This Privacy Policy ("Policy") applies to personal data processed by ONE Studios Ltd. ("LUCY," "we," "us," or "our") in connection with the LUCY websites, applications, and services (the "Service"). We process personal data in accordance with the data protection and privacy laws that apply to it, and we extend the rights described in this Policy to every user, wherever they live.

1. Data controller

The controller is ONE Studios Ltd. For privacy requests, contact us at [email protected].

2. Categories of personal data

Identity & account data: name, username, email, hashed credentials, and account identifiers.
Profile & artist data: biographical information, images, social links, and content you provide.
Identity-verification / KYC data: government-issued ID, date of birth, address, and tax identifiers, collected to verify identity, enable payouts, and meet anti-fraud, anti-money-laundering (AML), and tax obligations. This is sensitive data handled with restricted access (see Sections 5–6 and 8).
Distribution data: your Releases, recordings, artwork, metadata, and ISRC/UPC codes, processed to deliver your music.
Transaction, billing & payout data: payment information processed by our payment processor (we do not store full card numbers) and payout-account details and history.
Usage, technical & session data: IP address, device/browser type, log data, session identifiers, product interactions, and session recordings (see Section 10).
Advertising data: where you allow it, cookie and device identifiers (including your device's advertising identifier in our apps), IP address and the approximate location derived from it, browser and device details, the page or screen where an ad appears, and your interactions with ads (whether an ad was shown, viewed, clicked, watched, skipped or closed). If you watch a rewarded video, we also keep a record of the reward you chose and when you received and used it (see Section 11).
Age answer: whether you told us you are 18 or older (we do not ask for your date of birth), and when you answered (see Section 11).
Communications & marketing preferences.

3. Sources

We obtain data from what you provide directly; automated technologies when you use the Service (cookies and similar—see Section 10); service providers/partners who help operate the Service, including advertising partners who report which ads were shown and how they performed (see Section 11); and public sources where relevant.

4. Legal bases for processing

We process personal data only where we have a lawful basis to do so, namely:

Performance of a contract: accounts, distribution, payments, support, and core features, including applying a reward you earned by watching a rewarded video.
Legal obligation: KYC/identity verification, AML and sanctions screening, tax reporting, and responding to lawful requests.
Legitimate interests: securing the Service, preventing fraud and abuse (including invalid ad traffic and misuse of rewarded videos), analytics to improve the product, protecting children (asking whether you are 18 or older, and limiting the ads and analytics of those who are not), and direct marketing where permitted, subject to your rights.
Consent: where required for certain cookies, marketing, or other processing, including advertising cookies, the use of your device's advertising identifier, and personalised advertising (see Section 11). You can withdraw consent at any time; this does not affect processing that took place before you withdrew it.

5. How we use personal data

To create, maintain, and secure accounts; provide distribution, monetization, and analytics; process payments and payouts; verify identity and prevent fraud (including pre-distribution screening); respond to support; comply with legal obligations and enforce our terms; show and measure the advertising that funds the Free plan (see Section 11); and send service and, where permitted, marketing communications (you may opt out).

Whether you must give us data. You are under no legal obligation to give us personal data; it is your choice. Without account, Content and payout data we cannot open an account, distribute your music or pay you. Identity-verification and tax data are needed, under anti-money-laundering and tax law, before we can make payouts; without them payouts stay on hold. Advertising data is used only with your consent; refusing it does not affect your account. Answering the age question is voluntary; until you answer, you see only non-personalised ads. The purposes and recipients of your data are set out in Sections 5, 7, 8 and 11, and your rights, including to inspect and correct your data, in Section 13.

6. KYC / identity-verification data

We collect government-ID and related verification data only to verify identity, enable and secure payouts, prevent fraud, and comply with legal and tax obligations, including requirements of our Distribution Partners. Access is restricted to authorized personnel and vetted verification/payment providers, and the data is retained only as long as necessary and as required by law (see Section 9).

7. Disclosure & recipients

Distribution partners & DSPs: your Releases, metadata, artist name, artwork, and relevant identifiers are shared with our third-party distribution partner and the digital service providers (streaming and download stores) that carry your music, to deliver and monetize it.
Payment & KYC providers: our payment processor, for payments and identity verification.
Advertising partners: where you allow advertising, the ad networks named in Section 11 receive advertising data directly from your browser or device to choose, show and measure ads and to detect fraud. They act as independent controllers of the data they collect this way, under their own privacy policies.
Analytics, communications & security providers: as listed in Section 8.
Professional advisers and authorities where necessary or required by law.

We do not sell your personal data for monetary consideration, and we never give advertisers your name, email address, Content, KYC data or payout details. Certain analytics or advertising cookies and identifiers may constitute a "sale" or "sharing" of personal information under some privacy laws; you can opt out (see Sections 10, 11 and 13).

8. Sub-processors

We engage vetted service providers ("sub-processors") to process personal data on our behalf, in the following categories:

Cloud hosting and infrastructure
Database, authentication, and storage
Music distribution and DSP delivery
Payment processing and identity verification
Email and communications
Product analytics and session replay
Monitoring, logging, and security
Advertising and tag management

These providers are bound by contract to process personal data only on our instructions and to protect it. A current list of the specific sub-processors we use is available on request at [email protected].

9. Retention

We retain data only as long as necessary. Indicative periods: account and profile data for the life of the account plus a short wind-down period; KYC/ID documents for up to 5 years after account termination to meet AML and tax obligations; billing and tax records as required by applicable tax law; distribution metadata and royalty records while Content is live plus a reconciliation period; analytics and session recordings for a limited period (session recordings are routinely purged after 30 days); rewarded-video records as described in Section 11; and your age answer for the life of your account. Advertising partners keep the data they collect for the periods set out in their own privacy policies. When data is no longer needed, we delete or anonymize it.

10. Cookies, tracking & session recording

We use cookies and similar technologies for strictly-necessary functions; analytics; tag management; email and engagement; monitoring; and advertising (see Section 11). Non-essential cookies load only according to your choices in our cookie banner; manage them there or via browser settings, as described in our Cookie Policy.

Session recording: we use session-replay technology to record interactions (clicks, navigation, page views) to diagnose issues and improve the product. Recordings mask sensitive inputs such as passwords, payment fields, and personal identifiers, and are retained per Section 9. You can opt out via the cookie banner where required.

11. Advertising

Why and where we show ads. Advertising pays for the Free plan. We show ads:

to Free accounts, on pages of the LUCY web app and mobile apps;
to every account, including Pro and Label, in LUCY Academy in the app;
to visitors of the link and pre-save pages (lucysounds.com/l/…) of artists on the Free plan, and of their profile pages (except artists who told us they are under 18). Pages of artists on Pro or Label show no ads;
to visitors of some pages of lucysounds.com, such as our blog and Academy.

We never show ads on sign-in, account, settings, billing, payout, editing, legal or administrative pages. Ads are always labelled "Sponsored" or "Ad".

Under-18s see only non-personalised ads. We ask everyone who signs in to LUCY, once, whether they are 18 or older, and keep the answer with their account. Accounts that say they are under 18, or have not answered yet, see only Google's non-personalised ads (in our apps, rated for general audiences): no HilltopAds, no rewarded videos, and no tracking request. For accounts that say they are under 18 we also turn off session recordings and heatmaps in our product analytics. Our public pages, including artists' link pages and our blog, are open to anyone, and we cannot tell a visitor's age there.

Ads cannot see your account. HilltopAds banners in the LUCY app run in an isolated frame on a separate LUCY domain, so the ad code cannot read your account pages, messages or app data. We do not run pop-under ads in the app.

Our advertising partners. We currently work with:

HilltopAds (Hilltop Ads Ltd, England, company no. 08989201) — display and video ads on the web and in our apps, and pop-under ads on lucysounds.com only;
Google AdSense (Google Ireland Limited / Google LLC) — display ads on the web;
Google AdMob (Google Ireland Limited / Google LLC) — banner, full-screen and rewarded video ads in our iOS and Android apps.

These partners and the advertisers and ad exchanges they work with use cookies, device identifiers and similar technologies to choose which ads to show, limit how often you see the same ad, measure performance and detect fraud. Google's use of advertising cookies lets it and its partners serve ads based on your visits to this and other sites; see How Google uses information from sites or apps that use its services and manage Google ads personalisation at Google Ad Settings. You can also opt out of interest-based ads from many companies at aboutads.info and youronlinechoices.eu.

Your choices on the web. On our websites, in the web app and on artists' pages, no ad loads unless you accept advertising ("targeting") cookies in our cookie banner. You can withdraw that consent at any time in the cookie settings, after which no new ads load. Using LUCY does not require you to accept advertising cookies. If your browser sends a Global Privacy Control (GPC) signal, we treat it as your opt-out of the sale and sharing of your personal information: none of our ads load there, whatever you chose in the banner.

Your choices in our apps. On iOS, we ask for permission under Apple's App Tracking Transparency before any ad uses your device's advertising identifier; if you decline, we do not show HilltopAds ads and AdMob does not receive that identifier. Where the law requires it, Google's consent form asks whether you agree to personalised ads before AdMob uses your data for them. You can change these choices in your device settings (iOS: Settings > Privacy & Security > Tracking; Android: Settings > Privacy / Google > Ads).

Rewarded videos. If you use a Free account and choose to watch a rewarded video (for example to unlock a LUCY AI post draft, a day without ads, or an extra release in a month), we record your account, the reward, when the video started and when the reward was granted and used. We use this to apply the reward, enforce the limits shown in the app, and prevent abuse. We keep these records for as long as needed for those purposes and delete them when your account is deleted.

Ad measurement. We record, in our analytics tools (PostHog and Google Analytics, Section 10), whether an ad filled, was viewed, clicked, watched or closed, together with the page and format, and whether you answered the age question (never the answer itself), so that we can count revenue, keep ads from getting in the way, and find faults. We do not give these analytics to advertisers. For accounts that say they are under 18, Google Analytics runs with Google signals and ad personalisation turned off.

Ad content. Advertisers, not LUCY, create the ads, and an ad is not an endorsement by LUCY or by the artist whose page it appears on. To report an inappropriate ad, contact [email protected] with the page and time.

12. International transfers

We may transfer personal data to, and store it in, countries other than the one in which you live, including to the service providers that host or process data on our behalf (Section 8). Where we do, we ensure that the data remains adequately protected, for example by relying on a decision recognising the adequacy of the recipient country's data protection laws, or by using standard contractual clauses or another safeguard approved under the applicable law. Our advertising partners receive advertising data directly from your browser or device as independent controllers and apply their own transfer safeguards.

13. Your rights

Account and data deletion

Every user of the Service, regardless of country or region of residence, and whether the Service is accessed through lucysounds.com, the LUCY applications for iOS or Android, or by signing in with a third-party account (including Google, Apple or Facebook), may request the deletion of their account and of the personal data we hold about them. No reason need be given for such a request.

A deletion request may be made by any of the following means:

Within the Service: by signing in, navigating to Settings → Account, selecting Delete Account and confirming the request as instructed. The account is closed upon confirmation.
By email: where a user is unable to sign in, by writing to [email protected] from the email address associated with the account, or otherwise identifying the account concerned. We may take reasonable steps to verify the identity of the requester before acting on the request, and will complete the deletion and confirm it in writing within thirty (30) days of receiving a verified request.
Accounts connected to Facebook: a user who signed in with Facebook may, in addition, remove LUCY from their Facebook account under Settings & privacy → Settings → Apps and websites. Doing so prevents LUCY from receiving further data from Facebook, but does not by itself delete data already held by LUCY; deletion of such data may be requested by the means set out in paragraphs 1 and 2 above.

Upon deletion of an account, we will delete the associated profile, sign-in credentials and the personal data linked to the account within thirty (30) days, save for data that we are required to retain under applicable law, or that is reasonably necessary to establish, exercise or defend legal claims or to settle amounts owed, including identity verification (KYC) documents and billing, tax and royalty records, which are retained for the periods described in Section 9. Where a user has Content live on digital service providers, the user should so indicate in the deletion request (or notify us by email before deleting the account within the Service), whereupon we will instruct our distribution partner to remove that Content; removal by individual stores may take additional time. Data collected by advertising and analytics partners in accordance with the user's cookie choices is governed by those partners' own privacy policies (see Section 11).

The jurisdiction-specific rights set out below are in addition to, and do not limit, the right of deletion available to all users under this Section.

Wherever you live, you have the following rights in relation to your personal data, subject only to the limits that the applicable law permits:

Access: to be told whether we process your personal data and to receive a copy of it, together with information about how and why it is processed;
Correction: to have inaccurate, incomplete, unclear or out-of-date personal data corrected;
Deletion: to have your account and personal data deleted, as set out above;
Restriction and objection: to ask us to restrict the processing of your personal data, and to object to processing based on our legitimate interests; you may object to direct marketing at any time;
Portability: to receive the personal data you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another provider where technically feasible;
Withdrawal of consent: to withdraw any consent you have given, at any time, without affecting processing carried out before the withdrawal;
Limiting sensitive data: to limit the use of sensitive personal data. We collect only limited sensitive data, such as sign-in credentials and, where required, identity-verification data, and use it only to provide the Service, meet legal obligations and prevent fraud;
Opting out of sale or sharing: to opt out of any "sale" or "sharing" of personal information, including sharing for cross-context behavioural advertising (see Section 11). LUCY does not sell personal data for money, and we honour the Global Privacy Control (GPC) browser signal as an opt-out. We do not knowingly sell or share the personal data of anyone under 16;
Automated decisions: not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you (see Section 15);
Non-discrimination: not to be denied the Service, charged a different price or offered a different quality of service because you exercised any of these rights;
Complaint: to lodge a complaint with the data protection or privacy authority of the place where you live or work, or where you believe an infringement occurred.

To exercise any right, contact [email protected] or use the "Do Not Sell or Share My Personal Information" control where available. Exercising your rights is free of charge. You may also act through an authorised agent. We may verify your identity, or the agent's authority, before fulfilling a request. We respond within one month of receiving a request; where a request is complex or numerous, we may extend this period by up to two further months, in which case we will tell you within the first month and explain why.

14. Data-breach notification

We maintain safeguards to detect and respond to security incidents and will notify affected individuals and/or the relevant supervisory authority of a personal-data breach as and when required by applicable law, and within the time limits that law sets.

15. Automated processing & AI

We use automated processing and AI to analyze Content (e.g., genre/mood tagging, metadata generation), produce analytics and insights, personalize recommendations, and detect fraud. These do not produce legal or similarly significant effects on you without human involvement. You may contact us about automated processing that affects you.

16. Children & minors

The Service is intended for users 18 and over, and for those aged 13–17 only with verified parent/guardian consent (see Terms Section A-2). We do not knowingly collect personal data from children under 13, and accounts that tell us they are under 18 see only non-personalised ads and are recorded less in our product analytics (see Section 11). If we learn we have done so without required consent, we will delete it. Parents/guardians may contact us at [email protected].

17. Security

We implement appropriate technical and organizational measures to protect personal data. No method of transmission over the Internet is completely secure; you provide information at your own risk.

18. Governing law

This Policy and privacy matters are governed by the laws of the State of Israel, without prejudice to any mandatory data protection rights you have under the law of the place where you live, which continue to apply.

19. Changes & contact

We may update this Policy and will post the revised version with a new "Last updated" date; where required by law we will provide additional notice. For privacy requests or questions, contact ONE Studios Ltd. at [email protected].

Privacy Policy