Legal · Updated October 5, 2026

Privacy Policy

This Privacy Policy explains how Audora, operated by Metalmedia Group i Sverige AB, registration number 559084-6662 ("Audora", "we", "us", or "our"), collects, uses, stores, and protects personal data when you use our services.

Audora is committed to protecting your privacy and processing personal data in compliance with the EU General Data Protection Regulation (GDPR) and applicable Swedish law.

1. Data Controller

Audora is the data controller for personal data processed in connection with user accounts, subscriptions, payments, support, and platform operations.

2. Personal Data We Collect

We collect only the data necessary to operate the service.

2.1 Account & Identity Data

• Full name
• Artist name
• Email address
• Telephone number
• Postal address
• Account credentials

2.2 Payment & Financial Data

• Bank account details
• Payment processor identifiers (e.g. PayPal, Stripe)
• Payment history and payout records

Audora does not store full card details. Payment data is handled by regulated third-party providers.

2.3 Verification & Anti-Fraud Data

Where necessary and proportionate, Audora may collect:

• Identity documentation (only upon request)
• Information related to suspected misuse, fraud, or artificial streaming

Such data is collected only when required and retained for the minimum period necessary.

2.4 Technical & Usage Data

• IP addresses
• Device and browser information
• Log files
• Usage data related to platform activity — inside the app: which sections you open, forms you start and finish, actions the app refused and why, and a daily record of which steps are still open on your account. No IP address or device identifier is kept with these records (see section 4.1)
• How you reached the application page, if you apply: the audora.music page you came from, the domain of the referring site, campaign tags in the link, any plan you chose, and the referral code you arrived with, if any (see the Cookie Policy, section 2.3)

2.5 Generated Content & Metadata

Audora may process:

• Metadata related to music releases
• Content generated using Audora's tools (e.g. images, media, or other generated assets)
• Associated technical data required to operate and improve the service

2.6 What You Have Already Published as an Artist

When you apply to Audora, or when a label adds you to its roster, we look up what you have already published as an artist, so your page can start from it and you — or the label running your account — only confirm what is right. We also use it to review applications. The look-up starts from your artist name and any link you or the label gave us, and reads public pages only: streaming profiles, public music catalogues, your own website and your public social profiles. You can ask for a new look-up yourself, in Audora or through an AI assistant you connect. It is carried out by an AI model (Anthropic) that searches and reads the public web for us.

• It does not look for private information: no personal email addresses, phone numbers or street addresses, and no searches for your legal name. The one address it may pick up is a booking or contact address you publish for that purpose on your own pages, offered to you to confirm like everything else
• Nothing it finds appears on your artist page until you confirm it, and you can remove anything later
• What you keep, change or decline is recorded, so the look-ups get better

3. Purposes & Legal Bases for Processing

4. Analytics & Cookies

Audora uses limited analytics tools (e.g. Google Analytics 4) to understand how the service is used and to improve platform performance.

• Only strictly necessary and analytics cookies are used, plus the application-source cookie and the local application-source and referral records described in the Cookie Policy, section 2.3
• No marketing or retargeting cookies are deployed
• Cookie handling complies with EU consent standards
• The Global Privacy Control (GPC) browser signal is honored — analytics cookies are automatically suppressed when GPC is active

You can manage your cookie preferences at any time using the "Cookie Settings" button in the site footer (available in the app and on app pages). Further details are available in our Cookie Policy.

4.1 Product-usage records (first party)

Separately from analytics cookies, Audora keeps its own record of how the app is used by signed-in artists: which sections are opened, forms started and finished, actions the app refused and why, and a daily record of which steps are still open on each account. These records are stored in Audora's own database in the EU, are never shared with a third-party analytics service, and are processed on the basis of legitimate interest (section 3) to see where artists get stuck and fix it.

You can object at any time under Account Settings → Privacy & Data → Product usage records; existing records are then removed within a day. This switch is independent of the cookie settings above: the Global Privacy Control signal governs cookies, not these records.

4.2 Page counts on audora.music

Audora's server counts how many times each public page on audora.music is viewed, as anonymous daily totals per page, together with the website that linked to it (its domain only) and the country. No cookie is set, nothing runs in your browser, and no IP address, device identifier or account is recorded with these counts.

4.3 Emails about your account and Audora

If you have an account, Audora may email you three kinds of account email, each with its own switch. Tips & reminders: an occasional reminder about your own music — for example a release that still needs something, or the first numbers for a release — at most one a week. Product news: on the first Tuesday of the month, a short email with what is new on Audora, at most one a month and never on the same day as a reminder; it is sent only to a confirmed address, and only while your marketing emails are switched on. The Friday mail: if you release music with Audora, one email on a Friday listing what other artists on Audora put out that week, only when something came out, never including your own releases. You can turn any of them off with the link in any of them or under Account Settings → Privacy & Data, and a record of which of these emails was sent and when is kept for 13 months; after that we keep only which reminders you have had, so none is sent twice, until your account is deleted.

5. Data Storage & Location

• Audora's database and file storage are in the European Union
• Some of the services we use to run Audora are based in the United States — among them the AI providers (OpenAI, Anthropic, Replicate), payments (Stripe), email delivery (Resend), analytics (Google) and our website host (Netlify). Using them can mean personal data is transferred outside the EU/EEA. The Sub-Processor Registry says where each one is
• For every such transfer we rely on an adequacy decision of the European Commission — such as the EU–U.S. Data Privacy Framework, where the recipient is certified under it — or on the Commission's Standard Contractual Clauses
• Appropriate technical and organizational security measures are applied

6. Data Sharing & Processors

Audora may share data with trusted processors solely to operate the service, including:

• Payment providers (e.g. Stripe)
• Cloud infrastructure & hosting (e.g. Supabase)
• Digital distribution partners (e.g. The Orchard)
• Email delivery (e.g. Resend)
• AI content generation (e.g. OpenAI, Anthropic, Google Vertex AI, Replicate)
• Analytics providers (Google Analytics 4, limited non-marketing use)

All processors are bound by data processing agreements in compliance with GDPR. Audora does not sell personal data. A complete and current list of sub-processors is maintained on our Sub-Processor Registry.

6.1 Connected Social Media Accounts & Google User Data

If you choose to connect a social media account (such as YouTube, TikTok, Facebook, or Instagram) to publish promotional content, Audora accesses only what these features need:

• Account identity (channel, Page or profile name, avatar, and your TikTok username): read when you connect, so you can see which account posts will go to.
• Publishing on your behalf: content you have created, reviewed, and explicitly approved in Audora is posted to your own connected account, with the visibility you chose. Audora never posts to third-party accounts and never modifies or deletes your existing content.
• Post status: after publishing, Audora reads back the post's processing status to confirm the platform accepted it.
• Account and post numbers: once a day Audora reads the numbers the platform reports for your connected account (such as followers or subscribers, reach, views and profile visits) and for each post Audora published for you (such as reach, views, likes, comments, shares and saves). They are shown to you on your Reach card and under "How it did", to a label you work with for the artists on its roster, and to an AI assistant you connect to your own account. They also inform the next campaign Audora plans for you. YouTube numbers are never combined with other artists' numbers, and Audora does not sell these numbers or use them to train AI models.

Connected-account handles, including your TikTok username, are shown as follow links on your public artist page when it is enabled.

Access tokens for connected accounts are stored encrypted and used solely to provide the features described above. When you disconnect an account, its tokens and the account and post numbers Audora read from it are deleted at once. Otherwise the numbers are kept for 13 months. If Audora cannot renew its access to a YouTube channel for 30 days (for example because you removed it in your Google Account), the channel's numbers are deleted. When you remove Audora from your Facebook account or ask Meta to have your data deleted, Audora disconnects your Facebook Pages and Instagram accounts and deletes their numbers.

You can disconnect at any time in Audora's Social Connections settings, and additionally revoke access from the platform itself (for Google, via your Google Account security settings).

Audora's YouTube features use the YouTube API Services. By using them you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. Audora's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6.2 New-Music Alerts on Artist Pages

If you leave your email address on an artist's Audora page, we store it only to send you that artist's release news, and only after you confirm the address by clicking the link we email you (double opt-in). The address belongs to that artist's own alert list — it is not added to Audora's newsletter or used for anything else.

We email you at most once per release: when it gets its pre-save link, or on its release day if it has none — and only while the artist's page is public. We keep a record of which releases we emailed you about, so none is sent twice; it is deleted after 13 months, or at once when you unsubscribe.

Every alert email carries an unsubscribe link: it opens a page where one press takes you off the list, and your mail app's own Unsubscribe button works too. Sign-ups that are never confirmed are deleted automatically after 14 days, and addresses that have unsubscribed are deleted two years after the opt-out.

6.3 Recommended Listens

If you sign up for Recommended listens at audora.music/listen, we store your email address — and your name, if you give it — only to send you Recommended listens, once a month, and only after you confirm the address by clicking the link we email you (double opt-in). It is not added to any other list or used for anything else.

Every letter carries an unsubscribe link that takes effect on the first click. Sign-ups that are never confirmed are deleted automatically after 14 days, and addresses that have unsubscribed are deleted two years after the opt-out. To have your address deleted sooner, write to hello@audora.music.

7. Retention Periods

Personal data is retained only as long as necessary:

• Account data: for the duration of the account and legal retention periods
• Financial data: as required by accounting and tax law
• Anti-fraud and verification data: retained only while necessary
• Consent records: retained for 7 years, then anonymized automatically
• Product-usage records: daily readiness records for 180 days; in-app usage events for 90 days; aggregate totals that identify nobody for 3 years
• Page counts on audora.music: anonymous daily totals, 25 months
• Reminder emails: a record of which reminder was sent and when is kept for 13 months; after that we keep only which reminders you have had, so none is sent twice, until your account is deleted
• Error reports: 180 days
• Promotion learning signals: 12 months
• Numbers from connected social accounts (section 6.1): 13 months; deleted at once when you disconnect the account, and for a YouTube channel after 30 days without renewed access
• Artist-page alert sign-ups: unconfirmed sign-ups are deleted after 14 days; unsubscribed addresses are deleted 2 years after the opt-out; the record of which release alerts an address was sent is kept 13 months and deleted at once when the address unsubscribes
• Applications to join Audora: an application that leads to an account is kept while that account exists and deleted when the account is deleted; an application that does not lead to an account is deleted 12 months after it was made, once it has been decided. An approved application creates your account; if you never sign in to it, the account and the application are deleted 12 months after the approval
• Shows and release parties you post: deleted 90 days after the event ends, with the invitations and answers on it; deleted sooner with your account
• Look-ups (section 2.6): the record of what a look-up found is kept for 180 days, and is deleted sooner with your application or your account; what you kept, changed or declined on your artist page is kept for 2 years and deleted with your account
• Released records you bring in: the record of each import — which records, and what became of each — is kept for 90 days, and deleted sooner with your account. The records themselves stay in your catalogue until you delete them
• Inactive accounts: data may be anonymized or deleted after statutory periods
• Backups: files deleted from Audora are kept in backups for up to 90 days and database backups for up to 12 months, after which they are deleted; when your account is deleted, its data leaves the backups within those periods

Audora operates automated data retention processes that periodically purge expired data, anonymize old consent records, and execute approved account deletion requests in compliance with applicable retention obligations.

8. Your Rights Under GDPR

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request erasure ("right to be forgotten"), where applicable
• Object to processing based on legitimate interest
• Request restriction of processing
• Data portability
• Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal
• Lodge a complaint with a supervisory authority

9. California & International Privacy Rights

Although Audora is based in Sweden and primarily governed by EU GDPR, we extend certain privacy rights to all users regardless of location.

9.1 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• The right to know what personal information we collect, use, and disclose
• The right to delete your personal information
• The right to opt out of the "sale" or "sharing" of personal information
• The right to non-discrimination for exercising your privacy rights

Audora does not sell your personal data. For more information and to manage your preferences, visit our Do Not Sell or Share My Personal Information page.

9.2 Global Privacy Control (GPC)

Audora honors the Global Privacy Control (GPC) signal. When your browser sends a GPC signal, we automatically disable non-essential analytics cookies and treat the signal as a valid opt-out request under applicable laws including CCPA/CPRA and GDPR.

9.3 Other Jurisdictions

We aim to comply with applicable data protection laws worldwide, including the UK GDPR, Brazil's LGPD, and Canada's PIPEDA. If you have jurisdiction-specific questions, contact hello@audora.music.

10. Content Reporting

In accordance with the EU Digital Services Act (DSA), Audora provides a mechanism for reporting potentially illegal or infringing content. You may submit a report through our Content Takedown Request form. Reports are reviewed and actioned in compliance with DSA Article 16 requirements.

11. Security

Audora implements appropriate technical and organizational measures to protect personal data, including:

• Encrypted data transmission
• Access controls
• Secure infrastructure
• Limited internal access on a need-to-know basis

12. Changes to This Policy

Audora may update this Privacy Policy to reflect changes in legal requirements or service functionality. Material changes will be communicated via the platform or email.

13. Language

This Privacy Policy is written in English. Any translated version is provided for convenience only. In case of conflict, the English version shall prevail.