Your music stays yours
Saving a record does not give Release Rights ownership of your music or a share of your royalties.
YOUR INFORMATION. CLEARLY EXPLAINED.
Privacy policy.
How Release Rights handles personal information about artists, collaborators, managers and people using the service.
Updated 20 October 2026 · Version 6
Release records have access controls
Directory discovery is separate from access to songs, splits, agreements and signing records.
Your profile, your identity
After invitation, your personal details are managed by you. Roles and splits are agreed for each song.
1. Who is responsible
Release Rights is the service responsible for account operation, directory discovery, access controls and the personal information it uses for those purposes. Contact the service operator through our on-site privacy request service.
Release creators and participants also decide what information to enter and whom to invite. They are responsible for having an appropriate reason to share another person’s information and for handling downloads and copies they hold.
Submit a privacy request. No account or email inbox is needed: save the private tracking link to read our response. Never send a password, recovery key, bank details or identity document through the form.
Platform usage and administration
We record daily signed-in account activity (account ID, day and last activity time) to understand active usage and operate the service. This does not record page-by-page browsing history or anonymous visitors. Approved platform administrators can review account status and aggregate release, genre, signature and email-delivery statistics for support and service operation. Administrative access requires MFA and is logged. The administration dashboard does not expose email bodies, private invitation links, passwords or authenticator secrets.
2. Information we collect and where it comes from
| Information | Source and purpose |
|---|---|
| Account name, email, password hash, recovery-key hash, encrypted authenticator key, hashed MFA recovery codes and verification records | Provided at signup or account updates, to identify your account, verify email and protect access. |
| Legal and stage names, roles, contact details, country, society, IPI/CAE, publisher and profile links | Provided by you, a release creator or a collaborator, to identify the people involved, reuse directory identities and prepare accurate records. |
| Song and release details, credits, composition and master shares, agreement references and registration progress | Entered by authorised release participants to organise a release and record the position they agree. |
| Invitations, permissions, manager authorisations, review comments, typed signatures, capacity, version and timestamps | Created through invitations and review actions to control access and preserve evidence of who approved which version. |
| Session and recognised-device cookies, browser recovery storage, browser/device labels, IP address, approximate location, sign-in/activity times, security alerts and delivery status | Generated while using the service or receiving transactional email, to keep sessions working, recover unsaved edits, prevent abuse and track delivery. |
| Privacy request details and responses | Provided through the privacy request form, to answer questions and handle information-rights requests. |
A creator may add you before you have an account. Your information can therefore come from another participant rather than directly from you. Only enter information needed for the collaboration. This service does not require bank details, payment-card details, passport copies or medical information.
3. Why we use personal information
We use information to provide accounts and release planning, find and reuse contributor identities, apply permissions, send service messages, prepare PDFs, record reviews and signatures, resolve support requests and protect the service.
Where UK data protection law applies, providing the account and features you request is based on performance of our service arrangement with you. Collaboration records about other people, basic directory discovery, record integrity and abuse prevention use legitimate interests: accurate attribution, practical collaboration and secure operation, balanced against the people affected. Optional sharing of your extended directory profile is based on your choice and can be withdrawn in My details. The account email on a saved profile is available to signed-in directory users for release invitations by default. Information may also be processed when necessary to meet a legal obligation or establish, exercise or defend legal claims.
Account access needs an email and security credentials. Optional profile fields can be left blank, although certain artist or signing features need relevant details. We do not sell personal information, use release records for targeted advertising, or use entered songs, splits or profile details to train our own AI models. The site’s checks help you review entries; they do not make legal ownership decisions or automatically award royalties.
4. Who can see it
Signed-in directory users: basic legal and stage names and roles from registered accounts and existing contributor records can be found across the directory. Existing records may be discoverable before invitation or verification. When you enable full-profile sharing in My details, country, publishing information and profile links may also be shared. Account email from a saved profile is shared by default with signed-in directory users for release invitations, independently of full-profile sharing. There is no separate email-sharing checkbox. An exact email search can match an existing identity even when the email is not displayed. Artist suggestions show names and verified-email badges, rather than email addresses. People who have saved you as a collaborator and participants on your linked releases see your current reusable profile details, including country, contact number, publishing memberships and profile links, even when full-profile directory discovery is off. Song roles, credits, splits and signed snapshots remain specific to each release.
Release participants: access depends on their release membership, authorised songs, review invitation, personal split link or manager permission. Full release access can expose the contributor and contact information recorded for that release. A personal split record is a narrower extract. Older shared workspaces can be accessed by people with their workspace link and password. Keep all private links and passwords safe.
Service suppliers: Sites hosting and its Cloudflare infrastructure process requests and stored records. Resend processes transactional email, including the recipient, message and delivery information. Operators may access information when necessary to provide support, investigate a problem or handle a privacy request. Information may be disclosed where lawfully required.
Downloading a PDF or backup creates a separate copy under the recipient’s control. Revoking a link cannot retrieve earlier downloads. Entering Spotify, PRS or another society’s details does not automatically send your record to that organisation, register your work or authorise royalty collection.
Partner integrations
External sharing is optional and separate from split sign-off. The release creator can save a membership identifier and authorise specific composition or masters records for a particular release and partner. A saved preference does not verify membership or connect an account: the partner must confirm a supported connection before delivery.
Where connected and authorised, we send only the selected current approved record: release and song identifiers, names, percentages, applicable society / IPI / publisher details, agreement references and relevant sign-off names, capacity and timestamps. This integration does not send contributor emails, private notes, passwords, invitation links or full contract files. Delivery attempts, partner references and responses are recorded. Received and accepted are different statuses; neither alone proves registration.
Revocation stops future deliveries but cannot recall records already received or an in-flight request. A partner handles received information under its own terms and privacy policy. Changes to the approved record must pass a new review before an updated version can sync.
Release questions helper
The floating helper offers topic guidance from our help library. If AI chat is enabled, pressing Send shares your question and recent conversation with OpenAI to generate an explanation. On a release page, the helper also uses a limited snapshot of the selected song and your own linked roles, ownership percentages and recorded publisher / society entries. When you send an AI question, that snapshot is included with the question and recent chat. Other contributors’ details, emails, agreements and balances are excluded. Do not include confidential agreements, passwords or unnecessary personal details.
Chat text is held in the page’s memory, not saved as a Release Rights conversation record. Clear chat or leaving the page removes that conversation from the interface. Technical rate-limit counters are stored separately. OpenAI may retain API data under its applicable service and safety terms; clearing this interface does not delete provider records. API requests disable optional completion storage. See OpenAI’s API data controls. AI processing may occur outside your country. Answers are educational and do not decide rights or change your release.
5. How long information is kept
Account and profile information is retained while needed to provide the account and associated service. Drafts are retained while they remain part of the workspace. Deleting a draft removes it from normal access; it is not an immediate purge of all database entries, historical reviews or backups. The current service does not automatically erase every record after a fixed inactivity period.
Agreed versions, signatures, authorisations and related history may need to remain to evidence a collaboration or deal with a dispute. Account closure or a name change does not automatically rewrite other people’s agreed records. For erasure requests we assess what is still needed, the rights of others and applicable legal obligations, rather than treating every record as permanent.
Privacy requests are retained while handled and for as long as needed to demonstrate the response or address a related dispute. Expired account sessions are removed when sessions are created; verification and signup challenges have expiry controls. Browser recovery copies can remain on your device until replaced or cleared. Hosting backups and technical records have separate provider lifecycles. You can ask us to explain retention for a particular record.
6. Security, cookies and international processing
Security offers optional authenticator MFA, single-use MFA recovery codes, and a list of active browser/device sessions with IP address, approximate location and recent activity. A secure browser cookie recognises returning devices for sign-in alerts; it does not replace MFA. Reporting an unfamiliar sign-in revokes every session and requires a password reset. Email alert links require confirmation before taking action.
The service uses HTTPS, hashed account passwords and recovery keys, secure HttpOnly session cookies, account and song access checks, and encrypted queued email payloads. Cloudflare D1 encrypts database storage and transport. These controls reduce risk; they do not make any system or downloaded copy completely risk-free.
Cookies and local browser storage support sign-in, recognised-device alerts, workspace access, draft recovery and interface preferences. Optional authenticator MFA, single-use recovery codes and active-session controls are available in Security. Reporting an unrecognised sign-in revokes sessions and requires a password reset. The current site does not install advertising trackers or third-party analytics. Clearing browser storage can remove recovery copies and sign you out.
Hosting, authentication and email infrastructure can process information outside your country, including in the United States and other countries used by those suppliers. This service does not promise UK-only storage. Applicable provider data-processing terms and transfer arrangements govern their processing. Use the privacy request service for information about the locations and safeguards relevant to your records. Provider information is available in Cloudflare’s data processing addendum and Resend’s privacy policy.
7. Your choices and rights
Edit your own personal details in My details. Turning off full-profile sharing hides those additional directory fields; your names, roles and invitation email remain available. It does not erase records already saved by participants. Request an objection, restriction or removal of a basic listing through the privacy request service.
Depending on the applicable law and circumstances, you may request access, correction, erasure, restriction, a portable copy, or object to processing based on legitimate interests. You can withdraw optional sharing without affecting earlier lawful processing. Rights are not absolute, and a request about one person cannot automatically reveal or delete another person’s records.
Submit a privacy request. No account or email inbox is needed: save the private tracking link to read our response. Never send a password, recovery key, bank details or identity document through the form.
We may need to verify that a request relates to you before releasing or changing personal information. We normally aim to respond within one month, subject to applicable identity checks and lawful extensions; any extension or refusal should be explained. You can complain to the UK Information Commissioner’s Office or your relevant local data protection authority.
8. Young contributors and policy changes
Creators working with young artists should use only necessary professional details, ensure the appropriate adult or authorised representative is involved where required, and avoid publishing private information. Tell us promptly about an inappropriate entry or privacy concern involving a young person.
We will update this page when how the service handles information changes. Material new uses should be explained before they begin. The date above identifies this version. See the Data use policy for practical examples of how records are used.