TAEON Branding Agency Pte. Ltd. ("we", "us") operates SOUNDRADAR (soundradar.co) and is the data controller for personal data processed through the Service. We comply with the Singapore Personal Data Protection Act 2012 (PDPA) and, where applicable to a given individual, with the Korean PIPA, the EU/UK GDPR, and the California CCPA. This policy explains what we collect, why, how long we keep it, to whom we disclose it, and your rights. It covers three groups of individuals: Customers (workspace members), Fans (visitors to public pages), and Business Contacts (demo recipients, A&R/publisher contacts, press inquirers).
A. Customers (workspace members). Email, name, password (one-way hash only), optional 2FA/TOTP secret, role and permissions, last-login time. Workspace and artist names you create.
B. Fans (public smart-link / bio / newsroom visitors). For analytics we record derived, non-identifying signals: 2-letter country code, device type, browser, language, coarse city (from network headers), store/service clicked, a short anonymised referral token, and an anonymised visitor ID (a random value in the sr_vid cookie, not linked to your identity) used to count unique and repeat visits. We do not store your raw IP address for public-page analytics. If you sign up for a release reminder, an artist newsletter, or a hub/bio email form, we store your email and country.
C. Business Contacts. Names, organisation, email, and phone that a Customer enters for A&R managers/publishers; press/PR inquiry details (name, organisation, email, phone, message); demo-recipient name, company, and email. For private demo/A&R share links accessed by an invited recipient, we log access events for security and audit, including IP address, user-agent, country/city, listen duration, and play position. (This security logging applies to private, invitation-based demo links only — not to public fan pages.)
D. Payments. When you buy a paid plan or domain, Stripe processes your card. We receive and store only non-card data such as a Stripe session/customer reference, amount, currency, and order status. We do not store full card numbers.
E. Connected social accounts. If you connect X, Facebook/Instagram, LinkedIn, or TikTok, we store the account's external ID, username, display name, avatar/profile URL, granted scopes, and OAuth access/refresh tokens needed to publish on your behalf.
F. Cookies & device data. A session cookie (SRSESS) for login, a short-lived country cookie (sr_cc) to cache geolocation, an anonymous visitor-ID cookie (sr_vid, up to 1 year) for unique/repeat-visit analytics, a consent flag, and any retargeting/analytics pixels a Customer enables on a given link.
We collect personal data with consent, or where another lawful basis applies (performance of a contract, legitimate interests such as security and analytics, or legal obligation). By submitting an email opt-in form you consent to receive the relevant messages; you may withdraw consent at any time. Customers who enter Business Contact details confirm they have a lawful basis to do so.
We use strictly necessary cookies (login session, security, consent flag) and a functional country cookie. On a given link, a Customer may enable third-party retargeting or analytics pixels — including Meta, TikTok, Google (GA4/Ads/GTM), Snapchat, Pinterest, X, LinkedIn, Reddit, Quora, Microsoft, or AdRoll — which set their own cookies and are governed by those providers' policies. Where server-side Conversions API (Meta / TikTok) is enabled for a link, limited event data may be sent server-to-server, with email hashed (SHA-256) before transmission together with the visitor's IP and user-agent for matching. You can control cookies in your browser; blocking strictly necessary cookies will break login.
We do not sell personal data. We disclose it only to providers that help us run the Service, each under its own privacy terms, and only as needed:
We are based in Singapore and use reputable providers that may process data outside Singapore (for example, Stripe, Meta, TikTok, Google, Anthropic, and Search Atlas operate in the United States, and our CDN/hosting use global infrastructure). Where we transfer personal data abroad, we take reasonable steps so that recipients provide a standard of protection comparable to the PDPA, through contractual or equivalent safeguards.
We apply technical and organisational measures including one-way password hashing, optional 2FA, HTTPS/TLS in transit, access controls and role-based permissions, bot/abuse protection, and audit logging. No system is perfectly secure, but we work to protect personal data against unauthorised access, loss, or misuse.
If a data breach that is likely to result in significant harm to affected individuals, or is of a significant scale, occurs, we will assess it without delay, take remedial steps, and notify the Singapore Personal Data Protection Commission (PDPC) as soon as practicable — and in any event within 3 calendar days of determining the breach is notifiable — and notify affected individuals without undue delay, as required by the PDPA. We will also meet any additional notification duties under other applicable laws.
To exercise any right, contact contact@soundradar.co. We will verify your identity and respond within the period required by law. If unsatisfied, you may complain to the PDPC or your local data-protection authority.
The Service is intended for businesses and professional users aged 18+. Public smart-link and newsroom pages may be viewed by fans of any age, but we collect no identifying personal data from such visitors beyond the anonymous, country/device-level analytics described above. We do not knowingly collect personal data from children. If you believe a child has provided personal data (e.g. an email opt-in), contact us and we will delete it.
Data Protection Officer — SOUNDRADAR Operations, TAEON Branding Agency Pte. Ltd.. Privacy and data-rights inquiries: contact@soundradar.co. Registered office: 9 Raffles Place, #29-05, Republic Plaza, Singapore 048619.
We may update this policy and will post the revised version with a new "last updated" date; material changes will be notified in-Service or by email.