FSTRX Privacy Policy

1. Who We Are

1.1 This Privacy Policy explains how FSTRX LLC ("FSTRX", "we", "us", "our") collects, uses, shares and protects personal data in connection with the FSTRX platform and associated websites and applications (the "Service").

1.2 Data controller.

FSTRX LLC
A Delaware limited liability company (file number 10406784)
Registered address: 16192 Coastal Highway, Lewes, Delaware 19958, United States
Email: contact@fstrx.io

1.3 Privacy contact. All privacy enquiries and data-rights requests should be sent to contact@fstrx.io. We have not appointed a formal Data Protection Officer, having assessed that we are not currently required to do so under Article 37 of the GDPR. We will appoint one if that position changes.

2. Scope and Roles

2.1 This Policy applies to personal data we process about:

• (a) Account holders — Supervisors, Providers and Clients who register for the Service;

• (b) Invited collaborators and recipients — people invited to view, comment on or approve materials, including clients and reviewers who participate in a project without holding their own subscription;

• (c) External link recipients — people who receive a shared playlist, album, shortlist or link and who may have no FSTRX account. Where such a person opens a link, we process the IP address, device and browser information needed to deliver the content, secure the Service and prevent abuse;

• (d) Payers without an account — when you pay through a payment link, we store your email address and the payment outcome; Stripe collects your name and card or bank details;

• (e) Website visitors and prospective customers; and

• (f) Third parties whose personal data appears in Content uploaded by our Users, such as writers, performers, publisher contacts and email correspondents.

2.2 Controller and processor roles.

• (a) We act as controller for account data, billing data, usage and analytics data, website data, and marketing communications.

• (b) We act as processor for personal data contained within Content that an account holder uploads or transmits through the Service. In that case the account holder is the controller and is responsible for having a lawful basis for the processing, for providing required notices to the individuals concerned, and for responding to their requests. Our processing in that role is governed by our Data Processing Addendum, which is available to business customers on request from contact@fstrx.io.

2.3 Where you received an invitation or a playlist, album, shortlist or link from an FSTRX User, that User — not FSTRX — determines what is shared with you and why. Please direct requests about that material to them.

2.4 Beta stage. The Service is currently offered on a beta, early-access basis and free of charge. Payment facilitation between Users is live. Paid plans have not yet launched; features described in this Policy that depend on paid plans are marked accordingly and take effect only when those features launch. We will update this Policy and give notice under Section 17 before any material change in how we process personal data.

3. Personal Data We Collect

3.1 Data you provide.

3.2 Data collected automatically.

3.3 Data from third parties.

• (a) Google account data — where you sign in with Google (see Section 7).

• (b) Similar-track suggestions from Cyanite.ai — Cyanite.ai receives only Spotify track identifiers, to retrieve similar-track suggestions. No audio or user content is sent to Cyanite.

• (c) Catalogue reference data from Spotify — track, artist and release information retrieved when you use lookup or reference-search features.

• (d) Payment and identity data — verification status, payment outcomes and chargeback information from the payment processor.

• (e) YouTube video information — retrieved when you use video search or paste YouTube links.

3.4 We do not intentionally collect special categories of personal data (such as health, biometric, racial or ethnic origin, religious belief, trade-union membership or sexual orientation data) and ask that you do not upload such data through the Service except where necessary and lawful.

4. Why We Use Personal Data and Our Legal Basis

Where the GDPR, UK GDPR or Israel's Privacy Protection Law applies, we rely on the following bases.

4.1 Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may object to such processing as described in Section 12, and you may request details of the balancing assessment.

4.2 We do not carry out automated decision-making producing legal or similarly significant effects concerning you.

5. AI and Automated Processing of Content

5.1 The Service uses artificial intelligence and automated audio analysis to generate metadata; to classify and tag musical works by genre, sub-genre, mood, instrumentation, use case, key, tempo and vocal characteristics; to generate descriptions, transcribe lyrics and estimate perceived vocal gender; to separate audio into stems; to interpret creative briefs; to power natural-language, agentic and similarity search and discovery; and, where you expressly request it, to generate reference audio. Transcribed lyrics and perceived vocal gender are automated estimates and may be inaccurate.

5.2 To provide these features we transmit Content — which may in some cases include personal data contained in that Content — to the processors listed in Section 6, principally Google for analysis, search, discovery and generation. Cyanite.ai receives only Spotify track identifiers, to retrieve similar-track suggestions. No audio or user content is sent to Cyanite. Google's Gemini models receive the full audio of uploaded tracks, uploaded video, images and documents, YouTube links, file names, tags and songwriter credit information (names, IPI/CAE numbers, PRO affiliations and splits), and use them to generate descriptions, genres and moods, transcribed lyrics and an estimate of perceived vocal gender, to interpret briefs, and to power search. Each processor acts on our documented instructions under a written data-processing agreement. Source separation into stems is performed on our own infrastructure and is not sent to any third party.

5.3 We do not train AI models on your Content. We do not use Content uploaded to the Service to train, fine-tune or develop generative artificial intelligence or foundation models, whether our own or a third party's, and we contractually require our processors not to do so. We use only aggregated, anonymised and non-identifying usage statistics, which do not incorporate or reproduce Content, to measure and improve the Service.

5.4 Where the Service generates audio or other material using artificial intelligence at your request, that material is identified as AI-generated within the Service and, where technically feasible, carries a machine-readable marking, in line with transparency obligations under the EU Artificial Intelligence Act.

5.5 Automatically generated metadata, matches, identifications and rights information are assistive and may be inaccurate. They are not verification of ownership or clearance.

5.6 De-identified and aggregated data. Where we create de-identified or aggregated data, we maintain it in that form, do not attempt to re-identify it or associate it with any individual or household, and contractually require any recipient to do the same. We use such data only to measure, secure and improve the Service, and it does not incorporate or reproduce your Content.

6. Sharing and Sub-Processors

6.1 We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

6.2 We share personal data with the following categories of recipient.

• (a) Other Users, as directed by you. Information shared within a project workspace is visible to the participants authorised for that workspace, according to the permissions you set. When you share a playlist, album, shortlist, link, project or submission, the recipient sees the Content and the identity of the sharing account. Comments, approvals, timestamped notes and activity within a shared workspace are visible to the other participants in that workspace.

• (b) The FSTRX Catalogue. Content you upload to your own catalogue is not shared with other Users. Separately, you may opt in to submit Content for consideration for the FSTRX Catalogue. We review submitted Content before deciding whether to accept it, and inclusion is not automatic. Where Content is accepted, it and its associated metadata, artwork and derived tags may be surfaced to other Users in search, discovery, recommendation and brief-matching results, including to Users with whom you have no prior relationship, and the account or catalogue it belongs to is identified in those results. You may withdraw Content from the FSTRX Catalogue at any time.

• (c) Licensing counterparties. Where a licence or transaction is concluded through the Service, ownership and rights metadata — such as writer and publisher names, PRO affiliations, IPI/CAE numbers and share splits — may be transmitted to the counterparty to satisfy chain-of-title, cue-sheet and rights-administration requirements.

• (d) Processors and service providers. The following act on our behalf, under written data-processing terms.

Source separation into stems is performed on our own infrastructure and is not sent to any third party. We do not currently use third-party product analytics or error-tracking services. An up-to-date list is maintained in this Section. Business customers may subscribe to notification of changes as set out in our Data Processing Addendum.

• (e) Professional advisers — lawyers, accountants and auditors, bound by confidentiality.

• (f) Legal and regulatory recipients — where disclosure is required by law, court order or valid legal process, or is necessary to investigate suspected fraud or infringement, respond to an emergency involving a risk to life or serious harm, or establish, exercise or defend legal claims.

• (g) Corporate transactions — a prospective or actual buyer, investor or successor in connection with a merger, acquisition, financing, reorganisation or sale of assets, subject to confidentiality and to this Policy continuing to apply.

6.3 Third-party links and embedded content. The Service may contain links to, or embed content from, third-party websites and services, including video players, external review links and the sites of other Users. Those third parties determine their own privacy practices and may collect data about you when you interact with their content. This Policy does not cover them, and we are not responsible for their practices. Review the privacy notice of any third-party service before providing personal data to it. Emails we send may load fonts from Google, and embedded Spotify and YouTube players may set their own cookies when you play them.

7. Google Sign-In and Google User Data

7.1 You may choose to sign in to the Service using your Google account. If you do, we receive from Google only your name, email address, profile image where available, and a Google account identifier. We do not request access to your Gmail messages, Google Drive files, Google Calendar or any other Google service data.

7.2 FSTRX's use and transfer of information received from Google APIs to any other application adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

7.3 We do not use Google user data for advertising, do not transfer it to any advertising platform, data broker or information reseller, and do not use it to train, fine-tune or develop artificial intelligence models. Human access to Google user data occurs only with your affirmative consent, as necessary for security purposes or to investigate abuse, to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.

7.4 OAuth tokens issued to us by Google are encrypted at rest.

7.5 You may disconnect FSTRX at https://myaccount.google.com/permissions or ask us to do so at contact@fstrx.io, and may request deletion of Google user data held by us by contacting contact@fstrx.io.

7.6 Signing in with Google is optional. You may instead sign in using a magic link sent to your email address.

7.7 Separately from sign-in, we use Google Cloud Platform for hosting and Google's Gemini and Lyria models for the features described in Section 5. Those uses are covered by Section 6 and Section 5, not by this Section.

8. Cookies and Similar Technologies

8.1 We use essential cookies only: a sign-in session cookie (up to 7 days), a cookie remembering your sidebar layout, and cookies used during Google sign-in.

8.2 We do not use analytics or advertising cookies. Embedded third-party players may set their own cookies (see 6.3).

8.3 If we add non-essential cookies, we will ask for your consent first.

8.4 We honour Global Privacy Control (GPC) signals as a valid opt-out request where applicable law requires.

8.5 Do Not Track. Web browsers may transmit a "Do Not Track" signal. There is no common industry standard for interpreting it, and we do not currently respond to Do Not Track signals. We do respond to Global Privacy Control signals as described in Section 8.4, and we do not use non-essential cookies (see Section 8.1).

9. Retention

9.1 We retain personal data only for as long as necessary for the purposes for which it was collected, and then delete or irreversibly anonymise it.

10. International Transfers

10.1 FSTRX LLC is established in the United States. Our infrastructure runs on Google Cloud Platform, primarily in the United States (region us-central1). Some processors, including Cyanite.ai and Brevo, are established in the European Union. Our personnel and operations are located in Israel. Personal data you provide will therefore be processed in, and accessed from, countries outside your own.

10.2 Transfers from the EEA and the UK. Where personal data is transferred from the European Economic Area, the United Kingdom or Switzerland to FSTRX LLC in the United States, or onward to a processor in a country without an adequacy decision, we rely on:

• (a) the Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Addendum for transfers from the United Kingdom, and a transfer impact assessment where required; or

• (b) where the recipient is certified, the EU–US Data Privacy Framework and its UK and Swiss extensions.

10.3 Access from Israel. Our personnel access personal data from Israel in the course of operating the Service. The European Commission has recognised Israel as providing an adequate level of protection for personal data. That decision, first adopted in 2011, was reconfirmed on 15 January 2024 and upheld in the Commission's subsequent periodic review, and transfers from the EEA to Israel therefore require no additional safeguard.

10.4 We take steps to ensure that personal data continues to receive an appropriate level of protection wherever it is processed, including by imposing contractual data-protection obligations on every processor.

10.5 You may request a copy of the relevant safeguards by contacting contact@fstrx.io.

11. Security

11.1 We implement technical and organisational measures appropriate to the risk, including:

• (a) encryption of data in transit (TLS) and at rest;

• (b) We do not use passwords. Sign-in is by Google or by one-time email links;

• (c) role-based access control and least-privilege access for staff, with access to Content limited to those who need it for support, security or legal compliance;

• (d) network isolation, logging and monitoring;

• (e) contractual data-protection obligations on all processors;

• (f) regular backups;

• (g) encryption of OAuth tokens at rest; and

• (h) key infrastructure secrets held in a managed secrets service, with the database not publicly reachable and administrative access only through a bastion host with key-based authentication.

11.2 No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping access to your email account and Google account secure.

11.3 Breach notification. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where required, within 72 hours of becoming aware of it, and will notify affected individuals without undue delay where the breach is likely to result in a high risk. Where we act as processor for an account holder's Content, we will notify that account holder without undue delay.

12. Your Rights

12.1 Subject to applicable law, you have the right to:

• (a) access the personal data we hold about you and receive a copy;

• (b) rectify inaccurate or incomplete data;

• (c) erase your data in certain circumstances;

• (d) restrict processing in certain circumstances;

• (e) object to processing based on legitimate interests, and to object at any time to direct marketing;

• (f) data portability — receive data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;

• (g) withdraw consent at any time, without affecting the lawfulness of processing before withdrawal; and

• (h) not be subject to a decision based solely on automated processing producing legal or similarly significant effects.

12.2 California residents (CCPA/CPRA) — see also Section 13 — have the right to know the categories and specific pieces of personal information collected, the sources, purposes and categories of recipients; to delete; to correct; to limit the use of sensitive personal information; to opt out of sale or sharing (we do not sell or share); and not to be discriminated against for exercising these rights. Requests may be submitted by an authorised agent with proof of authorisation.

12.3 Israeli residents have rights of review, correction and deletion under the Privacy Protection Law, 5741-1981, including as amended by Amendment No. 13.

12.4 How to exercise your rights. Email contact@fstrx.io. We may need to verify your identity. We will respond within thirty (30) days, or within any shorter period required by applicable law, and may extend where the request is complex, in which case we will tell you.

12.5 Where your request concerns personal data contained in Content controlled by another FSTRX account holder, we will refer you to that account holder and assist them in responding.

12.6 Complaints. If you are dissatisfied with how we have handled your personal data, you may contact us first at contact@fstrx.io. You also have the right to lodge a complaint with a supervisory authority:

• EEA — the data protection authority of your country of residence, work or the place of the alleged infringement (list of authorities (https://edpb.europa.eu/about-edpb/board/members_en));
• United Kingdom — the Information Commissioner's Office, ico.org.uk (https://ico.org.uk);
• Israel — the Privacy Protection Authority;
• California — the California Privacy Protection Agency or the California Attorney General.

13. Additional United States State Privacy Rights

13.1 Where a United States state privacy law applies to you, you may have rights in addition to those in Section 12, including rights to know or access, to delete, to correct, to portability, to opt out of targeted advertising, sale or sharing, to limit the use and disclosure of sensitive personal information, to withdraw consent, and to appeal a refused request.

13.2 Sale and sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act as amended. We have not done so in the preceding twelve months.

13.3 Sensitive personal information. We do not use or disclose sensitive personal information for purposes other than those permitted without a right to limit under applicable law.

13.4 Categories, purposes and sources. The categories of personal information we collect, the purposes for which we collect them, the categories of sources, the categories of recipients to whom we disclose them, and the applicable retention periods are set out in Sections 3, 4, 6 and 9 of this Policy, which serve as our disclosure for the applicable look-back period.

13.5 Universal opt-out signals. We honour recognised universal opt-out mechanisms, including Global Privacy Control, where applicable law requires.

13.6 Authorised agents. You may use an authorised agent to submit a request on your behalf. We will require written proof of the agent's authorisation and may require you to verify your own identity directly.

13.7 Appeals. If we refuse a request, we will tell you why. You may appeal by replying to our decision or writing to contact@fstrx.io with the word "Appeal" in the subject line. We will respond to an appeal within the period required by the applicable law and, if we again refuse, will tell you how to contact the relevant state regulator.

13.8 No discrimination. We will not deny you service, charge you a different price, or provide a different level of quality because you exercised a privacy right.

14. Marketing Communications

14.1 We may send you communications about the Service, including product updates, feature announcements and, where permitted, information about related services. Service and transactional messages — such as security alerts, billing notices, project invitations and account notifications — are necessary to operate the Service and cannot be opted out of while your account is open.

14.2 Where consent is required by applicable law, we obtain it before sending marketing communications. Where we rely on legitimate interests for business-to-business marketing, we do so only as permitted by the law applicable to you.

14.3 How to opt out. If we send marketing emails, each will contain an unsubscribe link that works for at least thirty (30) days after the message is sent, and we act on opt-out requests within ten (10) business days. You may also opt out at any time by emailing contact@fstrx.io.

14.4 When you opt out, we retain the minimum information necessary — typically your email address on a suppression list — for the sole purpose of ensuring we do not contact you again. Opting out of marketing does not stop service and transactional messages.

14.5 Our postal address for these purposes is FSTRX LLC, 16192 Coastal Highway, Lewes, Delaware 19958, United States.

15. Children

15.1 The Service is intended exclusively for professional and business use by persons aged eighteen (18) or over. We do not knowingly collect personal data from anyone under eighteen.

15.2 If we become aware that we have collected personal data from a person under eighteen, we will delete it. If you believe a minor has provided us with personal data, contact contact@fstrx.io.

16. Data Processing Addendum

16.1 Business customers who require a data processing agreement covering personal data contained in their Content may request our standard Data Processing Addendum from contact@fstrx.io, which incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum where relevant.

17. Changes to This Policy

17.1 We may update this Policy from time to time. The date at the top shows when it was last revised. Previous versions are available on request from contact@fstrx.io, and we retain a record of the version in force at any given time.

17.2 Where changes are material, we will notify you by email to your registered address and by notice within the Service not less than thirty (30) days before they take effect.

18. Contact

FSTRX LLC
16192 Coastal Highway, Lewes, Delaware 19958, United States
Privacy and data rights, general and legal enquiries: contact@fstrx.io
Security vulnerability reports: contact@fstrx.io
EU/UK Article 27 representative: to be appointed

This Policy is available in an alternative accessible format on request.