GDPR

01Our role and your role

Run is operated from France by Void Music Group SASU, 25 rue de Ponthieu, 75008 Paris, France, which is the data controller for the personal data described in our Privacy Policy. Being established in the European Union, the GDPR applies to everything we do, for every user, wherever you are.

We have not appointed a Data Protection Officer, which a company of our size and activity is not required to do. A copy of your data and the deletion of your account you can run yourself, in your workspace settings; everything else reaches us directly at privacy@run.audio, and a person handles it.

When you enter credits, contributor roles and publishing splits, you are giving us personal data about other people. You are responsible for having the right to do that and for telling them how it is used; point them at this page, and they can exercise their rights with us directly.

02How we apply the principles

• Data minimisation is a design rule, not a promise. Run never stores your bank details or your tax forms. Card numbers go straight to our payment provider and never reach us. The record of your accepting our terms stores the browser user agent and deliberately not your IP address. We do keep the address a signed-in session connects from, for account security and abuse prevention and for nothing else, and it is in the copy of your data you can download.
• Purpose limitation. Data you give us to distribute music is used to distribute music, report on it and keep the service safe. We do not sell personal data, we run no behavioural advertising, and we do not profile you for marketing.
• Integrity and confidentiality. Access is restricted at the database level so an account reaches only its own records, credentials live as server-side secrets, traffic is encrypted in transit, and administrative access requires two-factor authentication.
• Accountability. State changes and administrative actions are written to an audit log, and every processor below is engaged under a written contract.

03Legal bases at a glance

Contract

Your account, your releases, delivery to the stores, earnings and analytics reporting, billing and support Article 6(1)(b)

Legal obligation

Accounting and tax records, invoices, answering lawful requests and rights holders’ complaints Article 6(1)(c)

Legitimate interests

Security and abuse prevention, screening submitted audio for unauthorised use and impersonation, enforcing our terms and store policies, improving the service Article 6(1)(f), balanced against your rights

Consent

Non-essential cookies and any optional message you opt into, withdrawable at any time Article 6(1)(a)

04Your rights, one by one

• Access (Art. 15): a copy of the personal data we hold about you, and confirmation of what we do with it.
• Rectification (Art. 16): correction of anything inaccurate or incomplete. Most of it you can edit yourself in the workspace.
• Erasure (Art. 17): deletion of your data. You start it yourself in Settings, and it takes your profile, your artist profiles, your drafts, the audio and artwork you uploaded, the addresses your account signed in from and your notifications with it. Some things stay, each for a reason: billing and accounting records, because French commercial law makes us keep them for ten years; the audit log, because it is how we can show what happened to a release we delivered; and the record that you accepted a version of an agreement, because it is the proof of the deal we distributed under. What stays no longer carries your name, your email or your address.
• Restriction (Art. 18): a pause on processing while a dispute about accuracy or legitimate interests is resolved.
• Portability (Art. 20): the data you gave us, in a structured, machine-readable format, for you or for another service. That is the export bundle in Settings: one JSON file holding your account, your artists, your labels, your catalogue with its credits and splits, your earnings lines, your notifications and a record of the mail we sent you. Your audio, artwork and clearance documents are not inside it: each one carries a link that works for as long as the export does. Earnings are also exportable as CSV from the workspace at any time.
• Objection (Art. 21): to processing based on our legitimate interests, including any direct marketing, which we stop on request without needing a reason.
• Withdrawal of consent (Art. 7(3)): at any time, without affecting what we did before you withdrew it.
• A human decision (Art. 22): see automated processing below.

The limits, stated plainly:

• Accounting records, including invoices and royalty statements, are kept for ten years because French commercial law requires it. Erasure does not reach them.
• We cannot delete a release from a store’s own systems. We can request its removal from every store it reached, which they then action on their own schedule.
• Records of the terms you accepted are kept while the agreement can be relied on, since they are the proof that it was accepted.
• An address on our do-not-contact list stays there: removing it would start the mail again.
• If we closed your account for breaking our rules, the IP addresses tied to it stay on our abuse denylist once the account is erased. Outliving the account is what the list is for, and the entry keeps the address and the reason it was added, with no name, no email address and no link back to the erased account.

05How to exercise them

In the workspace, immediately. Your profile, artist details, release drafts, credits and store selections are yours to edit, and takedown requests for your catalogue are self-serve. Two more controls sit in Settings, and between them they cover the rights people ask about most.

Download your data. Ask for it in Settings and we assemble everything we hold about your account into one machine-readable file, then email you when it is ready. You download it from Settings while signed in, which is what keeps it yours. It stays available for a few days (the email gives you the exact date) and is then deleted, and you can ask for a new one every 24 hours.

That file is your personal data gathered in one place, and the file links inside it work for anyone holding them until they expire. The download is private to your account: keep the file that way too, somewhere safe, and think twice before forwarding it or leaving it in a shared folder.

Delete your account. Also in Settings. You type the confirmation phrase, and the deletion is scheduled 14 days out, so a bad afternoon is not final: you can cancel it from Settings at any point in those 14 days. If you have releases at the stores you have to acknowledge it explicitly, because we request a takedown for them straight away, and cancelling the deletion does not put a release back. Stores remove on their own schedule. When the 14 days are up, the account is erased: profile, artists, drafts, uploaded audio and artwork, notifications. What survives, and why, is in the erasure entry above.

Everything else, by email. Write to privacy@run.audio from the address on your account, and say which right you are using and what it concerns. That is also the route if you have no account with us, for instance a collaborator named in someone else’s credits. A person reads it and answers.

What happens next. We answer within one month, and tell you inside that month if a complex request needs longer (up to two further months, which is the maximum the GDPR allows). It is free, unless a request is manifestly unfounded or excessive, in which case we say so rather than quietly ignoring it. If we cannot identify you from the request we will ask for what we need, and nothing more.

06Recipients and transfers

Article 13(1)(e) asks for the recipients or the categories of recipients of your personal data, and we publish the categories. Each one is engaged under a written contract that limits it to our instructions and forbids using your data for its own purposes.

Music distribution partner

Receives your release, its metadata and credits, and delivers them to the stores you selectRegion: United States

Hosting and infrastructure providers

Run this website and the workspace, the application backend, the account database, and storage for the audio and artwork you uploadRegion: European Union (database and uploaded files) and United States (application hosting)

Payment provider

Subscription payments, invoices and tax calculationRegion: United States

Email provider

Sends transactional email such as sign-in links and release status updatesRegion: United States

Audio recognition provider

Fingerprint matching on submitted tracks, to detect unauthorised use and impersonationRegion: European Union

Bot-protection provider

Protects the sign-up and sign-in forms against automated abuseRegion: Global

AI assistant provider

Generates the answers of the assistant in the workspace from the question you type and the recent conversation; it receives no catalog or account dataRegion: United States

We publish categories rather than company names. If you want to know which specific companies sit behind them, ask us and we will tell you: it is your right, and we answer it. That is not a courtesy: under Article 15(1)(c), as the Court of Justice read it in C-154/21, you are entitled to the actual identities on request, and asking costs you nothing. Write to privacy@run.audio.

Your account database and the files you upload are hosted in the European Union. Some recipients above are established in the United States, so running the service and delivering your music involve transfers outside the European Economic Area. Those are covered by the European Commission’s Standard Contractual Clauses or another Chapter V mechanism, and you can ask us which one applies to a specific transfer, and to which company.

07Retention

We keep account, artist and release data while your account is open. Delivered releases keep their delivery and rights record for as long as a claim or a royalty correction is possible. Accounting records run to ten years. Technical logs are short-lived, in the order of weeks to months, unless an entry is part of a security investigation. The full table is in the Privacy Policy.

Deleting your account puts a 14-day clock on all of it. During those 14 days nothing has happened yet and you can cancel in Settings. After them the erasure runs, and what it takes is gone: your profile, your artist profiles, your drafts, the audio and artwork you uploaded, your notifications, and the record of the mail we sent you. Export bundles you had asked for go with it.

What we have to keep is kept in anonymised form: billing and accounting records, which French commercial law holds us to for ten years; the audit log, which is how a release we delivered can still be accounted for; and the record that an agreement version was accepted, which is the proof of the terms it was delivered under. None of them carry your name, your email or your address once the erasure has run.

08Automated processing

Releases are checked automatically before delivery: metadata and files against store requirements, and audio against a fingerprint database to detect unauthorised use and impersonation. Those checks can hold a release or send it back with reasons.

They are not decisions taken solely by automated means within the meaning of Article 22. Anything flagged is reviewed by a member of our team before a release is rejected, you are told why, and you can correct and resubmit, or contest the outcome with us. We do not profile you, and none of this produces a score attached to you as a person.

09If something goes wrong

If a personal data breach happens and it presents a risk, we notify the CNIL within 72 hours of becoming aware of it, and we notify you directly where the risk to you is high. Our processors are contractually required to tell us without undue delay, which is what makes that deadline meetable.

10Labels and businesses using Run

If you use Run as a label, a manager or a company, you are handling personal data about your artists and collaborators, and you need a lawful basis for giving it to us. For most accounts we are a controller in our own right for that data, not your processor, because we decide how it has to be handled to deliver to stores and to meet our own legal obligations.

If your own compliance work needs written data processing terms, ask at privacy@run.audio and we will sort it out with you.

11Complaints

Come to us first at privacy@run.audio: it is usually the fastest way to fix something. You also have the right to complain to a supervisory authority at any time, without asking us first.

Ours is the French authority: Commission Nationale de l’Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr. You can equally complain to the authority in the country where you live or work.