01Overview and accountability
This Privacy Policy explains how rooot., the unincorporated operator defined in the Terms of Service, collects, uses, discloses, and retains personal information. As of the effective date, rooot. is the organization accountable for and controlling that information. This Policy applies to visitors, members, buyers, sellers, profile claimants, identified producers, rights holders, and people who contact us.
We do not sell personal information and do not run third-party behavioural advertising. We use personal information to operate a music marketplace and catalog, deliver and license content, process transactions and payouts, create and transfer seeded producer profiles, verify claims and rights, personalize the Service, communicate, measure performance, prevent abuse, and comply with law.
rooot. is accountable for personal information under its control. Our Privacy Lead can be reached using section 14. If the Service is transferred, the successor identified by notice may become the accountable organization and controller, subject to this Policy and applicable law. Depending on where you live, a service provider may process information for us under its own legal obligations and terms.
02Information we collect
We do not intend to collect passwords, full payment-card numbers, or payout-bank credentials. Do not send them to support or include them in claim evidence. Information that is not personal when collected may become personal when linked to an account, device, profile, transaction, or claim.
03Sources and seeded producer profiles
We collect information:
- from you, when you register, buy, sell, upload, claim, connect payouts, communicate, or set preferences;
- automatically, through the Service, cookies, logs, analytics, session replay, security tools, and transactions;
- from service providers, including authentication, payment, payout, fraud, hosting, email, and analytics providers;
- from professional and public sources, including producer websites, social profiles, marketplaces, catalogs, credits, publicly shared kits, and other sources associated with a producer or release; and
- from administrators, collaborators, rights holders, complainants, and other users who submit catalog, ownership, attribution, contact, claim, or dispute information.
rooot. may create a Seeded Profile before the identified producer registers. We may collect and publish professional identity and catalog information and associate Admin-Ingested Content with that profile to organize, attribute, preview, market, license, deliver, and account for the catalog. A Seeded Profile is an unclaimed catalog record; it does not mean the producer registered, approved the profile, or endorsed rooot.
Collection of professional identity information does not mean that copyright, personality, publicity, trademark, or other rights in associated Content have been authorized. Those rights are addressed separately in the Terms of Service and Sound License.
An authorized producer or representative can use the public claim process to verify authority, link the profile to an account, obtain eligible earnings, correct profile information, and control or remove Content. Anyone may send a rights or accuracy complaint under the Terms of Service.
04How and why we use information
We use personal information to:
- create, authenticate, secure, support, and administer accounts, profiles, claims, and seller access;
- host, process, catalog, attribute, preview, rank, recommend, deliver, license, and remove Content;
- process plans, credits, orders, refunds, disputes, seller earnings, claim settlements, taxes, and payouts;
- verify identity, authority, ownership signals, claim links, payment eligibility, and conflicting claims;
- personalize feeds and recommendations and remember settings, favorites, follows, folders, and entitlements;
- send sign-in links, receipts, service notices, claim communications, seller and account messages, and marketing where permitted;
- analyze use, diagnose errors, replay sessions to understand product failures, test features, and improve performance and design;
- detect, prevent, investigate, and respond to fraud, chargebacks, manipulation, infringement, security incidents, and Terms violations;
- establish, exercise, or defend legal rights; preserve evidence; respond to valid process; and comply with tax, accounting, sanctions, consumer, privacy, and other law; and
- create aggregated or de-identified statistics that we do not use to identify you.
An appropriate purpose is required for every collection, use, and disclosure, but it does not by itself replace consent. Where we collect information about a producer who has not directly interacted with us, we do so without knowledge or consent only where PIPEDA or another applicable law permits, including business contact information and prescribed publicly available information strictly within the statutory scope. Public accessibility alone does not make information non-personal or create blanket consent. Where no exception applies, we obtain any consent required before the relevant collection, use, or disclosure. We also rely, as applicable, on consent, performance of a contract or requested step, and compliance with legal obligations. Where consent is required, you may withdraw it subject to legal and contractual limits, but that may prevent the relevant feature from working.
06Cookies, analytics, and session replay
We and our providers use cookies, local storage, pixels, SDKs, logs, and similar technologies for authentication, security, preferences, checkout, rate limiting, analytics, and Service operation. Essential technologies are required for the Service to work. Browser or device controls may let you block or delete some technologies, but doing so can break sign-in, playback, checkout, downloads, or saved settings.
PostHog helps us measure product events and provides session replay. A replay can capture page state, navigation, clicks, scrolling, and other interactions so we can diagnose problems and improve the product. We configure text inputs to be masked and do not intentionally use replay to collect passwords, full payment details, or bank credentials. Payment and identity entry generally occurs on Stripe-controlled surfaces. Masking and technical controls reduce but cannot eliminate all risk, so do not enter sensitive information in free-text fields unless it is requested for that purpose.
We may offer additional consent or opt-out controls where required. A browser “Do Not Track” signal is not a consistent industry standard, so the Service may not respond to it unless applicable law requires a recognized mechanism.
07Public information and user disclosures
Producer profiles, names, handles, images, biographies, links, verification status, kits, sound metadata, prices, public activity, and selected statistics may be visible to anyone and indexed, copied, cached, quoted, or reshared by search engines and third parties. Seeded professional and catalog information may remain publicly associated with the producer until corrected, claimed, unlisted, or removed.
Content you publish and information you intentionally make public are not confidential. Removing a profile or Content from rooot. may not remove copies already downloaded, cached, republished, included in completed projects, or retained by others under a valid license. Do not publish private contact details or information you lack authority to disclose.
08How long we keep information
We keep personal information only as long as reasonably necessary for the purposes described here, including while an account, profile, listing, transaction, claim, or dispute remains active and for an appropriate period afterward. Retention depends on the data, purpose, sensitivity, legal requirements, and risk of fraud, infringement, payment reversal, or dispute.
- Account and preference data generally remains until deletion or until no longer needed to provide the Service.
- Orders, licenses, credit ledgers, earnings, payouts, settlements, tax, and accounting records may be retained for statutory periods and to prove buyer and seller rights.
- Claim anchors, evidence, decisions, conflicts, and linking records may be retained to prevent fraud, prove authority and ratification, administer settlements, and resolve later disputes.
- Rights complaints, support records, security logs, and enforcement records may be retained while a claim is possible or as needed to protect users and the Service.
- Deleted Content and personal information may persist temporarily in restricted backups, caches, logs, and transaction records and may be retained where deletion would impair legal obligations, security, accounting, fraud prevention, or another person’s valid license.
We may aggregate or de-identify information and retain the resulting non-identifying information for analysis and Service improvement.
09Your privacy rights
Depending on where you live, you may have rights to request access to personal information, learn how it is used or disclosed, correct inaccurate information, withdraw consent, object to or restrict processing, request deletion, receive portable information, or complain to a privacy regulator. These rights are subject to identity verification and lawful exceptions, including another person’s privacy, privilege, fraud prevention, security, legal claims, tax and accounting duties, and records needed to administer a license, transaction, claim, or settlement.
You can update some account and profile information in Settings or the seller dashboard. To make a privacy request, email support@rooot.online with “Privacy Request” in the subject. Identify the account, profile, or claim and the right you want to exercise. We may ask for proportionate verification and, where permitted, decline excessive, unfounded, or unverifiable requests.
An identified producer who does not control a Seeded Profile may use the claim process or send a rights complaint to correct, control, or seek removal of the public profile and Content. A request to remove Content does not revoke completed buyer licenses or require deletion of transaction and legal records.
10How we protect information
We use administrative, technical, and organizational safeguards designed for the nature of the information, including managed authentication, access controls, encryption in transit, restricted service credentials, payment-provider separation, logging, monitoring, rate limiting, and backups. Access is limited to authorized personnel and service providers who need it for their work.
No online service, transmission, or storage system is completely secure. You are responsible for protecting your email account, sign-in links, devices, passwords used with identity providers, and private claim links. Tell us promptly if you suspect unauthorized access or a privacy incident.
11Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. A person below the age of majority must use the Service with a parent or legal guardian as required by the Terms of Service. Selling, claiming a profile, and receiving payouts require legal capacity or an authorized adult or entity. If you believe a child provided information contrary to this Policy, contact us so we can investigate and take appropriate action.
12International processing and transfers
rooot. operates from Canada and uses providers and infrastructure that may process information in Canada, the United States, and other countries. Those countries may have privacy laws and government-access rules different from yours. We use contractual and other safeguards appropriate to the transfer where required, but information remains subject to lawful access in the country where it is processed.
13Changes to this Policy
We may update this Policy to reflect changes in the Service, providers, practices, or law. We will post the updated version and effective date. If a change is material, we will provide reasonable additional notice through the Service, email, or another appropriate method and obtain consent where law requires it.
14Contact and complaints
Contact the rooot. Privacy Lead at support@rooot.online. Use the subject “Privacy Request” or “Privacy Complaint” and include enough information for us to identify the relevant account, profile, claim, or interaction.
We will investigate privacy complaints and explain our response. You may also complain to the Office of the Privacy Commissioner of Canada or the privacy authority where you live, subject to that authority’s jurisdiction.