DRAFT · PENDING LEGAL REVIEW · effective date to be set

Privacy Policy

Effective date: [EFFECTIVE DATE]
Last updated: [LAST UPDATED DATE]

This policy explains what personal information Royalty Detective collects through royaltydetective.com, why we collect it, who helps us process it, how long we keep it, and the choices you have. We've tried to write it in plain English. If anything is unclear, email us (see Contact us).

Who we are

Royalty Detective is operated by [Legal entity name] ("Royalty Detective," "we," "us"), founded by Raymond Collins and based in Cooper City, Florida, USA. For the purposes of laws like the GDPR, we are the "controller" of the personal information described here.

Contact: privacy@royaltydetective.com placeholder: inbox not set up yet

The short version

We collect only what you type into our free-scan signup form, plus a small amount of technical data to keep the form safe from spam and abuse.
We use it to put you on our waitlist, contact you about your free scan, and understand which channels bring people to us.
We do not sell your personal information, do not share it for advertising, and do not use analytics or advertising cookies.
We use a few service providers (Cloudflare to host the site and check for bots; optionally Resend to notify us internally about new signups).
You can ask us to see, correct, or delete your information at any time.

What we collect

Field	Required?	Why
Your name	Yes	To know who we're talking to
Email address	Yes	To contact you about your free scan and our launch
Artist / project name	No	To find your works in public registration databases when we run your scan
Your performing rights organization (e.g., BMI, ASCAP, SOCAN)	No (defaults to "Not sure / none")	To know which registries to check
Approximate catalog size	No	To plan your scan and suggest the right audit size
Your role (artist/songwriter, producer/topliner, manager, other)	No	To send you relevant information
Consent checkbox	Yes	Records that you agreed to this policy and to us emailing you about your free scan

Information collected automatically when you submit the form

Referring page and campaign tags. The web address that sent you to our site (if your browser shares it) and any "UTM" campaign tags in the link you clicked (source, medium, campaign). We use these to understand which channels work. We don't use them to track you across other sites.
A one-way hash of your IP address. We do not store your IP address. We combine it with a secret value and run it through a one-way function (SHA-256), and store only the result. We use this solely to limit repeated signups from the same network (currently 5 per 10 minutes) and to fight spam. It is deleted automatically after 30 days (see How long we keep it).
Your browser's user-agent string (browser and operating system type), used to spot automated abuse. Also deleted automatically after 30 days.
The date and time you signed up.

If you fill in a hidden field that only automated bots see, we discard the submission and store nothing.

Information we do not collect

We don't collect payment details, passwords, royalty statements, or access to your society or distributor accounts through this website today. See Future services.

Cookies and similar technologies

Royalty Detective itself does not set any cookies and does not use analytics, advertising, or tracking tools, local storage, or tracking pixels.

Two things to know:

Cloudflare Turnstile (our bot check on the signup form) runs on the home page. It may use browser signals, and in some cases strictly necessary cookies or similar technologies, to tell humans from bots. It's not used for advertising. See Cloudflare's Turnstile Privacy Addendum.
Cloudflare, as our host and security provider, may set strictly necessary security cookies (for example, to block malicious traffic). See Cloudflare's cookie policy.

Our fonts are hosted on our own site, so loading our pages doesn't send your information to font providers.

How we use your information

Run the waitlist and your free scan: record your signup, contact you about your scan and our launch, and run the scan using public registration databases.
Avoid duplicates: if you sign up twice with the same email, we keep your original signup and tell you you're already on the list.
Protect the service: verify you're human, limit repeated submissions, and prevent spam, fraud, and abuse.
Understand what's working: see which referral channels and campaigns bring people in, in aggregate.
Notify our team: we may send ourselves an internal email when someone signs up (see Resend below).
Meet legal obligations: respond to lawful requests and enforce our terms.

We do not send marketing emails to you except about your free scan and our launch, as you agreed when you signed up. Every non-transactional email we send will include a way to opt out. We don't use your information for automated decisions that have legal or similarly significant effects on you.

Legal bases (for visitors in the EEA, UK, Switzerland and similar jurisdictions)

Consent: to contact you about your free scan and our launch. You can withdraw consent at any time; this doesn't affect anything we did before you withdrew.
Steps before a contract at your request: to run the free scan you asked for.
Legitimate interests: to secure the site and prevent abuse (hashed IP, user agent, bot check), and to understand which channels work (referrer/UTM). We've kept this data minimal and short-lived.
Legal obligation: where the law requires us to keep or disclose information.

We do not sell your personal information and do not "share" it for cross-context behavioral advertising (as those terms are defined under California law). We share it only with:

Provider	What they do for us	Data involved	Privacy policy
Cloudflare, Inc. (USA)	Hosts the website and signup function (Cloudflare Pages), stores signups in its database service (D1), protects the site, and runs the Turnstile bot check	Everything submitted through the form; standard web request data (like IP address) that passes through its network	Cloudflare Privacy Policy · Turnstile Privacy Addendum
Resend (USA). Optional; only if we enable internal signup notifications	Delivers an internal email to our team when someone signs up. We don't use it to email you	Your name, email, artist name, PRO, catalog size, role, and referrer	Resend Privacy Policy

These providers process data on our behalf under their terms and data processing agreements, and may not use it for their own advertising.

We may also disclose information if required by law, to protect the rights, safety, or property of you, us, or others, or as part of a merger, acquisition, or sale of assets (in which case this policy, or one at least as protective, will continue to apply).

How long we keep it

Signup information (name, email, artist name, PRO, catalog size, role, referrer/UTM, consent, signup date): kept until you ask us to delete it, or until 24 months after you sign up if you haven't become a customer or otherwise engaged with us, whichever comes first. We review the list at least every quarter and delete records that have reached this limit.
Hashed IP address and user agent: deleted automatically after 30 days. Our system clears these fields on older records as new signups come in, and we also clear them during our quarterly review.
Cloudflare's own logs and security data are retained under Cloudflare's policies.
If you become a customer, we'll keep information as described in the updated policy and agreement that will apply to paid services.

How we protect it

Data is sent over encrypted connections (HTTPS) and stored with Cloudflare, which encrypts data at rest.
IP addresses are never stored in readable form; only a salted one-way hash, which is deleted after 30 days.
Exporting the signup list requires a secret administrator token. Only people who need access to run Royalty Detective have it.
Secrets (like the token and the hashing value) are stored as encrypted environment settings, not in our code.

No system is perfectly secure. If a breach affects your personal information, we'll notify you and the authorities as required by law.

Your rights and choices

Wherever you live, you can ask us to:

Access the personal information we hold about you and get a copy;
Correct information that's wrong;
Delete your information (we'll remove you from the waitlist);
Withdraw consent / opt out of emails from us at any time.

Email privacy@royaltydetective.com from the address you signed up with. We may need to confirm your identity before acting. We'll respond within 30 days (or sooner if required by law), and we won't discriminate against you for using your rights.

California (CCPA/CPRA). California residents have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of the "sale" or "sharing" of personal information (we do neither); and to limit the use of sensitive personal information (we don't collect any). You may use an authorized agent. In the past 12 months we have collected the categories of identifiers (name, email, hashed IP), internet activity (referrer, UTM tags, user agent), and professional information (artist name, PRO, role, catalog size) described above, for the purposes described above, and disclosed them only to the service providers listed above.

EEA, UK and Switzerland (GDPR / UK GDPR). You also have the rights to restrict or object to processing based on legitimate interests, to data portability, and to complain to your local data protection authority.

Florida and other US states. Florida's Digital Bill of Rights applies only to very large businesses and doesn't currently apply to us, but we offer the rights above to everyone. If your state gives you additional privacy rights, contact us and we'll honor them as required.

Global Privacy Control / Do Not Track. Because we don't sell or share personal information or use tracking cookies, there's nothing for these signals to switch off. We treat them as a valid opt-out request where the law requires it.

Children

Royalty Detective is meant for working musicians and their teams. It's not directed to children under 13, and we don't knowingly collect personal information from children under 13 (or under 16 in the EEA/UK). If you're under 18, please have a parent or guardian sign up for you. If you believe a child has given us information, contact us and we'll delete it.

International transfers

We're based in the United States, and our providers process data in the US and other countries where they operate. If you're outside the US, your information will be transferred to and processed in the US, where privacy laws may differ from yours. Where required, we rely on appropriate safeguards such as our providers' Standard Contractual Clauses and/or their certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

Future services

Today this website only collects waitlist signups. Our paid audit services will involve more sensitive information, such as royalty statements, registration exports, and read-only or delegated access to your society, MLC, SoundExchange, or distributor accounts. Before we collect any of that, we'll ask you to sign a separate Engagement & Success Fee Agreement and we'll publish an updated privacy policy explaining exactly what we access, why, and how long we keep it. We will not file anything on your behalf without your approval.

Changes to this policy

We'll post any changes here and update the "Last updated" date. If a change is material, we'll notify people on our list by email before it takes effect.

Contact us

[Legal entity name] (Royalty Detective)
Cooper City, Florida, USA
Email: privacy@royaltydetective.com