Privacy Policy

Echocraft Sound Labs LLC

Version 1.0. Effective October 1, 2026.

This Privacy Policy explains what personal data Echocraft Sound Labs LLC ("Echocraft," "ESL," "we," "us," or "our") collects when you use echocraftsoundlabs.com, the Echocraft licensing platform, and the composer portal (together, the "Service"), why we collect it, who receives it, how long we keep it, and the choices and rights you have. It is written to describe what the Service actually does.

Echocraft Sound Labs LLC is the controller of personal data processed through the Service. We are a Wyoming limited liability company operating from California, United States. Our mailing address is 30 N Gould St, Ste R, Sheridan, WY 82801, and our contact for anything in this policy is sync@echocraftsoundlabs.com.

1. Who Uses the Service

The Service is an invitation-only professional platform. There are three kinds of people whose data we process:

• Licensing users: people at agencies, studios, production companies, brands, and similar organizations who search the catalog, audition tracks, and license music.
• Composers and artists: people who create the music in the catalog and have a written agreement with us.
• Share recipients: people who receive a playlist or pitch link from a licensing user and open it without an account.

The Service is not directed to anyone under eighteen, and we do not knowingly collect data from children.

2. What We Collect

2.1 Information you give us

Access requests and invitations. Name, email address, company, professional role, and any message you include when you request access. If you are invited, the invitation records your email address and its status.

Account. Email address, password (held by our authentication provider in hashed form; we never see it), optional display name, your marketing preference, and the role or client class assigned to your account.

Consent records. Which version of the Terms and this Privacy Policy you accepted, when, and whether you opted in to marketing email, together with the versions in effect at the time. We keep these so we can show what you agreed to.

Reference uploads for search. When you search by reference you may upload an audio file, a video, or a PDF brief, with optional text describing what you are looking for. We store the file temporarily, its original filename, size and type, and the search session it belongs to.

Licensing details. When you license a track: your legal name or your organization's legal name, entity type and jurisdiction if provided, the production or campaign you are licensing for, brand, territory, and the other deal terms you select; your click-acceptance of the License and the time and IP address at which you accepted it, which are recorded on the executed License as evidence of execution.

Playlists, favorites, follows, and shares. Tracks you save, playlists you build and their names and notes, composers you follow, and any share links you create, including the names and email addresses of people you address a share to.

Messages. Anything you send us by email or through a form on the Service.

Composers and artists. Legal name, professional name, contact details and mailing address, biography, credits and photograph for your public profile, performing rights organization affiliation, IPI number, publisher and ownership details for each work, the agreements you sign with us, statements and payout records, and the payment details and tax documentation you provide so that we can pay you. Payment details are stored encrypted; the Service shows only whether they are on file.

2.2 Information the Service records as you use it

Activity. Searches you run and their results, tracks you audition, comps you download, licenses you view, playlists you open, and similar actions, with the time of each. Alongside some actions we record a salted hash of your IP address for security and abuse detection.

Share activity. When a share link is opened, the Service records the open, the tracks played, any downloads, and any reactions, attributed to the recipient the link was addressed to or to the link itself.

Search history. The text of your searches, the interpretation the Service generated from your reference, the results, and a mathematical representation of the search (an embedding) used for later suggestions.

Watermark identity. Every audition stream and comp download you receive carries an inaudible watermark encoding the account or share link it was delivered to, so that a file found outside the Service can be traced back to its delivery.

Device and connection. Browser type, operating system, IP address, and the pages you request, as recorded in ordinary server logs by our hosting providers.

Errors. If something goes wrong, our error-monitoring service receives a report that may include your account identifier and technical context about the failure. Request bodies, cookies, and query strings are removed before the report is sent.

2.3 Information from others

Payment status. Our payment processor, Stripe, tells us whether a payment succeeded and sends us the transaction record for the license you bought. We do not receive your full card number.

Email delivery. Our email provider tells us whether messages we sent were delivered, bounced, or generated a complaint, so that we stop sending to addresses that reject mail.

3. Why We Use It

We use personal data to:

• decide whether to grant access to the invitation-only Service and to run the invitation process;
• create and secure your account and authenticate you;
• run the searches you ask for, including sending your reference upload to our AI providers for analysis (Section 5);
• deliver auditions and comps, and watermark them so that unlicensed use can be traced;
• issue Licenses in your name, record their execution, generate the License and cue-sheet documents, and process your payment;
• pay composers and artists their share, produce their statements, and administer their agreements and registrations;
• personalize the order of tracks shown to you based on your favorites, auditions, and searches;
• operate share links and show the person who created a share who opened it and what they played;
• send you transactional email: invitations, confirmations, license documents, delivery links, and account notices;
• send you occasional catalog updates if you opted in, and stop if you opt out;
• detect, investigate, and prevent fraud, abuse, account sharing, and unauthorized use of the catalog;
• monitor the reliability of the Service and fix errors;
• comply with law, respond to lawful requests, and establish, exercise, or defend legal claims;
• enforce our Terms, Licenses, and Rights Agreements.

We do not sell personal data. We do not share personal data with third parties for their own advertising. We do not use personal data for cross-context behavioral advertising.

4. Legal Bases (EU, UK, and Switzerland)

Where the GDPR, the UK GDPR, or Swiss law applies, we rely on:

• performance of a contract, for accounts, searches, licensing, payment, composer agreements, and delivery;
• our legitimate interests, for security, abuse prevention, watermarking, share attribution, personalization, error monitoring, and improving the Service, in each case balanced against your interests;
• consent, for marketing email, which you can withdraw at any time;
• legal obligation, for tax, accounting, and responding to lawful requests.

Where we rely on legitimate interests you may object (Section 11).

5. Artificial Intelligence

5.1 What is processed by AI. The Service uses third-party artificial intelligence services for the following:

• Your reference uploads. Audio, video, PDF briefs, and search text you submit are sent to Google's Gemini models to produce a description of what you are looking for, to match it against the catalog, and to explain the results. Video is analyzed for mood, pace, and content; we do not use facial recognition, voice identification, or any biometric processing, and we do not attempt to identify people in what you upload.
• The catalog. Catalog recordings are analyzed by Cyanite and by Google's Gemini models to produce descriptions, tags, and searchable representations. These describe the music, not you.
• Composer profiles. When we build a composer's public profile, text and a photograph the composer supplies may be processed by Google's Gemini models to extract biography details and to frame the photograph. This is done by us, on the composer's own material.

5.2 What is generated for you. Search interpretations, rankings, and explanations are generated for you in real time and are not individually reviewed by a person. Catalog descriptions and tags are generated and then reviewed by us before publication. When you use reference search you are interacting with an AI system; we say so in the Service.

5.3 Training. We do not use your uploads, your activity, or the catalog to train any artificial intelligence model. We use paid, business-tier AI services whose terms and our agreements prohibit the provider from using our inputs to train or improve their models. Cyanite has confirmed to us in writing that catalog audio it analyzes is never used to train any model, and Cyanite never receives your uploads at all.

5.4 Your reference uploads, step by step. Because a reference you upload may be an unreleased cut, a confidential brief, or unreleased music, here is exactly what happens to it, and what each provider that touches it has committed to.

Upload. Your browser sends the file directly to a private storage bucket over an encrypted connection (TLS), using a one-time signed upload address that is valid only for that upload. The file is never placed at a public address and is never indexed or listed anywhere.

Storage. The bucket is operated by Supabase in the United States. Supabase encrypts all stored data at rest with AES-256 and all connections in transit with TLS, holds ISO 27001 certification, and processes data for us under a written data processing agreement. Only our own service credentials and your authenticated session can read the file; no other user can, and the file is not visible in any shared or public part of the Service.

Processing. To analyze an audio or video file, our media worker (Fly.io, Los Angeles region) retrieves it, converts it to the format the analysis needs, sends it, and deletes its temporary copy when the job finishes, whether it succeeds or fails; the worker's temporary storage is ephemeral and is not persisted. A text or PDF brief is handled in memory by our web application (Vercel) and is not written to disk there. In each case the material is sent to Google's Gemini API inside the analysis request itself; we do not upload it to any file store at Google, and we have not enabled Google's optional developer logging, so Google holds no copy of your material for our use. Google processes the request under its paid-service terms, which prohibit using our inputs or outputs to train or improve Google's models, and under Google's data processing terms. Google keeps a log of requests for up to fifty-five days solely to detect abuse of its own service; that log is not used to train any model, is not shared, and is deleted at the end of the period. The analysis returns a written description of what your reference sounds or looks like; that description, not your file, is what the search uses.

Who at Echocraft can see it. Members of our team can access a reference upload only to operate the Service or to investigate a report of abuse, and we do not open reference material as a matter of course.

Deletion. The file is scheduled for deletion twenty-four hours after your search session is created, and an hourly process removes files whose time has passed. A file uploaded but never attached to a search is removed after six hours. If you delete a search session yourself, its file is deleted at that moment. Deleted files are not carried in our database backups, because Supabase database backups do not include storage objects.

What remains after the file is gone. The written description of your reference, the search text you typed, and the results stay in your search history until you delete the session or your account is deleted, so that you can return to a search. The original filename is kept with the session record. Our background-job service (Inngest) holds the written description as part of its job record for its retention period, and our error-monitoring service (Sentry) may hold technical context, which we scrub of request bodies, cookies, and query strings, for up to ninety days. None of these hold your file.

What we never do with it. We never watermark, fingerprint, catalog, share, or show your reference material to anyone, and we never use it for anything other than your search. Our contractual commitments about reference material are in Section 7.8 of the Terms of Service.

5.5 Personalization. The Service computes a preference representation from your recent favorites, auditions, and searches and uses it to reorder tracks and make suggestions. It does not make any decision about you that has a legal or similarly significant effect, and you are not profiled for any purpose other than what you see first.

6. Who Receives Personal Data

6.1 Service providers. We use the following providers to run the Service. Each processes personal data on our instructions under a written agreement, and each has its own security program.

6.2 Composers, artists, and licensees. When you license a track, the composer or artist receives a statement identifying the license, the production, the licensee organization, and the fee, because that is how they are paid. When a composer's work is licensed, the licensee receives the composer's legal name, performing rights affiliation, IPI number, and publisher details on the License and cue sheet, because that is how performance royalties are routed.

6.3 Share recipients and creators. If someone shares a playlist or pitch with you, the person who created the share can see that you opened it and what you played. If you create a share, the people you address it to see your name as the sender.

6.4 Legal. We disclose personal data when the law requires it, to respond to a subpoena, court order, or lawful request, to protect our rights or the rights and safety of others, and to enforce our Terms, Licenses, and Rights Agreements, including to trace and pursue unlicensed use identified through a watermark.

6.5 Business transfers. If we sell or transfer the business or a substantial part of it, personal data may transfer to the acquirer under this policy.

7. International Transfers

We operate in the United States and our providers process data in the United States and in other countries where they operate. If you are in the European Economic Area, the United Kingdom, or Switzerland, your data is transferred to the United States. We rely on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where a provider is certified under it, and on Standard Contractual Clauses (and the UK Addendum) with our providers otherwise. You may contact us for information about the safeguards applied to a particular transfer.

We are established only in the United States and have not appointed a representative in the EU or UK. You may contact us directly at sync@echocraftsoundlabs.com.

8. How Long We Keep It

We keep personal data for as long as we need it for the purpose it was collected for and as the law requires. In practice:

• Account, profile, consent, and activity records: for as long as your account exists, and then as described in Section 11.5.
• Reference uploads: scheduled for deletion twenty-four hours after the search session is created, six hours if never attached to a search, immediately if you delete the session (Section 5.4). Search history: until you delete it or your account is deleted.
• Executed Licenses and the records that support them (the deal terms, the frozen ownership and split snapshot, the acceptance time and IP address, the payment record, and the generated documents): for the life of the License and afterward for as long as we are required to keep contract and financial records. These are the legal record of a transaction and are not deleted on account deletion.
• Composer and artist records: for the life of your agreement with us and afterward for as long as we are required to keep contract, payment, and tax records.
• Watermark delivery records: for as long as the associated audition or comp could plausibly surface, which in practice means for as long as we hold the catalog.
• Email delivery events and suppression records: for as long as needed to keep our sending reliable and to honor your preferences.
• Error reports: according to our monitoring provider's retention period, currently up to ninety days.
• Backups: our providers keep backups for short rolling periods; deleted data may persist in a backup until that period ends.

9. Security

We protect personal data with encryption in transit, encryption at rest by our storage providers (AES-256 at Supabase), hashed passwords held by our authentication provider, role-based access so that users see only their own records and administrators see only what their role requires, time-limited signed links for every file download and one-time signed addresses for every upload, encrypted storage of composer payment details, and forensic watermarking of every evaluation file we deliver. Our payment page is hosted by Stripe and we never hold full card numbers. No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur. If a breach affects your data and the law requires notice, we will notify you.

10. Cookies and Similar Technologies

The Service uses a small number of cookies and browser-storage items, all of them needed to operate the Service: cookies that keep you signed in, a browser-storage item that remembers how you like the catalog displayed, and a browser-storage item that remembers who you are on a share link you opened. We do not use analytics cookies, advertising cookies, or any third-party tracking. Because we set only necessary storage, we do not show a cookie consent banner. Our Cookie Policy lists each item.

Do Not Track and Global Privacy Control. We do not track you across other websites and do not sell or share personal data for advertising, so there is nothing for these signals to switch off. The Service does not currently change its behavior in response to them.

11. Your Rights and Choices

We extend the following to everyone who uses the Service, wherever you live.

11.1 Access and portability. You may ask for a copy of the personal data we hold about you in a portable format.

11.2 Correction. You can change your email address and password in your account settings. Ask us to correct anything else.

11.3 Deletion. You may request deletion of your account from your account settings or by email. When you do, your account is scheduled for deletion and you can cancel by signing in again within thirty days. After that we anonymize or delete your personal data, except records we must keep: executed Licenses and their supporting records, Rights Agreements and payment records, consent records needed to show what you agreed to, and records needed to enforce our rights or comply with law. Copies of files you downloaded, and files already sent to you, are outside our control.

11.4 Marketing. Marketing email is opt-in. You can change your preference in your account settings or use the unsubscribe link in any marketing message. We will still send transactional email about your account and licenses.

11.5 Search history and shares. You can delete individual search sessions from your history and revoke share links you created.

11.6 Objection and restriction. Where we rely on legitimate interests, you may object, and we will stop unless we have compelling grounds to continue. You may ask us to restrict processing while a dispute is resolved.

11.7 Withdrawal of consent. Where we rely on consent, you may withdraw it at any time without affecting processing that already happened.

11.8 How to exercise these rights. Write to sync@echocraftsoundlabs.com from the email address on your account, or by post to the address above. We will verify that the request comes from you, may ask for more information to do so, and will respond within thirty days. If we need longer we will tell you why. We do not charge for requests unless they are manifestly unfounded or excessive. You may authorize someone to make a request for you; we will need proof of the authorization and may confirm it with you directly.

11.9 Complaints. If you are in the EEA, the UK, or Switzerland and believe we have not handled your data lawfully, you may lodge a complaint with your national supervisory authority. We would ask that you contact us first so that we can try to resolve it.

12. Information for California Residents

This section is provided under the California Online Privacy Protection Act. In the twelve months before the effective date of this policy we have collected the categories of personal information described in Section 2, from the sources described there, for the purposes described in Section 3, and disclosed them to the categories of recipients described in Section 6. We have not sold personal information and have not shared it for cross-context behavioral advertising. Our response to Do Not Track and Global Privacy Control signals is described in Section 10. California residents may exercise the rights in Section 11 in the same way as everyone else.

13. Changes to This Policy

We may revise this policy. If a revision materially changes how we use your data, we will notify you by email or through the Service before it takes effect. The version and effective date appear at the top of this page, and the version you accepted is recorded in your consent records.

14. Contact

Echocraft Sound Labs LLC
30 N Gould St, Ste R, Sheridan, WY 82801
sync@echocraftsoundlabs.com