Privacy Policy

This Privacy Policy describes how SwaLay Digital, doing business as SwaLay (“SwaLay”, “we”, “us”, “our”), collects, uses, stores, shares, and protects your personal information when you access or use our platform, including the websites at https://swalay.in, https://swalay.com, https://swalay.talantoncore.in, and https://swalayplus.in, the SwaLay mobile application, SwaLay artist dashboard, SwaLay Studio audio processing services, and any other media form, service, tool, feature, or technology linked or connected thereto (collectively, the “Platform”).

This Policy applies when you visit or use the Platform, create an account, upload content, use our distribution or audio processing services, interact with our support team, or otherwise engage with SwaLay in any capacity.

By using the Platform, you acknowledge that you have read, understood, and agree to the collection and use of your information as described in this Privacy Policy. If you do not agree with the practices described herein, please do not access or use the Platform.

This Policy should be read together with our Terms of Service, Content Declaration, Content Distribution Policy, Copyright Infringement Policy, and Royalty Sharing Policy, all of which are incorporated by reference.

1. Information We Collect

We collect information you provide directly, information collected automatically when you use the Platform, and information from third-party sources. The types of information we collect include:

1.1 Information You Provide Directly

• Account Information: When you register for an account, we collect your full name, email address, phone number, date of birth, gender, profile picture, and password.
• Artist & Label Information: Artist name, label name, biography, social media links, bank account or UPI details for royalty payouts, PAN number (for Indian tax compliance), and any other information you choose to include in your artist profile.
• Content & Metadata: Audio files, cover artwork, song titles, album names, genre, language, lyrics, credits, ISRC/UPC codes, release dates, and any other metadata you submit with your releases.
• Communications: When you contact our support team, submit feedback, or participate in surveys, we collect the content of your messages and any attachments.
• Payment Information: Billing details, bank account information, UPI IDs, and transaction history related to subscription payments and royalty payouts.
• Identity Verification Documents: Government-issued photo ID, address proof, or other documents submitted for account verification or copyright dispute resolution.

1.2 Information Collected Automatically

• Device Information: Device type, operating system, browser type and version, screen resolution, device identifiers, and mobile network information.
• Usage Data: Pages visited, features used, actions taken within the Platform (uploads, edits, downloads), time spent on pages, navigation patterns, and interaction with emails or notifications we send.
• Log Data: IP address, access timestamps, referring/exit URLs, server logs, and error reports.
• Location Data: Approximate geographic location derived from your IP address. We do not collect precise GPS location unless you explicitly grant permission.

1.3 Information from Third Parties

• Social Login Providers: If you sign in using Google, Facebook, Apple, or other social login providers, we receive your name, email address, profile picture, and account identifier from that provider.
• DSP & Streaming Platforms: Aggregated streaming counts, revenue data, geographic distribution, and listener demographics provided by Digital Service Providers.
• Payment Processors: Transaction confirmation, payment status, and related financial data from payment gateways.
• Public Sources: Publicly available information relevant to copyright verification or content moderation.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Platform Operations: To create and manage your account, process your content submissions, distribute your music to DSPs, and provide the core services of the Platform.
• Royalty Processing: To calculate, track, and distribute royalty payments to you in accordance with our Royalty Sharing Policy.
• Communication: To send you transactional emails (release confirmations, payout notifications, account alerts), service updates, and, where you have opted in, promotional communications about new features or services.
• Analytics & Insights: To provide you with streaming analytics, audience demographics, geographic performance data, and revenue reports through your artist dashboard.
• Platform Improvement: To analyze usage patterns, diagnose technical issues, improve existing features, develop new services, and optimize the user experience.
• Security & Fraud Prevention: To detect, prevent, and respond to fraud, unauthorized access, abuse, and other harmful activities on the Platform.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and governmental requests, including tax reporting requirements.
• Copyright Protection: To manage Content ID registrations, process copyright claims, handle DMCA/takedown requests, and enforce intellectual property rights.
• Personalization: To tailor your experience on the Platform, recommend features, and display relevant information based on your usage and preferences.
• Customer Support: To respond to your inquiries, resolve issues, and provide technical assistance.

3. Audio Content & Processing Data

Given the nature of our Platform as a music distribution and audio processing service, we handle audio content and related processing data with particular care.

3.1 Audio Files

When you upload audio files to the Platform for distribution or processing through SwaLay Studio, we store your original audio files on secure servers. These files are retained for the duration of your distribution agreement and are used solely for the purposes you authorize, including distribution to DSPs, audio processing, and Content ID registration.

3.2 Processing Data

When you use SwaLay Studio services (mastering, mixing, spatial audio conversion), we process your audio files using our proprietary algorithms and third-party processing tools. Technical metadata generated during processing (waveform data, frequency analysis, loudness measurements, format conversion logs) is retained for quality assurance and to enable you to revisit or modify your processing settings.

3.3 Content ID & Fingerprinting

To enable copyright protection through YouTube Content ID and similar systems, we generate audio fingerprints of your content. These fingerprints are shared with the relevant platforms to identify and manage unauthorized use of your content. Audio fingerprints are mathematical representations of your audio and cannot be used to reconstruct the original recording.

3.4 Caller Tune Data

When your content is distributed as Caller Ring Back Tones (CRBT), we share relevant audio clips and metadata with telecom operators (Jio, Airtel, Vi, BSNL) as required for the CRBT service. The telecom operators process this data under their own privacy policies.

4. Analytics & Performance Data

We collect and process analytics and performance data to provide you with insights into how your content is performing across platforms.

4.1 Streaming Analytics

We aggregate streaming data received from DSPs, including play counts, skip rates, save rates, playlist additions, and listener demographics (age, gender, location). This data is presented to you in your artist dashboard in aggregated form and does not identify individual listeners.

4.2 Revenue Analytics

We track revenue generated from each DSP, each release, and each territory to provide you with detailed earning reports. Revenue data is processed in accordance with the payment terms and schedules outlined in our Royalty Sharing Policy.

4.3 Platform Usage Analytics

We use analytics services (including but not limited to Google Analytics, Mixpanel, and proprietary tools) to understand how users interact with the Platform. These services may use cookies and similar technologies to collect information about your use of the Platform. You can manage your cookie preferences through your browser settings or our cookie consent tool.

5. Legal Bases for Processing

We process your personal information based on the following legal grounds:

• Contractual Necessity: Processing necessary to perform our contract with you, including account management, content distribution, royalty processing, and providing the services you have requested.
• Consent: Where you have given us explicit consent to process your data for specific purposes, such as marketing communications, optional analytics, or sharing data with specific third parties. You may withdraw your consent at any time.
• Legitimate Interests: Processing necessary for our legitimate business interests, including improving our Platform, preventing fraud, ensuring security, and conducting internal analytics, provided these interests are not overridden by your rights and interests.
• Legal Obligation: Processing necessary to comply with applicable laws, regulations, court orders, or governmental requests, including tax reporting, anti-money laundering requirements, and responding to lawful data access requests.
• Vital Interests: In rare circumstances, processing necessary to protect the vital interests of you or another individual.

6. Sharing Your Information

We may share your information with the following categories of recipients:

• Digital Service Providers (DSPs): We share your content, metadata, and artist information with DSPs (Spotify, Apple Music, YouTube Music, Amazon Music, JioSaavn, Gaana, Wynk, and others) as necessary to distribute your content. DSPs process this information under their own privacy policies.
• Telecom Operators: For Caller Tune distribution, we share relevant audio and metadata with Jio, Airtel, Vi, BSNL, and other telecom operators.
• Payment Processors: We share necessary financial information with payment gateways and banking partners to process royalty payouts and subscription payments.
• YouTube & Content ID Partners: We share audio fingerprints and metadata with YouTube and other content identification systems for copyright protection and monetization.
• Service Providers: We engage trusted third-party service providers for hosting, data storage, email delivery, analytics, customer support, and other operational needs. These providers are contractually bound to use your data only for the services they provide to us and to maintain appropriate security measures.
• Legal & Regulatory Authorities: We may disclose your information when required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and the choices you may have regarding your information.
• With Your Consent: We may share your information with other third parties when you have given us explicit consent to do so.

We do not sell your personal information to third parties for their independent marketing purposes.

7. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on the Platform. These include:

• Essential Cookies: Required for the Platform to function properly, including session management, authentication, and security. These cookies cannot be disabled.
• Functional Cookies: Enable enhanced functionality and personalization, such as remembering your preferences, language settings, and login status.
• Analytics Cookies: Help us understand how users interact with the Platform by collecting usage data in aggregated form. We use services like Google Analytics to analyze traffic and usage patterns.
• Performance Cookies: Monitor Platform performance, load times, and error rates to help us optimize the user experience.

You can manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. However, if you disable essential cookies, some features of the Platform may not function correctly.

We may also use web beacons, pixel tags, and similar technologies in our emails and on the Platform to track engagement and measure the effectiveness of our communications.

8. Social Media Logins

The Platform offers the option to register and log in using third-party social media accounts, including Google, Facebook, and Apple (“Social Login”).

If you choose to register or log in using a Social Login, we will receive certain profile information from the social media provider, including your name, email address, profile picture, and account identifier. The specific information we receive depends on the provider and your privacy settings with that provider.

We use this information solely for the purpose of creating and managing your SwaLay account. We do not post to your social media accounts, access your contacts or friend lists, or collect information beyond what is necessary for authentication.

Your use of Social Login is governed by the privacy policy and terms of service of the respective social media provider. We encourage you to review those policies before using Social Login. You may disconnect your social media account from SwaLay at any time through your account settings.

9. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. Specifically:

• Account Data: Retained for the duration of your active account and for up to 3 years after account closure, to comply with legal obligations and resolve any disputes.
• Content & Distribution Data: Audio files, metadata, and distribution records are retained for the duration of your distribution agreement and for a reasonable period thereafter to ensure continuity of service and compliance with DSP requirements.
• Financial Records: Transaction records, royalty statements, and tax-related documents are retained for a minimum of 8 years in accordance with Indian tax law and applicable financial regulations.
• Usage & Analytics Data: Aggregated and anonymized usage data may be retained indefinitely for analytics and Platform improvement purposes. Identifiable usage logs are retained for up to 2 years.
• Communication Records: Support tickets, emails, and other communications are retained for up to 3 years after the last interaction.
• Legal Hold: If your data is subject to a legal hold, regulatory investigation, or pending dispute, we will retain it for as long as required to resolve the matter, regardless of the standard retention periods stated above.

When personal information is no longer needed, we securely delete or anonymize it in accordance with our data disposal procedures.

10. Data Security

We implement industry-standard technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher. Sensitive data at rest, including payment information and identity documents, is encrypted using AES-256 encryption.
• Access Controls: Access to personal information is restricted to authorized personnel who require it for legitimate business purposes. We implement role-based access controls and multi-factor authentication for administrative access.
• Infrastructure Security: Our servers are hosted in secure data centers with physical security controls, redundant systems, and regular security audits. We utilize cloud infrastructure providers that maintain SOC 2 and ISO 27001 certifications.
• Monitoring & Incident Response: We continuously monitor our systems for security threats and have established incident response procedures to promptly address any data breaches. In the event of a breach that affects your personal information, we will notify you and the relevant authorities in accordance with applicable law.
• Regular Audits: We conduct periodic security assessments, vulnerability scans, and penetration testing to identify and address potential security risks.

While we strive to protect your personal information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security but are committed to maintaining the highest practicable level of protection for your data.

11. International Data Transfers

SwaLay Digital is headquartered in India. Your personal information may be transferred to, stored in, and processed in countries other than your country of residence, including India, the United States, and other jurisdictions where our service providers or DSP partners operate.

When we transfer your data internationally, we take steps to ensure that appropriate safeguards are in place to protect your information, including:

• Entering into Standard Contractual Clauses (SCCs) approved by the European Commission with recipients in countries not recognized as providing adequate data protection.
• Ensuring that recipients are certified under recognized frameworks, where applicable.
• Implementing supplementary technical and organizational measures to maintain the level of protection required by applicable data protection laws.

By using the Platform, you acknowledge that your information may be transferred to and processed in jurisdictions with data protection laws that may differ from those in your country of residence. We will always ensure that your data is treated in accordance with this Privacy Policy regardless of where it is processed.

12. Your Privacy Rights — India (DPDP Act, 2023)

If you are a resident of India, you are entitled to certain rights under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and other applicable Indian privacy laws. These rights include:

• Right to Access: You have the right to obtain confirmation of whether we are processing your personal data and to access a summary of your personal data and the processing activities.
• Right to Correction & Erasure: You have the right to request correction of inaccurate or incomplete personal data, and to request erasure of your personal data that is no longer necessary for the purpose for which it was collected.
• Right to Nominate: You have the right to nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity.
• Right to Grievance Redressal: You have the right to file a complaint with our Grievance Officer or with the Data Protection Board of India if you believe your data protection rights have been violated.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to the withdrawal.

To exercise any of these rights, please contact our Grievance Officer at the details provided in Section 20 of this Policy. We will respond to your request within the time frame prescribed by applicable law.

13. Your Privacy Rights — European Economic Area (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have certain rights under the General Data Protection Regulation (GDPR) and equivalent local laws. These rights include:

• Right of Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to request that we correct inaccurate or incomplete personal data.
• Right to Erasure (“Right to be Forgotten”): You have the right to request deletion of your personal data, subject to certain legal exceptions.
• Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
• Right to Object: You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.
• Rights Related to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects you.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise your GDPR rights, please contact us using the information provided in Section 21. We will respond to your request within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

14. Your Privacy Rights — California (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). These rights include:

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: You have the right to opt out of the sale or sharing of your personal information. SwaLay does not sell personal information. If we share personal information for cross-context behavioral advertising, you may opt out.
• Right to Limit Use of Sensitive Information: You have the right to limit the use and disclosure of sensitive personal information to purposes necessary to perform the services you have requested.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To submit a request, please contact us using the information in Section 21. We will verify your identity before processing your request. You may also designate an authorized agent to submit a request on your behalf.

15. Your Privacy Rights — Other Jurisdictions

If you are located in a jurisdiction with applicable data protection or privacy laws not specifically addressed above, you may have additional rights regarding your personal information. These may include, but are not limited to:

• Brazil (LGPD): Rights to confirmation, access, correction, anonymization, portability, deletion, information about sharing, consent management, and the right to petition the ANPD.
• Canada (PIPEDA): Rights to access, correction, and the ability to challenge compliance with the principles of PIPEDA.
• Australia (Privacy Act): Rights to access, correction, and the right to complain to the Office of the Australian Information Commissioner.
• Other Jurisdictions: If your local laws provide you with additional rights regarding your personal data, we will honor those rights to the extent required by applicable law.

To exercise any privacy rights available to you under your local law, please contact us at the details provided in Section 21. We will respond within the time frame required by your applicable law.

16. Children’s Privacy

The Platform is not intended for use by persons under the age of 18. We do not knowingly accept, request, or solicit information from persons under the age of 18 or knowingly market to persons under the age of 18. Our content distribution services are strictly limited to individuals who are 18 years of age or older and who possess full legal capacity to enter into binding contracts under applicable law.

If we become aware that we have collected personal information from a person under 18, we will take steps to promptly delete that information from our servers and terminate the associated account. If you believe that a person under 18 has provided us with personal information, please contact us immediately at the details provided in Section 21.

17. Third-Party Links & Services

The Platform may contain links to third-party websites, services, and applications that are not owned or controlled by SwaLay, including but not limited to DSP platforms (Spotify, Apple Music, YouTube, etc.), social media platforms, payment processors, and analytics services.

We are not responsible for the privacy practices, content, or security of any third-party websites or services. When you leave the Platform and visit a third-party site, this Privacy Policy no longer applies. We encourage you to read the privacy policy of every website or service you visit.

The inclusion of a link to a third-party site does not imply endorsement by SwaLay of that site, its content, or its privacy practices.

18. Do-Not-Track Signals

Some web browsers transmit “Do-Not-Track” (DNT) signals to websites. Because there is no universally accepted standard for how to interpret and respond to DNT signals, the Platform does not currently respond to DNT browser signals or headers.

However, you can manage your tracking preferences through your browser's cookie settings, our cookie consent tool (where available), and the opt-out mechanisms described in this Policy. We will continue to monitor developments in DNT technology and update our practices if a uniform standard is adopted.

19. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes to this Policy, we will:

• Update the “Last Updated” date at the top of this page.
• Provide notice through the Platform, such as a banner or notification on your dashboard.
• Where required by law or where changes are significant, send you an email notification to the address associated with your account.

Your continued use of the Platform after the effective date of the revised Policy constitutes your acceptance of the changes. If you do not agree with the updated Policy, you should discontinue your use of the Platform and contact us to request deletion of your account and personal data.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

20. Grievance & Data Protection Officer

In accordance with the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and the rules made thereunder, the contact details of our Grievance Officer are as follows:

Grievance Officer
SwaLay Digital (A part of TalantonCore LLP)
TalantonCore HO, Graphix Tower - 2, A-13, Sector 62 Ground Floor, Noida
Sector 62, Noida, Gautam Buddha Nagar- 201301, Uttar Pradesh, India

Email: swalay.care@talantoncore.in
Response Time: We will acknowledge your grievance within 24 hours and resolve it within 30 days from the date of receipt, as required by applicable law.

For users in the EEA, UK, or Switzerland, our Grievance Officer also serves as our Data Protection Officer (DPO) for GDPR-related inquiries.

If you are not satisfied with our response, you may escalate your complaint to the relevant data protection authority in your jurisdiction, including the Data Protection Board of India, your local EU supervisory authority, or the Information Commissioner's Office (ICO) in the UK.

21. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

SwaLay Digital
(A part of TalantonCore LLP)
TalantonCore HO, Graphix Tower - 2, A-13, Sector 62 Ground Floor, Noida
Sector 62, Noida, Gautam Buddha Nagar- 201301, Uttar Pradesh, India

General Inquiries: swalay.care@talantoncore.in
Privacy & Data Requests: swalay.care@talantoncore.in
Grievance Officer: swalay.care@talantoncore.in
Websites: https://swalay.in, https://swalay.com, https://swalay.talantoncore.in, https://swalayplus.in

We will make every effort to respond to your inquiries within 48 hours during business days.