrics, ISRC, etc.), profile information (photo, bio). Information Collected Automatically: IP address, browser type, operating system, service usage records (access times, pages viewed), device information. Through Third Parties: Payment and payout information is managed directly by Stripe and not stored on RAWTRAK servers. Copyright verification results via ACRCloud audio fingerprinting. We Do Not Collect: Government-issued ID numbers (SSN, passport), or sensitive personal data (health, religious beliefs, union membership).
3. How We Use Your Information
Collected information is used solely for: music distribution (DSP delivery, metadata transmission), revenue calculation and royalty payouts, pre-upload copyright verification (ACRCloud), customer support, anonymized usage analytics, and service-related notices. We do not sell, share, or provide your personal information to third parties for marketing purposes.
4. Third-Party Sharing & International Data Transfers
DSPs (Spotify, Apple Music, etc.) — Music files, metadata, artist name — for distribution — Global Stripe — Email, payout amounts — payment processing — USA ACRCloud — Audio fingerprint (not the file) — copyright & AI detection — Asia Pacific Supabase — Account info, metadata — database & storage — Japan (ap-northeast-1) Vercel — None (static hosting) — website hosting — Global CDN Resend — Email address — service email delivery — USA Your personal data may be transferred to servers in the US, Japan, and other countries. Each third-party service processes data under its own privacy policy. We only use services that maintain appropriate security standards.
5. Music File Handling
Uploaded music files are stored temporarily for copyright verification and DSP delivery. After successful delivery to DSPs, original music files are deleted from RAWTRAK servers (Supabase Storage). Audio fingerprints (digital signatures, not the music files themselves) may be retained for duplicate detection purposes.
6. Data Retention
Account info (email, name) — duration of service + 30 days after cancellation Distribution & payout records — up to 5 years after service end (Korean E-Commerce Act / US IRS requirements up to 7 years) Service usage logs — up to 1 year (fraud prevention) Audio fingerprints — duration of service, deleted upon cancellation Upon account cancellation, all personally identifiable information is deleted within 30 days, except where retention is required by law.
7. Data Security
In transit: TLS 1.3 encryption At rest: AES-256 encryption (Supabase) Access control: Supabase Row Level Security (RLS) enforcing least-privilege access Authentication: Service role keys used only in server environments Passwords: Stored as hashed values only (never in plain text)
8. Your Rights
Right of Access: Request a copy of your personal data. Right to Rectification: Request correction of inaccurate data. Right to Erasure: Request deletion (subject to legal retention obligations). Right to Restrict Processing: Request temporary suspension of data processing. Right to Data Portability (EU residents): Under GDPR, receive your data in machine-readable format. Right to Opt-Out of Sale (California residents): Under CCPA, opt out of personal information sale. (Note: RAWTRAK does not sell personal information.) Requests: support@rawtrak.com · Response time: within 14 business days (up to 30 days for complex requests).
9. Children's Privacy
RAWTRAK does not knowingly collect personal information from users under the age of 18. If we become aware that a user under 18 has registered without parental consent, the account and associated personal data will be deleted immediately.
10. Cookies & Analytics
We use only essential cookies required for service operation (authentication sessions, CSRF tokens, etc.). We do not use third-party advertising cookies or behavioral tracking cookies. If analytics tools are introduced in the future, users will be notified and asked for consent beforehand.
11. Changes to This Policy
If this privacy policy is updated, we will provide at least 30 days' notice via email or in-service notification. For significant changes such as expanded data collection or changes in usage purposes, we will obtain separate consent. Updated policies will be posted at rawtrak.com.