Music Royalty LabMusic Royalty Lab

Privacy Policy

Effective Date: 30 August 2026
Legal Entity: Music Royalty Lab (Pty) Ltd (“MRL”, “we”, “us”, “our”)
Company Registration Number: 2016/162621/07

This Privacy Policy explains how we collect, use, share, store and protect your personal information when you use Music Royalty Lab (the “platform”). We are committed to processing your personal information lawfully and transparently in accordance with the Protection of Personal Information Act, 2013 (POPIA) of South Africa and, where it applies to you, the EU/UK General Data Protection Regulation (GDPR).

1. Who We Are & Our Information Officer

MRL is the responsible party (data controller) for the personal information described in this policy.

Music Royalty Lab (Pty) Ltd
Company Registration Number: 2016/162621/07

Our Information Officer (as required by section 55 of POPIA) is Ryno Zeelie. You can contact our Information Officer for any privacy question or to exercise your rights:

Ryno Zeelie — Information Officer, Music Royalty Lab (Pty) Ltd
šŸ“§ [email protected]
šŸ“§ [email protected]

2. Personal Information We Collect

  • Account & identity data: name, email address, password (stored hashed), and profile details you provide.
  • Learning data: your course enrolments, lesson and course progress, quiz results and certificates.
  • Content you create: releases, song and catalogue metadata, split sheets, contracts, collaborators, expenses and files you upload.
  • Transaction data: plan, subscription status, billing records and payment references. Full card/bank details are handled by our payment processor, not stored by us.
  • Communications: support requests and correspondence with us.
  • Technical & usage data: device, browser, IP address, and analytics events — collected only in line with your cookie choices (see section 10).

3. Legal Basis for Processing (POPIA s.11 / GDPR Art.6)

We only process your personal information where we have a lawful basis to do so:

  • Performance of a contract — to create and operate your account and deliver the services you sign up for.
  • Consent — for optional activities such as direct marketing and non-essential cookies/analytics. You may withdraw consent at any time.
  • Legitimate interests — to secure, maintain and improve the platform and prevent abuse, balanced against your rights.
  • Legal obligation — to keep financial and tax records and comply with applicable law.

4. How We Use Your Information

  • To provide, personalise and maintain the platform and your account.
  • To track and display your learning progress and generate certificates.
  • To store and manage the releases, documents and catalogue data you create.
  • To process payments, subscriptions and refunds.
  • To respond to your enquiries and provide support.
  • To send you service and account messages (these are not marketing and are necessary to operate your account).
  • To send direct marketing only where you have opted in (see section 12).
  • To protect the security and integrity of the platform.

5. Who We Share It With (Recipients & Operators)

We do not sell your personal information. We share it only with trusted operators (processors) who act on our instructions under confidentiality and data-protection obligations:

  • Abacus.AI — our cloud platform and AI provider, which hosts the application, its database and processing (see sections 6 and 7).
  • Bunny.net (Bunny CDN) — secure storage and delivery of the files you upload (see section 6, “The Vault”).
  • Google Drive — additional secure backup of your files so they are not lost (see section 6, “The Vault”).
  • Payment processor — to process payments and subscriptions securely.
  • Email/notification provider — to deliver account and (where opted in) marketing emails.
  • Analytics providers — only where you have consented to analytics/marketing cookies.

We may also disclose information where required by law, to protect our legal rights, or in connection with a business transfer.

6. How & Where Your Data Is Stored — The Vault

Keeping your work safe is central to how we operate. We refer to our combined storage and backup system as “The Vault”:

  • Application & database: for the platform to function, your data is stored in the Abacus.AI cloud environment, which runs across Amazon Web Services (AWS) and Microsoft Azure infrastructure.
  • Your uploaded files: all files you upload are sent to the Bunny.net (Bunny CDN) environment and are backed up across three geographic territories — Johannesburg (South Africa), Frankfurt (Germany) and London (United Kingdom).
  • Additional backups: a further backup of all files is made to Google Drive, so that your files are protected against loss.

Together, these layers make up The Vault — the redundant, multi-region storage and backup system we use to protect your files and data.

7. Artificial Intelligence & Your Data

Some features of the platform use artificial intelligence, provided through Abacus.AI. We want you to understand exactly how this works:

  • Abacus.AI operates a zero data-retention policy with its underlying AI providers.
  • The AI you interact with is not trained on your prompts, inputs or content. Your data is not used to train AI models.
  • AI is used only to generate the output you request at the time, and outputs should always be reviewed by you before you rely on them.

8. International Transfers (POPIA s.72 / GDPR Chapter V)

Because our operators host and back up data across South Africa, the EU (Frankfurt), the UK (London) and other regions used by AWS, Microsoft Azure, Bunny.net and Google, some of your information is processed outside South Africa. Where this happens, we ensure an adequate level of protection through appropriate safeguards — such as processing in countries with comparable data-protection laws, binding contractual terms (e.g. Standard Contractual Clauses), or your consent where permitted — so that your information continues to be protected in line with POPIA and the GDPR.

9. How Long We Keep Your Information (Retention)

  • Account & content data: kept while your account is active. After you cancel or request deletion, we retain it for a 30-day grace period so you can download or restore it, after which it is deleted or anonymised (subject to the exceptions below).
  • Financial & tax records: retained for approximately 5 years to comply with South African tax and company law.
  • Proof of marketing consent: kept for as long as you are subscribed to marketing and for a reasonable period afterwards as evidence of consent.
  • Support communications: retained for approximately 2 years.
  • Backups: The Vault holds secure, rotating backups that are cycled and overwritten over time; deleted data may persist in backups for a limited period before being overwritten.

10. Cookies & Tracking

We use strictly necessary cookies to run the platform, and — only with your consent — analytics and marketing cookies. When you first visit, our cookie banner lets you accept all, reject non-essential cookies, or customise your choice. You can change your preferences at any time using the Cookie Preferences link in the footer. Non-essential trackers (including analytics and advertising pixels) are only loaded after you opt in.

11. Your Rights

Subject to applicable law, you have the right to:

  • Access the personal information we hold about you and obtain a copy.
  • Correct or update inaccurate or incomplete information.
  • Delete your information (right to erasure), subject to legal retention obligations.
  • Object to or restrict certain processing.
  • Data portability — receive your data in a structured, machine-readable format. You can download your data at any time from your account settings.
  • Withdraw consent at any time, without affecting processing carried out before withdrawal.

To exercise any of these rights, contact our Information Officer at [email protected]. We will respond within a reasonable time and in any event within approximately 30 days.

12. Direct Marketing (POPIA s.69)

We send marketing communications by email only to people who have opted in. Marketing consent is separate from creating your account, and you can withdraw it at any time by using the unsubscribe link in any marketing email or by contacting us. We will always give you the ability to opt out.

13. Automated Decision-Making

We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing without human involvement.

14. Security

We take appropriate, reasonable technical and organisational measures to safeguard your personal information — including encryption in transit, hashed passwords, access controls, secure hosting and the multi-region backups described in section 6 (The Vault). No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the relevant authority of any breach as required by law.

15. Children’s Privacy

Our platform provides music education and tools for people of all ages, and is useful to anyone interested in releasing music at any stage of life. Where a user is under 18 (a minor), we require that a parent or legal guardian consents to and supervises their use of the platform, and any personal information relating to a minor is processed on the basis of that consent as required by POPIA. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us and we will take appropriate steps.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the effective date above. Significant changes will be communicated where appropriate.

17. Contact Us

Music Royalty Lab (Pty) Ltd
Information Officer: Ryno Zeelie — šŸ“§ [email protected]
šŸ“§ [email protected]
šŸ“§ [email protected]