WHITEHOLE — Privacy Policy

Version 1.1 · Effective 2026-08-14 · SAAAD LABS LLC d/b/a WHITEHOLE

1 · What we collect

Account: email address, a password (stored only as a salted hash), an optional display name, your plan, and the account type (listener or artist).
Purchases and wallet: which tracks you bought, when, and at what price — this record is what makes your purchases permanent and re-downloadable — plus your wallet balance and its transaction history. We never see or store card numbers; payment details go directly to the payment processor.
Listening: which track was played, when, and under which plan. We are legally required to keep this: U.S. law obliges a music service to report usage to the collecting societies that pay songwriters.
Artist accounts additionally: payee, identity-verification and tax information required to pay royalties lawfully.
Cookies: exactly two, both essential — a session cookie and a CSRF protection cookie. No advertising cookies, no third-party trackers, no analytics scripts.

2 · How we use it

To run the service (accounts, playback, purchases, payouts); to meet legal duties (royalty usage reporting to The Mechanical Licensing Collective and performing rights organisations — in aggregate, never as a profile of you; tax reporting; responding to lawful requests; copyright notices under §512); and to keep the service safe (an audit log records administrative actions — it names what changed, not your personal values). We do not sell personal information, and we do not use it for advertising.

3 · Who receives it

Service providers that host and operate the platform: server hosting, and Stripe as payment processor — when you pay, Stripe receives your payment details directly, under its own privacy policy, and tells us only that the payment succeeded and for what; collecting societies, in aggregated usage reports; and authorities where the law requires. No one else.

4 · Retention

Account data lasts while the account does. Purchase and royalty records are financial records: they are retained for as long as the law and our royalty obligations require, including after account closure. Usage events are retained for royalty reporting and audit.

5 · Your choices

You can read and correct your profile in the Account tab, and request access, correction, or deletion of your data at contact@saaadlabs.com. Deletion has limits: records we must keep (financial, royalty, and legal-compliance records) survive a deletion request, and we will tell you what was kept and why.

6 · Security, children, changes

The service runs over TLS; passwords are hashed with scrypt; administrative access is role-restricted and audited. The service is not directed to children under 13 and we do not knowingly collect their information. We will post changes to this policy here with a new version and effective date.