Privacy Policy

1. Information We Collect

We collect information in three ways: information you give us directly, information generated when you use the Service, and information received from third-party services you connect.

1.1 Account and Identity Information

When you create an account, authentication is handled by Clerk. You provide your credentials (email address, phone number, and/or OAuth identity) directly to Clerk. We receive from Clerk the information needed to identify your account, including your Clerk user ID, email address, display name, and profile photo if you set one. We do not receive or store your password.

1.2 Payment Information

Subscription payments are processed by Stripe, Inc. Your full card number, CVV, and bank account details are entered directly on Stripe’s payment interface and are never transmitted to or stored on KUDDZOO servers. We receive from Stripe only a payment token, subscription status, and limited billing metadata (last four digits, card type, billing postal code) needed to manage your subscription.

1.3 Usage and Telemetry

We collect information about how you interact with the Service, including:

• Play events: which tracks or content you play, for how long, and when (used to compute play counts and Creator payout allocations).
• Pages visited, features used, and navigation paths within KUDDZOO.
• Device type, operating system, browser type and version, and screen resolution.
• IP address and approximate geographic location (city/region level).
• Web Vitals and performance telemetry (Core Web Vitals reported client-side).
• Error logs and crash reports.
• Request IDs (x-request-id) for distributed tracing and debugging.

1.4 Creator-Uploaded Content

If you are a Creator, we store the content you upload, including audio files, images, short video, and associated metadata such as titles, descriptions, and cover art, in provider-routed cloud object storage. Creator Studio music uses private AWS S3 storage; legacy music may remain in isolated Cloudflare R2 storage during a controlled migration and rollback period, and supported non-music media may also use Cloudflare R2. Private media is delivered to authorized listeners through our edge delivery networks. Public promotional images and thumbnails may be delivered without playback authorization.

1.5 Communications

When you contact us (by email or through the platform), we keep a record of that communication, including your contact information and the content of your message, to respond to you and to improve our support.

2. How We Use Your Information

We use the information we collect to:

• Operate and provide the Service: authenticate your account, process your subscription, deliver content, and manage your Creator designation.
• Process Creator payouts: compute play-weighted allocations and directed-dollar distributions from your play events and directed-dollar designation.
• Communicate with you: send receipts, service announcements, legal notices, and (where you have opted in) notifications about Creators you follow.
• Improve the Service: analyze usage patterns, diagnose errors, and optimize performance.
• Enforce our Terms of Service and community standards: investigate and act on reports of abuse or policy violations.
• Comply with legal obligations: respond to valid legal process, comply with applicable law, and protect the rights of Opynx and its users.
• Prevent fraud and security threats: monitor for suspicious activity and unauthorized access.

Legal bases (GDPR): Where EU/UK/Swiss data protection law applies, we process your personal data on the following bases: (a) performance of a contract with you (account operation, subscription, payouts); (b) our legitimate interests (fraud prevention, security, service improvement); (c) compliance with a legal obligation; and (d) your consent where we have obtained it (e.g., marketing emails, push notifications).

3. Third-Party Processors

We share your information with the following third-party service providers, each acting as a data processor on our behalf and bound by appropriate data processing agreements:

We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes. We may share information as required by law, court order, or in connection with a merger, acquisition, or sale of assets (in which case you will be notified).

4. Cookies and Tracking

We take a minimal-cookie stance. KUDDZOO uses:

• Session and authentication cookies set by Clerk to maintain your logged-in state. These are strictly necessary for the Service to function.
• Signed streaming cookies issued by our provider-routed media delivery edge for authenticated playback. These are short-lived, scoped to the applicable media CDN domain, and contain no personal information beyond authorization data.

We do not use third-party advertising cookies, cross-site tracking pixels, or analytics beacons from social networks. We do not run targeted advertising on KUDDZOO.

If you block strictly-necessary cookies, the Service will not function correctly. You can clear cookies at any time in your browser settings.

5. Data Retention

We keep your personal information only as long as necessary for the purposes described in this Policy or as required by law:

• Account data: retained for the life of your account, then purged within 30 days of account deletion, except where legal hold or financial record-keeping obligations require retention.
• Financial records (revenue ledger, payout records): retained for a minimum of 7 years to comply with U.S. tax and accounting law. These records are pseudonymized where possible.
• Play events and usage logs: retained for up to 2 years for payout computation and analytics, then aggregated or deleted.
• Creator-uploaded media: retained while your Creator account is active. Deleted from our storage within 30 days of account deletion, subject to legal hold.
• Support communications: retained for 3 years to support ongoing and potential future inquiries.

6. Security

We implement commercially reasonable technical and organizational security measures to protect your information, including:

• TLS encryption for all data in transit between your browser and our servers.
• Encryption at rest for the database (Aurora Serverless v2 with AWS-managed keys).
• Private provider-routed object storage for masters and gated media, including AWS S3 for Creator Studio music and isolated Cloudflare R2 storage for supported legacy or other media. Private playback requires short-lived edge authorization.
• Secrets stored in AWS Secrets Manager and SSM Parameter Store, with no credentials in environment variables or code.
• IAM token-based database authentication (no long-lived database passwords).
• Content Security Policy (CSP) headers on all responses, with a per-request nonce.
• Periodic security reviews and dependency audits.

No system is perfectly secure. We cannot guarantee that unauthorized parties will never defeat our security measures. If we become aware of a data breach that affects your information, we will notify you as required by applicable law.

To report a security vulnerability, email legal@kuddzoo.com with the subject line “Security Disclosure.”

7. Your Rights and Choices

Depending on where you live, you may have the following rights over your personal information. We honor these rights regardless of your location to the extent technically feasible.

To exercise any right, use the self-service tools described in Section 8 or contact us at privacy@kuddzoo.com. We will respond within 30 days (or the shorter period required by applicable law). We may ask you to verify your identity before fulfilling a request.

EEA/UK users: If you are in the European Economic Area or the United Kingdom, you may lodge a complaint with your local supervisory authority (for example, your national Data Protection Authority) if you believe we have violated your rights. We would, however, prefer to resolve your concern directly, so please contact us first.

8. Data Export and Account Deletion

We provide self-service tools for both data export and account deletion, available to signed-in users at:

8.1 Data Export

Requesting a data export generates a downloadable archive of the personal information KUDDZOO holds about you: your account profile, play history, membership records, and other data associated with your account. The archive is provided in a machine-readable format (JSON). Exports are typically ready within 24 hours of your request.

8.2 Account Deletion

Requesting account deletion initiates permanent removal of your KUDDZOO account and associated personal data. Deletion includes: your profile, play history, Creator designation, and uploaded content (for Creator accounts). Deletion is processed within 30 days of your confirmed request. As noted in Section 5, we retain financial records (revenue ledger entries and payout records) as required by law, and may retain de-identified or aggregated data that does not identify you.

Once your account is deleted, it cannot be recovered. Download your data export before initiating deletion if you want a copy of your information.

9. Children’s Privacy

KUDDZOO is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you are under 13, do not use KUDDZOO or provide any information about yourself.

If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete that information as quickly as practicable. If you believe we may have information about a child under 13, contact us at privacy@kuddzoo.com.

If you are between 13 and 17, parental consent to these terms and this Privacy Policy is required as set out in our Terms of Service.

10. International Transfers

KUDDZOO is operated from the United States. Our infrastructure (AWS) runs primarily in the us-east-1 region (Northern Virginia, USA). Cloudflare processes data at its global edge nodes, which may include locations in the EEA and other regions.

If you are located outside the United States, including in the European Economic Area, United Kingdom, or Switzerland, your information will be transferred to and processed in the United States and potentially other countries. These countries may have data protection laws that differ from those of your country.

Where required by law (e.g., GDPR), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other appropriate transfer mechanisms, when transferring personal data from the EEA or UK to third countries. Our key sub-processors (Clerk, Stripe, Cloudflare, AWS) participate in recognized cross-border data transfer frameworks.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and/or by a notice within the Service before the changes take effect. The “Effective date” at the top of this page reflects when the current version took effect.

For non-material changes (such as correcting a typographical error or updating a contact address), we will update the page without advance notice.

Continued use of KUDDZOO after an updated Privacy Policy takes effect constitutes your acceptance of the changes.

12. Contact

For privacy-related inquiries, requests to exercise your rights, or any concern about how we handle your data:

EEA / UK Representative. Opynx Entertainment LLC is a United States entity with no establishment in the European Economic Area and has not appointed an Article 27 representative. If you are in the EEA or United Kingdom, contact us at privacy@kuddzoo.com for any GDPR-related request.