SoundEX.ai

Last updated: October 17, 2026

EM-Muzic Ltd. ("EM-Muzic", "SoundEX", "we", "us", or "our") operates the SoundEX platform at soundex.ai (the “Platform”). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal data when you use the Platform, submit an access request, connect a third-party account, submit content for distribution, or otherwise interact with us. For purposes of applicable data protection law, EM-Muzic Ltd. is the controller of the personal data described in this Privacy Policy, except where we expressly state otherwise. Capitalized terms not defined in this Privacy Policy have the meanings given to them in our Terms of Service.

Privacy Notice and Legal Bases

Please read this Privacy Policy carefully. Your use of the Platform does not by itself constitute consent to all processing of your personal data. Where we rely on consent, we will request it separately and you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. We may process personal data where necessary to provide the Platform and related services, comply with legal obligations, pursue our legitimate interests where those interests are not overridden by your rights, protect the rights, safety, and security of users and others, or otherwise with your consent where required by applicable law. If you do not provide personal data that is necessary for us to provide a requested service, we may be unable to provide that service.

1. Information We Collect

1.1 Information You Provide

Data Type	Examples	Purpose
Access and Account Data	Name, email address, optional phone number, requested role, account status and type, password hash, and, if you choose Google sign-in, Google account identifier	Process access requests, create and secure accounts, authenticate users, administer the Platform, and communicate about your account
Profile Data	Stage name, legal name, artist or professional profile information, biography, image, address or country, date of birth, organization, genres, social and music-service links, and professional roles or portfolio information	Create and administer profiles, provide Platform functionality, enable collaboration and profile visibility settings, and personalize relevant features
Content and Distribution Data	Audio masters, cover art, images, file metadata, release and track information, lyrics, rights-owner information, contributor credits, recording and release codes, AI-use declarations, and distribution information	Review and administer release submissions, facilitate music distribution, manage catalogs, address rights issues, and maintain business records
Access Request and Campaign Data	Name, email address, optional phone number, requested role, declared artist profile or first-release status, and campaign tags	Assess and administer access requests, prevent duplicate or fraudulent requests, measure access-request campaigns, and communicate about an access request
Identity, Tax, and Payout-Related Data	Legal first and last name, date of birth, nationality, country of tax residence, and optional tax number; where a user supplies them, web addresses for identity-document and selfie materials	Administer identity and eligibility processes, comply with accounting, tax, fraud-prevention, and legal obligations, and support payout-related functionality if and when it becomes available
Acceptance, Financial, and Service Records	Records of acceptance of legal documents, including version, time, IP address, user agent, and, in some cases, a receipt; revenue, royalty, wallet, ledger, and withdrawal-related records; and service communications	Evidence of acceptance, legal compliance, security, audit, accounting, dispute resolution, and provision of Platform services

We may automatically collect limited technical and usage information when you access or use the Platform, including:

Usage and Service Data: release-form progress, AI-feature usage and associated token or credit information, app-shortcut installation records, service activity records, and security or operational logs. We do not use a general click-stream or page-view analytics tool on the Platform at the date of this Policy.
Device and Browser Data: browser user-agent information in limited contexts, such as acceptance records and app-shortcut installation records, and device platform information where you use the app-shortcut feature.
Connected-Platform and Performance Data: where you connect or select supported music, social, or video services, or where administrators import distributor statements or performance reports, we may receive and store the data described in Section 1.3, including public catalog information, account or channel information, audience and performance metrics, streaming, revenue, and territory information.
IP Address and Security Data: IP addresses, user-agent information, and rate-limiting information used for security, fraud prevention, abuse prevention, and evidence of legal-document acceptance. We do not use IP addresses for precise or general geolocation through the Platform.

1.3 Information from Third Parties and Connected Services

Connected Services: If you connect, authorize, or select a supported service, we may receive information from that service as authorized by you and as permitted by the service. This can include public Spotify artist-page and catalog information; YouTube channel information, access and refresh tokens, and channel analytics; TikTok profile information, access tokens, profile metrics, and limited video metrics; and Meta, Instagram, or Facebook Page information, access tokens, and engagement metrics. The categories and retention of data differ by service. We do not collect passwords for those services, private messages, or identities of individual followers, viewers, or listeners through the Platform.

YouTube Data

SoundEX.ai uses YouTube API Services. Connecting a YouTube channel is optional and requires your authorization. If you connect a channel, we request the Google permissions "View your YouTube account" (youtube.readonly) and "View YouTube Analytics reports for your YouTube content" (yt-analytics.readonly). Access is read-only: we cannot upload, edit, comment or post on your channel through these permissions. We receive your channel name, identifier, profile picture, and subscriber, view and video counts; information about up to five most recent public videos, including their titles, publication dates, thumbnails, links, and view, like and comment counts; and YouTube Analytics for the last 90 days, comprising views, watch time and views by country. We also receive access and refresh tokens, which we store encrypted. Channel information identifies the channel associated with the Google account that authorized access. We do not receive channel earnings, age or gender reports, or the identities of individual viewers or subscribers through the current YouTube connection.

SoundEX.ai's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

We use YouTube API data to display the artist's channel information and selected channel analytics. We store a snapshot daily and when a channel is connected or manually refreshed. The artist's YouTube page displays the most recent stored record, including subscriber, view and video counts, watch time, the top five countries, and the titles, view counts and links of the three most recent videos. The page does not currently display historical growth information or video thumbnails. A live read from YouTube occurs when the artist who owns the connection manually refreshes it or opens the connections page; managers and administrators view stored information and do not initiate a live read through the artist's YouTube page. Access is limited to the artist, a manager authorized by the artist, and SoundEX.ai administrators operating the Platform. The database is hosted on Google Cloud in Germany; automatic database backups are stored within the European Union, and operational logs may be stored in Google's global infrastructure. We do not sell YouTube API data or use it for advertising. Apart from the authorized access and infrastructure processing described in this section, we do not disclose it to others unless required by law. Under our current practices, YouTube API data is not sent to our AI provider and is not included in combined follower totals, growth figures or engagement scores, including in the internal administrator roster view. Historical records are addressed separately below.

You may disconnect your YouTube channel through the Platform. When you disconnect, we immediately delete the connection, associated access and refresh tokens, YouTube snapshots and other API-sourced YouTube data from our active systems, subject to the residual and separate records described below, and request revocation of the applicable Google authorization. If Google does not confirm revocation, we still immediately delete the connection, tokens and relevant data from our active systems, but SoundEX.ai's access may remain listed in your Google account until you remove it through https://security.google.com/settings/security/permissions. The same revocation and deletion process applies when your Platform account is closed.

You may revoke SoundEX.ai's access directly through Google's security settings at https://security.google.com/settings/security/permissions. We check authorization for each connected channel daily by renewing access with Google, so withdrawal is detected at the next daily check, within one day. Where you revoke access through Google, we delete the relevant stored YouTube API data from our active systems within 30 days of revocation, subject to the residual and separate records described below. If a connection loses access without a recorded revocation, our automatic process records the loss of access and applies the same deletion process, deleting the relevant stored YouTube API data from our active systems within 30 days after the loss of access is detected, subject to the residual and separate records described below.

Residual and Separate Records. Following deletion from active systems, residual copies remain in automatic database backups until those backups expire. Our current backup configuration keeps automatic daily database backups, each for seven days. Under the normal daily backup cycle, deleted records cease to be present in those backups within approximately seven to eight days. Campaign-valuation records do not store YouTube figures. When YouTube API data is deleted, any YouTube figure in an existing campaign valuation is removed at the same time. Separately, when administrators upload YouTube report files, the files are parsed in memory and are not retained as uploaded files; the extracted reporting records are stored in the database. Those imported records are not automatically deleted when a YouTube channel is disconnected and may be removed through administrative batch deletion or artist-merge processes. Their source and applicable requirements determine how they may be retained and used; importing information through a report does not exempt API-sourced data from applicable Google or YouTube requirements. These statements describe current storage practices and do not create a right to retain or disclose YouTube API data contrary to applicable Google or YouTube requirements. The general retention exceptions elsewhere in this Privacy Policy do not expand the permitted retention of YouTube API data.

Historical Data. We previously received estimated channel revenue until 10 September 2026 and age and gender reports until 5 October 2026. These records were deleted on 5 October 2026, together with subscriber-based figures in historical artist rankings and the temporary backup used for that clean-up. Before public launch, we deleted all test accounts together with their historical records, including combined Spotify and YouTube follower totals and the scores, AI-generated reports and tasks that repeated YouTube subscriber counts.

YouTube-related features use YouTube API Services. The YouTube Terms of Service are available at https://www.youtube.com/t/terms, and Google's Privacy Policy is available at https://policies.google.com/privacy.

Meta, Instagram, and Facebook Data

If you connect a Meta, Instagram, or Facebook account or Page, we may process the information and access tokens made available through the permissions you authorize. You may disconnect the relevant connection through the Platform. The effect of disconnection varies by service and feature. Depending on the relevant service and disconnection route, we may delete the connection record, clear an access token, or change the connection status. Stored performance data may remain where necessary for Platform operations, legal, security, recordkeeping, backup, or other legitimate purposes described in this Privacy Policy.

For requests concerning data obtained through Meta platforms, contact us at sound@soundex.ai with the subject line "Meta Data Request." We will process requests in accordance with applicable law and the requirements that apply to our use of Meta platform services.

Distribution Partners and Performance Sources: Administrators may import distributor statements and music-service performance reports containing artist, release, track, country or territory, streaming, sales, revenue, royalty, and related reporting information. Such records may include information about contributors or artists who are not Platform users. We may also use public catalog lookups and, where enabled, public-demand-signal services using an artist name or identifier as a search term.

2. How We Use Your Information

We use collected data to:

Operate, maintain, and improve the SoundEX Platform
Generate and display ARI, meaning Artists Rank Intelligent, and provide AI-generated insights, tasks, and other Platform features.
Review release submissions, facilitate distribution through our distributor, maintain release and catalog records, reconcile statements, and administer revenue and wallet records.
Send service-related communications, including access-request, account, security, password-reset, account-closure, and notification messages. We will send direct marketing only where permitted by applicable law and subject to the choices described in Section 11.
Detect, investigate, prevent, and address fraud, abuse, security incidents, unauthorized access, technical failures, and violations of our terms or legal rights.
Comply with legal obligations

We may also use personal data to maintain records, enforce our agreements, resolve disputes, establish or defend legal claims, respond to lawful requests, and comply with accounting, tax, regulatory, and other legal obligations.

For YouTube API data, the specific purposes and limitations in the "YouTube Data" subsection of Section 1.3 govern. The general purposes described in this section do not authorize additional uses of YouTube API data, including use in AI prompts or advertising.

For individuals in the European Economic Area, the United Kingdom, and Switzerland, our legal bases depend on the processing activity. They include performance of a contract or steps taken at your request before entering a contract; compliance with legal obligations; our legitimate interests in operating, securing, improving, and protecting the Platform and our rights, provided those interests are not overridden by your rights; and consent where required. Where we rely on consent, you may withdraw it at any time.

We do not sell personal data for money. We also do not share personal data for cross-context behavioral advertising as those terms are defined under applicable United States privacy laws. We may disclose personal data as follows:

Distribution Partner: We may disclose release, rights, contributor, and related distribution information to Believe, our distributor, through whom releases may be delivered to digital music services and stores.
Service Providers: We use service providers to host and operate the Platform, store data and files, provide security and anti-bot measures, deliver service emails, support optional sign-in, provide AI functionality, and perform related services. These providers may include Google Cloud, Google Cloud Storage, Google Cloud Logging, Google Vertex AI, Google reCAPTCHA, Google sign-in, and EmailJS. We disclose personal data to service providers only as necessary to provide their services to us. Where required by applicable law, we seek to implement appropriate contractual, technical, organizational, and international-transfer safeguards for such processing.
Legal Requirements: When required by law, court order, or to protect rights and safety
Change of Control: In the event of a merger, acquisition, or purchase of all or substantially all of our assets, your data may be transferred to the acquiring entity, provided they maintain the same privacy terms
Authorized Users and Internal Recipients: administrators may access Platform data as necessary to administer the Platform. An artist may authorize a manager to access that artist's data. Other signed-in users may view information made available through active artist profiles, including profile, release, and selected performance information. We encourage users not to include sensitive personal data in public-facing profile fields or content.

● Connected Platforms and Content Hosts: When you use connected-platform functionality, the relevant service may receive information through your interaction with that service. In addition, images, audio previews, and similar content may be loaded directly by your browser from third-party hosts, which may receive your IP address and browser information.

● Corporate Transactions: Personal data may be disclosed in connection with a proposed or completed financing, merger, acquisition, reorganization, sale of assets, bankruptcy, or similar transaction, subject to applicable law.

● Legal and Safety Disclosures: We may disclose personal data where we reasonably believe disclosure is necessary to comply with law, respond to lawful process, protect the rights, property, security, or safety of EM-Muzic, our users, or others, or investigate fraud or security incidents.

The specific access and disclosure limitations for YouTube API data in Section 1.3 take precedence over the general disclosure categories in this section. Those general categories do not independently authorize disclosure of YouTube API data to other signed-in users, distribution partners, AI providers, prospective investors or transaction counterparties.

4. Data Security

We use technical, organizational, and administrative safeguards designed to protect personal data appropriate to the nature of the information and the risks involved, including:

TLS/SSL encryption for all data in transit
Application-level encryption for certain sensitive information, including connected-account tokens and tax numbers, together with cloud-provider safeguards for data stored in our hosted environment.
Regular security audits and vulnerability assessments
Role-based access controls for internal systems
reCAPTCHA protection on access-request and registration flows to help prevent automated abuse.

● Password hashing, time-limited password-reset controls, access controls, private file storage, signed download links, security headers, rate limiting, and security monitoring.

No method of transmission or storage is completely secure. We cannot guarantee absolute security. If we become aware of a security incident affecting personal data, we will assess and respond to it in accordance with applicable law, including providing notice where legally required.

5. Data Retention

We retain personal data for periods that vary according to the category of data, the services used, the nature of our relationship with you, and applicable legal, accounting, tax, security, rights-management, and recordkeeping requirements. We may retain data for the duration of an account or distribution relationship and afterwards where necessary to meet those purposes, resolve disputes, or establish, exercise, or defend legal claims.

We are developing and implementing a retention schedule to define retention periods, review points, and deletion, anonymization, or secure-isolation actions for each material category of personal data. Until the applicable retention controls are fully implemented, information may be retained in accordance with our operational, security, legal, accounting, and rights-management requirements.

Account Closure: Account closure is handled through a request and review process. Closure may delete or anonymize certain account, session, connected-platform, notification, AI-feature, and profile data. Some information may remain where necessary for legal, accounting, security, distribution, rights-management, fraud-prevention, recordkeeping, dispute-resolution, or backup purposes.
Financial, Tax, and Identity Records: We may retain these records for the period required or permitted by applicable accounting, tax, anti-fraud, and other laws. Our current operational target for identity records is up to seven years following account closure, subject to applicable law and any required change to our retention practices.
Content, Distribution, and Rights Records: Releases, masters, artwork, contributor and rights information, and related business records may be retained for the duration of a distribution relationship and afterwards where necessary for rights administration, legal compliance, dispute resolution, recordkeeping, or the protection of legal rights.

● Acceptance, Security, and Log Records: We retain records of acceptance, security events, and logs for periods necessary to demonstrate compliance, protect the Platform, prevent abuse, and establish, exercise, or defend legal claims. Acceptance records may be retained for an extended period where necessary to demonstrate the version and timing of a user's acceptance of our legal documents. We will review retention periods under our retention schedule as it is implemented and updated.

● Backups and Deleted Files: Residual copies of data may remain in backups or storage-version systems after deletion from active systems. We retain backup copies for restoration, security, legal compliance, and disaster-recovery purposes and will apply deletion or overwrite controls in accordance with our retention schedule as implemented.

YouTube API data is subject to the specific deletion and residual-record provisions in Section 1.3, which take precedence over the general retention provisions in this section, including the provisions concerning account closure, financial records, logs and backups. General operational, security, accounting, rights-management or dispute-resolution purposes do not independently authorize retention of YouTube API data beyond what applicable Google or YouTube requirements permit.

6. Your Rights

Depending on where you live and subject to applicable law, you may have the following rights in relation to your personal data:

Access: Request a copy of your personal data
Rectification: Correct inaccurate or incomplete data
Erasure: Request deletion of your data ("right to be forgotten")
Portability: Receive your data in a structured, machine-readable format
Restriction and Objection: request restriction of processing or object to processing based on our legitimate interests, including direct marketing where applicable.
Withdraw Consent: withdraw consent at any time where we rely on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.

If you are in the EEA, the UK, or Switzerland, you may also lodge a complaint with your local data protection authority. If you are a resident of a United States state with applicable privacy rights, you may have rights to know, access, correct, delete, obtain a portable copy of, or opt out of certain processing of your personal information, subject to applicable exceptions and limitations. We do not sell personal information and do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising applicable privacy rights.

If we deny a request made under an applicable United States privacy law, you may appeal by replying to our decision and stating that you are submitting a privacy-rights appeal.

To exercise your privacy rights, email sound@soundex.ai with the subject line "Privacy Request." Please describe your request and provide information reasonably necessary for us to identify you and locate the relevant records. We may request additional information where necessary to verify your identity or, where applicable, the authority of an authorized agent acting on your behalf. We will respond within the period required by applicable law. Where permitted by law, you may authorize an agent to submit a request on your behalf, subject to verification of the agent's authority and your identity.

7. Cookies & Tracking

We use cookies, local storage, session storage, and similar technologies that are necessary to provide, secure, and operate the Platform. These technologies may be used for authentication, session management, fraud prevention, security, connection flows, user-interface preferences, campaign attribution, and the display of AI-feature content and action items.

Our authentication session may persist for up to 30 days and may be renewed during use. We may also use cookies or similar technologies in connection with sign-in security, TikTok connection flows, and Platform preferences. Google's reCAPTCHA service may set or access technologies in your browser when used on relevant pages.

We do not currently use Google Analytics, advertising pixels, or third-party advertising cookies on the Platform. We do not use cookies or similar technologies to sell personal information or to share personal information for cross-context behavioral advertising.

Where applicable law requires consent before non-essential cookies or similar technologies are used, we will obtain that consent before activating them. You can manage cookies through your browser settings. However, disabling strictly necessary technologies may prevent some Platform functions from operating properly.

8. International Data Transfers

We are established in Israel. The Platform, database, and primary file storage are operated through Google Cloud infrastructure in Germany. Depending on the services you use, personal data may also be processed in Israel, the United States, and other countries where our service providers, distribution partner, or connected platforms operate. In particular, certain AI processing is performed through Google Vertex AI in the European Union, and in the United States only when the European Union service is temporarily unavailable.

Where personal data subject to the laws of the European Economic Area, the United Kingdom, or Switzerland is transferred to a country that is not recognized as providing an adequate level of protection, we will use an appropriate transfer mechanism required by applicable law. Depending on the transfer, this may include an adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or UK Addendum to the Standard Contractual Clauses, or another legally valid transfer mechanism, together with supplementary safeguards where required.

9. Children's Privacy

SoundEX is not intended for individuals under 18 years of age. We do not knowingly collect personal data from individuals under 18. We do not currently use an age-verification process at the access-request stage. If we learn that we have collected personal data from an individual under 18, we will assess the circumstances and take appropriate action, including deleting or restricting the information where required by applicable law. Parents or legal guardians who believe that a child has provided personal data to us may contact us at sound@soundex.ai.

10. Service Providers and Third-Party Services

We use third-party service providers to operate and support the Platform. Depending on the feature used, these providers may include Google Cloud and Google Cloud Storage for hosting, database, and file storage; Google Cloud Logging for operational logs; Google Vertex AI for AI-generated insights, tasks, and statement-column mapping; Google reCAPTCHA for bot protection; Google sign-in for optional authentication; EmailJS for service-email delivery; Believe for music distribution; and supported music, social, video, and catalog services, including Spotify, YouTube, TikTok, Meta, Apple Music, and Deezer. Some public-demand-signal services may be used only if enabled. Provider processing, privacy practices, and locations are governed by the applicable provider terms and privacy notices.

11. Direct Marketing

We may send service-related emails and other operational communications needed to administer your account or provide the Platform. We do not currently use the Platform to send marketing emails or SMS messages. If we introduce direct marketing, we will do so only as permitted by applicable law and will provide any required notice, consent mechanism, and opt-out method. You may unsubscribe from optional notification emails through the unsubscribe link in the relevant message or through available account settings.

12. Use of Artificial Intelligence (AI)

We use Google Vertex AI, including the Gemini model made available through that service, to provide certain AI-generated insights, tasks, and statement-column mapping assistance. AI processing takes place in the European Union. If the European Union service is temporarily unavailable, a request may be processed in the United States instead. Depending on the feature used, information included in an AI prompt may include artist name, genre, artist type, home country, connected services other than YouTube, ARI score, streaming and revenue trends, distribution-fee information, selected engagement and performance metrics, country-level performance information, upcoming events, track information, and content or questions that you submit. Under our current practices, YouTube API data is excluded from information sent to the AI provider, including connected-service data, engagement and performance metrics, and country-level analytics. Please do not submit YouTube API data in free-text AI prompts. Please also do not submit sensitive personal data, special-category personal data, confidential information, or personal data about third parties in free-text prompts unless you have a lawful basis and, where required, appropriate authority to do so. AI-generated outputs are provided as informational tools only. They may be inaccurate, incomplete, or unsuitable for your circumstances and should not be relied upon as legal, financial, investment, medical, or other professional advice. ARI is calculated by our own systems and not by the AI provider. AI outputs and ARI do not by themselves determine eligibility for access, payments, or Platform features. We do not use personal data from the Platform to train our own AI models unless we first provide any notice and obtain any consent required by applicable law. This general provision does not authorize use of YouTube API data for model training. Processing by our AI service providers is subject to the terms, settings, contractual arrangements, and data-protection commitments applicable to the relevant service.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or business operations. We will post the updated Privacy Policy on the Platform and update the "Last updated" date.

If a change is material, we will provide additional notice in a manner appropriate to the change and as required by applicable law. This may include a notice on the Platform, an email where we have a valid email address and are permitted to contact you, a request for renewed consent, or a request for re-acceptance. Unless a different period is required by applicable law or stated in the notice, material changes will take effect no earlier than seven days after notice is provided.

14. Contact Us

For privacy-related questions or data requests:

EM-Muzic Ltd.
Data Protection Inquiries
Email: sound@soundex.ai
Registered office: Hirschfeld 34, Rishon Lezion 7524444, Israel
Company number: 517203071

If EM-Muzic appoints a representative in the European Economic Area or the United Kingdom, or is required by applicable law to do so, this Privacy Policy will be updated to identify that representative and provide its contact details.