Privacy Policy

Website & applications

Soundtrade SRL, Șos. Nordului nr. 62B, sc. C, et. 2, ap. 2E, Sector 1, București, România, operates this website. When you apply, we process the contact details, location, artist or label information, catalogue links and rights information you submit to assess your application and contact you about onboarding. Support enquiries are used to respond to your request.

Application review is carried out to take steps at your request before entering a contract. Account security and abuse prevention protect the service and its users. Information is available to authorised reviewers and the technical providers needed to deliver the service. Retention depends on the application, support request and any applicable record-keeping requirements; you can ask us about a specific record.

Submitting an application is not consent to marketing. See Cookies for browser authentication storage. Contact privacy@sound-trade.com for access, correction, deletion or other privacy requests.

Pro

Soundtrade SRL processes account, identity, representation, tax residence, title evidence, contractual acceptance and transaction data to provide services, assess eligibility, prevent fraud and meet legal obligations. Identity/payment providers receive necessary data; authorized staff and technical providers have limited access. Retention follows the purpose and applicable obligations, including contractual and fiscal archives after account closure. Contact SoundTrade support to exercise access, correction, erasure, restriction, portability or objection rights where applicable. You may complain to ANSPDCP or the competent authority. Acknowledgement of this notice is not marketing consent.

1. Who is responsible

Soundtrade SRL (“SoundTrade”), Șos. Nordului nr. 62B, sc. C, et. 2, ap. 2E, Sector 1, București, România, is responsible for the personal information it uses to operate the investor app. Contact privacy@sound-trade.com for privacy requests or questions.

This notice covers account registration, browsing and watchlists, rights transactions and bids, wallet and royalties, Pies, referrals, support, security and notifications. It also covers features used during a TestFlight preview. It does not mean that every financial feature is enabled or that a TestFlight build processes live payments.

2. Information we use and where it comes from

The information depends on the features you use:

• Account and contact information you provide: name, display name, email address, phone number and country calling code, date of birth, address and country, account identifiers, preferences and protected sign-in credentials.
• Identity and eligibility information: verification references and results, legal name, age and residence details, and review records. For a Stripe Identity check, Stripe collects the document image and selfie directly through its native verification screen inside the SoundTrade app. SoundTrade stores the session reference, status and account-match result; it does not copy the document image, selfie or biometric template into its own database. Authorised staff may need to inspect information through a provider interface when reviewing a case.
• Financial, rights and contract information: deposits, withdrawals, balances, bids, orders, payments, ownership, rights agreements, royalty entitlements, statements, invoices and the records needed to explain or correct them.
• Content and choices: watchlists, Pies you create or follow, public Pie details, referral activity, support messages and attachments, and notification settings.
• Security and technical information: device and app details, sign-in and session events, network and diagnostic records, and a push token if you enable phone alerts.

We receive most information from you and your use of the app. We may also receive transaction and payment results from providers, identity-check results from a verification provider, and asset or royalty information from Asset Managers, rights holders and music-data sources. If such information relates to your account or position, we treat it as personal information.

3. Why we use it

• To create and operate your account, show the catalogue, manage your choices, provide support and carry out transactions you request: to perform our contract with you, or to take steps you request before entering it (GDPR Article 6(1)(b)).
• To verify eligibility, maintain transaction and accounting evidence, respond to valid requests from authorities and meet applicable tax, financial or other record-keeping duties: to comply with a legal obligation where one applies (Article 6(1)(c)).
• To protect accounts, detect fraud or misuse, investigate discrepancies, secure the service, resolve disputes and defend legal claims: our legitimate interests in operating a reliable marketplace and protecting users and SoundTrade (Article 6(1)(f)), subject to your rights and the applicable balancing assessment.
• To send optional phone alerts you enable: your consent given by enabling alerts in the app and allowing them on your device (Article 6(1)(a)). You can switch off categories in the app or revoke device permission. If another use needs consent under applicable law, we request it separately; accepting the Terms & Conditions or reading this notice is not that consent.

When you participate in a referral programme, we use referral information to provide the requested programme under its terms (Article 6(1)(b)), and to prevent duplicate or abusive rewards under our legitimate interests (Article 6(1)(f)). We record any confirmed credit; an unconfirmed referral is not money belonging to you.

4. Information required for an account

Registration requires a name, email address, phone number with country calling code, date of birth and password. We cannot create or secure an account without these details. A phone number supplied at registration is not automatically verified as belonging to you. You must be at least 18. Before a financial activity is allowed, we may also require your legal name, identity, residence and payment details; without a successful check, the activity can remain unavailable.

Optional information, such as Pie content, referral participation and phone-alert preferences, is needed only for the feature you choose. Do not send identity documents in an ordinary support message.

5. Identity verification

For the TestFlight identity check, we open a Stripe Identity verification screen inside the native SoundTrade app, tied to an internal account reference. This is a real identity check, even though financial activity in staging is simulated. You submit your identity document and selfie directly to Stripe. SoundTrade receives the verification status and limited verified outputs needed to compare the name and date of birth with your account and check the age requirement. We use this result to assess eligibility for an activity you request (Article 6(1)(b)), meet a legal verification duty if applicable (Article 6(1)(c)), and prevent impersonation and fraud (Article 6(1)(f)). A successful identity check is one part of eligibility; it does not by itself enable trading or confirm every legal requirement.

Stripe also handles identity information for its own stated purposes as an independent controller. Its privacy practices, including image and biometric processing and retention, are explained at https://stripe.com/privacy. Any consent required for biometric processing is requested in the verification flow separately. If you cannot or do not wish to use the Stripe check, contact SoundTrade Support to ask what alternative review is available; a request does not itself verify your identity or enable financial actions.

6. Who receives information

Access within SoundTrade is limited to staff who need information for support, verification, security, finance and administration. Depending on the service used, information may also go to:

• Stripe and other payment or identity providers for the relevant check, payment or payout;
• hosting, storage, email and technical providers operating the service on our behalf;
• Expo and Apple or Android delivery services if you enable phone alerts;
• an Asset Manager, rights holder or transaction party when their identity and contract details are needed for a rights agreement or royalty statement;
• professional advisers, auditors, courts, regulators or public authorities when a valid need or legal duty applies.

A public Pie can show its creator label, name, description, cover art and selected assets. It is not intended to reveal your private address or date of birth. We do not sell personal information or identity documents.

7. Phone alerts

If push delivery is active and you allow notifications, we associate a push token with your account and send selected alerts through Expo Push Service and the relevant device platform. Notification text may appear on a locked screen according to your device settings. You can change supported categories in the app and disable alerts in your device settings. An in-app notification may still appear when push delivery is unavailable or switched off.

8. Transfers outside the EEA

Some providers, including Stripe and mobile push-delivery services, may process information outside the European Economic Area. For a transfer subject to GDPR Chapter V, the applicable mechanism may be an adequacy decision or a safeguard such as standard contractual clauses. Contact privacy@sound-trade.com for the destination and mechanism relevant to your information, and how to obtain a copy of any applicable safeguard. A future live feature must be checked against its actual providers and transfers before activation.

9. How long we keep it

We keep account and profile information while the account is open and afterwards only while needed to resolve closure, protect the service, meet applicable legal duties or address claims. Transaction, contract, royalty and accounting records can remain after closure for the statutory record period and while a related claim or correction is possible. Support cases and security events are kept for the time needed to resolve the case and any related legal or fraud issue. A push token is removed when it is no longer needed for a connected device or account.

Identity images and biometric information submitted through Stripe are subject to Stripe’s own retention rules and any deletion instruction SoundTrade can make for the verification service. SoundTrade retains its verification reference and outcome only for the related eligibility, compliance or dispute purpose. When no reason to retain a record remains, we delete or de-identify it. Ask privacy@sound-trade.com for the period or retention criterion relevant to a specific record.

10. Your rights and account closure

Subject to applicable GDPR conditions and exceptions, you can request access, correction, deletion, restriction, portability or an objection to processing based on legitimate interests. You can withdraw a separate consent where one was given, without affecting earlier lawful processing. Send a request to privacy@sound-trade.com; we may need to verify that it comes from the account holder. You may also contact Stripe about its independent processing through https://stripe.com/privacy.

To request account closure, contact SoundTrade Support. Closure does not automatically erase transaction or contract evidence that we must retain, or end unresolved rights, balances and claims. We explain any record we must keep when responding to a deletion request. You can complain to Romania’s National Supervisory Authority for Personal Data Processing (ANSPDCP) or another competent EEA authority where you live or work.

You can find information about complaints on the ANSPDCP website.

11. Calculations and review

Rules help calculate displayed prices, balances, portfolio values, referral eligibility and access to financial actions. An identity result or account-risk signal can restrict an action pending review. A displayed asset valuation is an estimate about an asset, not a decision about your personal characteristics. If an automated restriction materially affects you, contact Support to request an explanation and human review of your case.

12. Security and age

We use authentication, access controls and protected session storage to safeguard information. No method of storage or transmission is completely risk-free. The investor app is for people aged 18 or older; registration asks for a date of birth and rejects a person whose stated age is below 18. If we learn that an account belongs to a minor, we will restrict it and review deletion and any applicable retention duty.

13. Changes to this notice

This version is effective from 12 October 2026. We may update it when our processing changes. A newer version will show its effective date; we will provide notice or seek a separate choice before a material change where required by law. Earlier effective versions remain available by version number.