Privacy Policy

Privacy Policy

Placeholders in square brackets, like [LEGAL ENTITY NAME], will be filled in once the operating company is registered.

1. Summary

• HearStage is a voice and music app, so we handle your voice recordings and live audio. We use them to run the features you choose, nothing more.
• We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not show third-party ads.
• Private rooms are never recorded. We do not use your voice to train AI models.
• You can see, download, correct and delete your data, and delete your account in Settings.

2. Who is responsible (controller)

[LEGAL ENTITY NAME], Connecticut, USA, [REGISTERED ADDRESS] ("HearStage", "we"). Privacy contact: [PRIVACY CONTACT EMAIL], or in the app under Settings → Privacy requests.

• EU representative (GDPR Art. 27): [EU REPRESENTATIVE NAME AND ADDRESS]
• UK representative (UK GDPR Art. 27): [UK REPRESENTATIVE NAME AND ADDRESS]
• Data protection officer / Brazil encarregado (LGPD): [DPO NAME AND EMAIL]
• India Grievance Officer (DPDP Act 2023 and IT Rules 2021): [GRIEVANCE OFFICER NAME AND EMAIL]

3. What we collect

We do not collect precise GPS location, your contacts, or advertising IDs. Some data counts as sensitive in some laws: voice recordings may reveal things about you, and the age check uses biometric matching carried out by Stripe, not by us. We process sensitive data only to provide the feature you asked for, and with your consent where the law requires it.

4. Why we use it and our legal bases

Where we rely on legitimate interests, we have balanced them against your rights, and you can object (section 8). In India we process personal data on the basis of your consent or for legitimate uses permitted by the DPDP Act.

5. Who we share it with

We share personal data only as needed with:

• Other users, as you choose: your public profile, public posts and anything you say or type in a public room. Private rooms are only heard by the people inside.
• Service providers (processors) that work on our instructions under data-processing agreements:

• Authorities and others when required by law, for example a valid court order, or to report child sexual abuse material. We check each request, disclose the minimum, and tell you unless the law forbids it or there is a safety risk.
• A buyer or successor if HearStage is sold or merged, under this policy.

We will update this list before we start using a new provider for personal data.

6. International transfers

We are based in the USA and our providers process data in the USA and other countries. When we transfer personal data from the EU/EEA, UK or Switzerland, we use the EU Standard Contractual Clauses (with the UK Addendum where relevant), the EU-US Data Privacy Framework where the provider is certified, or another lawful mechanism. Transfers from Brazil rely on the standard contractual clauses approved by the ANPD, transfers from other countries rely on the safeguards their laws require, and transfers from Albania follow Law No. 124/2024. You can ask us for a copy of the safeguards.

7. How long we keep it

8. Your rights

Depending on where you live, you have the right to:

• Access your data and get a copy in a portable format
• Correct inaccurate data
• Delete your data and your account
• Restrict or object to processing, including processing based on legitimate interests
• Withdraw consent at any time, without affecting earlier processing
• Not be subject to decisions based solely on automated processing that have legal or similarly significant effects (we do not make such decisions)
• Opt out of the sale or sharing of personal information, targeted advertising and profiling (we do none of these)
• Appoint an agent or nominate someone to exercise your rights if you die or become unable to (for example under India's DPDP Act)
• Not be discriminated against for using your rights
• Complain to your data-protection authority

How to use them: delete your account in Settings → Danger zone → Delete account; send other requests in Settings → Privacy requests or to [PRIVACY CONTACT EMAIL]. We may need to verify your identity. We answer within the time your law sets: usually 30 days (EU/UK one month, extendable by two months for complex requests; 45 days under US state laws; 15 days under Brazil's LGPD for a full access report). If we refuse, we explain why and how to appeal. In US states that offer an appeal (such as Connecticut, Virginia and Colorado), reply to our decision with "appeal" and we will review it within 60 days.

9. Region-specific information

• United States (California CCPA/CPRA, Connecticut CTDPA, Virginia, Colorado, Utah, Texas, Oregon and other state laws): the categories of personal information we collected in the last 12 months are those in section 3 (identifiers, customer records, commercial information, internet activity, audio information, approximate geolocation, inferences about your listening preferences, and sensitive information limited to account login and, for 18+ features, the age-check result). Sources, purposes and recipients are in sections 3 to 5. We have not sold or shared personal information, and we do not knowingly sell or share data of consumers under 16. We use sensitive personal information only for purposes allowed without a right to limit. We honour Global Privacy Control signals as an opt-out where the law requires. California residents may request this information once a year under the "Shine the Light" law; we do not share personal information with third parties for their direct marketing.
• Illinois, Texas, Washington and other biometric laws: we do not collect or store biometric identifiers ourselves. If you choose an age check, Stripe Identity processes your ID and selfie under its own notice, after your separate written consent; it does not share biometric data with us.
• EU/EEA and UK (GDPR, UK GDPR, ePrivacy): our legal bases are in section 4 and your rights in section 8. You may complain to the authority where you live or work, for example the Irish DPC, the French CNIL or the UK ICO.
• Brazil (LGPD): you have the rights in Art. 18 LGPD, including confirmation of processing, anonymisation, portability, information about sharing and review of automated decisions. You may complain to the ANPD.
• India (DPDP Act 2023): you can access a summary of your data, correct, complete, update and erase it, nominate someone, and raise a grievance with our Grievance Officer (section 2), who will respond within the period set by law. If unresolved, you may complain to the Data Protection Board of India.
• Canada (PIPEDA and provincial laws, including Quebec Law 25): you can access and correct your data and complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.
• Australia (Privacy Act 1988): you can access and correct your data and complain to the OAIC.
• Japan (APPI): we provide data to foreign providers listed in section 5 under measures equivalent to the APPI; you can request disclosure, correction and cessation of use.
• South Korea (PIPA): you can request access, correction, deletion and suspension of processing; our providers abroad are listed in section 5 and section 6.
• China (PIPL): HearStage is not targeted at mainland China. If you use it from there, your data is transferred abroad to the providers in section 5, and you have the rights in section 8.
• Albania (Law No. 124/2024 on personal data protection) and other countries: you have the rights in section 8 and may complain to the Information and Data Protection Commissioner (IDP) or your local authority.

10. Children and teens

HearStage is not for children under 13, and we do not knowingly collect data from them (US COPPA). Where a country sets a higher minimum age for using online services without parental consent, that age applies (see the Terms). If you are a parent and think your child under 13 has an account, contact [PRIVACY CONTACT EMAIL] and we will delete it. Accounts under 18 cannot use private rooms, People Booking or cash-out, and we do not use teen data for targeted advertising.

11. Security

We use encryption in transit (HTTPS/TLS), access controls with row-level security, hashed passwords, least-privilege staff access with logging, and signed payment webhooks. No system is completely secure. If a breach affects you, we will notify you and the authorities as the law requires.

12. Cookies and similar technologies

We use only first-party cookies and local storage needed to log you in, keep you secure, remember your settings and credit invite links. We do not use advertising or third-party analytics cookies. See the Cookie Notice.

13. Emails and notifications

We send service emails you need (for example security and booking emails). Marketing emails, if we ever send them, will identify us, include our postal address and an unsubscribe link, and follow the US CAN-SPAM Act, EU/UK ePrivacy rules and similar laws. You control push notifications in Settings and on your device.

14. Changes

We will tell you in the app before important changes take effect and show the version and effective date at the top of this page.