Privacy Policy

Controller and Data Protection Officer

Responsible Party (Controller). For the purposes of POPIA, the responsible party (information regulator) is SynthVerse (Pty) Ltd, Registration Number 2024/001234/07, a private company incorporated in the Republic of South Africa.

Registered address. 1200 Constitution Street, Block B, 4th Floor, Sandton, 2196, Gauteng, South Africa.

Data Protection Officer (DPO / Information Officer). SynthVerse has appointed an Information Officer and Deputy Information Officer in accordance with section 55 of POPIA. All POPIA-related correspondence, notices and data-subject requests should be directed to the DPO at:

• Email: dpo@synthverse.co.za (preferred)
• Postal: Data Protection Officer, SynthVerse (Pty) Ltd, PO Box 782419, Sandton City, 2146, South Africa
• Telephone: +27 (0)10 020 0000, weekdays 09:00–17:00 SAST

PAIA Manual. A PAIA manual in the form prescribed by the Information Regulator is available on written request to the DPO and will be provided free of charge in electronic form.

Lawful Bases for Processing

SynthVerse relies on one or more of the following lawful bases under section 11 of POPIA whenever we process personal information:

• (a) Consent. You have given explicit, revocable consent for a specific purpose (e.g., marketing emails, optional MFA recovery phone number, profile visibility settings). You can withdraw consent at any time from Account > Privacy without affecting the lawfulness of processing based on consent before withdrawal.
• (b) Contractual necessity. Processing is necessary for the performance of a contract between you and SynthVerse (e.g., billing information to collect subscription fees, payout details to remit royalties, delivery of a purchased download).
• (c) Legal obligation. Processing is required to comply with a law or regulation binding on SynthVerse (e.g., statutory retention of tax records, SARS reporting of royalty payments above the reporting threshold, anti-money-laundering KYC on Enterprise accounts).
• (d) Legitimate interests. Processing is necessary for the legitimate interests pursued by SynthVerse or by a third party, except where such interests are overridden by your interests, fundamental rights or freedoms requiring protection of personal information (e.g., detection of streaming-fraud botting to protect honest creators, security monitoring to prevent credential-stuffing attacks, content-recommendation tuning to surface relevant music).
• (e) Protection of data subject or another person. Processing is necessary to protect the legitimate interests of the data subject or another natural or juristic person (e.g., emergency contact information on artist profiles used in the event of a live-event safety incident).

Where processing relies on legitimate interests, a formal Legitimate Interests Assessment (LIA) is recorded and available on request to the DPO. You have the right to object to any processing based on legitimate interests — see Right to Object below.

Processing Purposes and Categories of Information

The following table summarises the categories of personal information we process and why:

Retention Periods

Personal information is retained only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. SynthVerse applies the following default retention schedule:

• Active account data: retained for the duration of your account, plus a soft-delete window of 30 calendar days after account closure.
• Authentication logs and session hashes: 180 days for active sessions; 365 days for security-audit trail of logins/logouts/failures.
• Financial records, invoices, royalty statements and tax documentation: 5 (five) years from the end of the tax year in which the transaction occurred, as required by the Tax Administration Act, 2011 and Value-Added Tax Act, 1991.
• Copyright and royalty-audit records: 7 (seven) years, reflecting the contractual limitation period under South African prescription law for claims arising from copyright infringement and royalty accounting.
• Support tickets and complaints: 2 (two) years from final resolution.
• Marketing opt-out records: retained indefinitely to suppress future marketing as required by the Consumer Protection Act, 2008.
• Documentation Vault chain-of-custody hashes and certificates: retained indefinitely, even after account closure, as they serve as tamper-evident evidence of ownership and licensing and may be needed for legal disputes.

At the end of the applicable retention period, personal information is either (a) irreversibly anonymised (where anonymised records do not qualify as "personal information" under POPIA) and retained for aggregated statistics and historical royalty reconciliation, or (b) irrevocably deleted by cryptographic-shred of the encryption key for stored records followed by overwrite of underlying storage blocks.

1. Right of Access (Section 23(1)(j) POPIA)

You have the right to request a copy of the personal information we hold about you, and to be told — in a reasonable form and manner — the following:

• A description of the specific personal information held;
• The identity of all third parties who have had access to your information in the preceding 12 months (where loggable);
• The source of the information, if we did not collect it directly from you;
• The categories of processing operations applied and their lawful bases;
• Any automated decision-making logic applied to your information, together with an explanation of the envisaged consequences.

How to exercise. Sign in, open Account > Privacy > Data Subject Requests, and select "Request a copy of my data". Alternatively, email dpo@synthverse.co.za with subject line "POPIA Access Request". Two forms of identity verification are required before we disclose any record.

Response time. Within 30 calendar days of a verified request, extendable by a further 30 days for complex or voluminous requests, with written notice of the extension and reasons.

Fee. One free Access request per 12-month period. Subsequent requests may be charged a reasonable administrative fee not exceeding the tariff prescribed from time to time by the Information Regulator.

2. Right to Correction / Rectification (Section 24 POPIA)

You have the right to require SynthVerse to correct, update, or supplement any personal information about you that is inaccurate, incomplete, out-of-date, irrelevant or misleading.

• Self-service corrections. Most account fields (email, display name, profile bio, country, social links, avatar, payout details, marketing consents) can be edited directly from Account > Profile and Account > Privacy. Changes take effect immediately and a confirmation email is sent.
• Assisted corrections. If you cannot self-service a correction (e.g., a mis-typed legal name on an invoice, a country field locked because of pending royalty payout, an old username retained for legacy redirects), email the DPO with evidence of the correct value. An assisted correction ticket will be opened and resolved within 10 business days of verified request.
• Rectification record. Where we correct personal information that has previously been disclosed to third parties in the preceding 12 months, SynthVerse will notify those third parties of the correction unless this proves impossible or involves disproportionate effort, and will record the notification in the DSR audit log.

Until a correction is processed, you may also request that a note of the disputed correction be applied to the record so that downstream consumers of the data are alerted.

3. Right to Erasure / Right to be Forgotten (Section 25 POPIA)

Subject to the exceptions in section 25(3) of POPIA, you have the right to request the destruction or deletion of personal information held about you where:

• The information is no longer necessary for the purpose for which it was lawfully collected or processed;
• You have withdrawn consent and there is no other lawful ground for the processing;
• You have successfully objected to the processing (see Right to Object below) and the objection has been upheld;
• The personal information has been unlawfully processed;
• Continued retention is no longer justified for the legitimate interests that justified collection.

Mandatory statutory exceptions (erasure not available). SynthVerse will not erase information that we are obliged by law or court order to retain, including but not limited to: 5-year tax/financial records, 7-year royalty-audit records, indefinite Vault chain-of-custody provenance certificates (these are hashed and de-identified to the extent possible while retaining evidentiary value), and marketing opt-out suppression lists.

How to exercise. Account > Security > Close account (initiates 30-day soft-delete, with optional permanent erase tick-box), or Account > Privacy > Data Subject Requests > "Request erasure of my personal information", or email DPO with subject line "POPIA Erasure Request".

Outcome. Eligible personal information is cryptographically erased within 60 days of verified request. A confirmation certificate is provided on request and held by the DPO for 2 years.

4. Right to Data Portability (Section 26 POPIA)

Where processing is based on consent or on a contract, you have the right to receive the personal information you have provided to SynthVerse, in a structured, commonly-used, machine-readable format, and to transmit that information to another responsible party without hindrance from SynthVerse, where technically feasible.

Scope. The portability export package includes:

• Account core fields (JSON); your profile, artist metadata, label metadata, social links, country, verified badges;
• Playlists you created (JSON + m3u8 portable format);
• Follows / favourites / saved-artists / saved-releases (JSON);
• Engagement history (CSV): plays, skips, durations, timestamps, release ids;
• Financial history (PDF invoices, CSV royalty statements, CSV payout transactions);
• Notification preferences, marketing consents, visibility flags (JSON);
• Vault certificates you own (PDF copies with full chain-of-custody hashes).

Exclusions. Information derived by SynthVerse (e.g. recommendation-engine embeddings, fraud-risk scores, internal LIA scoring) is not included in portability exports, because it is not personal information "provided by" the data subject.

How to exercise. Account > Privacy > Data Subject Requests > "Export my data (portable format)". The export is packaged as a ZIP (password-protected on request) and a signed download link is emailed within 10 business days.

5. Right to Object to Processing (Section 27 POPIA)

At any time, you may object — on grounds relating to your particular situation — to the processing of your personal information where that processing is based on:

• Legitimate interests pursued by SynthVerse or by a third party; or
• Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

Upon receiving a substantiated objection, SynthVerse will:

1. Acknowledge receipt within 5 business days with a ticket number;
2. Suspend the challenged processing activity immediately pending review, except where the processing is required for the establishment, exercise or defence of a legal claim;
3. Conduct a fresh balancing-of-interests exercise, documented and reviewable by the DPO;
4. Communicate a final decision in writing within 30 calendar days of the objection, with reasons;
5. If the objection is upheld, either cease processing entirely or offer a technically-feasible alternative that accommodates your grounds (e.g., disabling recommendation personalisation on your account, removing your artist profile from specific algorithmic surfacing surfaces, or switching an engagement-log processor to on-demand-only storage).

Additionally, you have the absolute right to object at any time to the processing of personal information for the purpose of direct marketing, without giving reasons and without any adverse consequence. You may exercise this right from Account > Privacy > Marketing Consents or by clicking the one-click unsubscribe link in any marketing email.

6. Right to Challenge Automated Decision-Making (Section 72 POPIA)

SynthVerse uses automated decision-making ("ADM") systems in the following limited contexts, where they produce legal or similarly significant effects for a data subject:

• Streaming-fraud / bot detection score. An ensemble model evaluates play-count patterns, IP and user-agent entropy, concurrent-session clustering, and chart-manipulation heuristics. A high score may temporarily suspend royalty eligibility, strip a release from chart qualification, or require a manual review of the creator account. Thresholds for automatic actions are published to creators in the Artist Program Rules.
• Account-takeover risk and login-risk scoring. Per-session model estimates the probability that a login attempt is unauthorised. Scores above the high-risk threshold automatically require MFA re-challenge, session revocation or temporary account lock until the account owner verifies ownership.
• Chargeback and refund abuse flag. Pattern of chargebacks, refunds and partial-month cancellations may automatically result in a temporary suspension of new-purchase ability pending manual review, to protect against systematic payment abuse.
• Content moderation auto-flag. Keyword, audio-fingerprint and image-hash classifiers may auto-flag a submitted release or comment for human review. No auto-flag on its own results in a takedown of creator content; every auto-flag is queued for a mandatory human review before action is taken.

You have the right, under section 72 of POPIA, to:

1. Be informed when a decision producing legal or similarly significant effects is taken solely on the basis of automated processing (SynthVerse clearly marks the outcome with an "Automated decision" banner in the relevant UI and ticket);
2. Request human intervention by a SynthVerse moderator or appeals officer to review the decision;
3. Make written representations to the reviewer and present evidence that the decision was incorrect;
4. Receive, in writing, an explanation of the logic involved in the automated decision, the input features that materially contributed, and the outcome of the human review.

How to challenge. Open the relevant notification in your account (ticket reference visible) and click "Challenge automated decision", or email the DPO quoting the ticket number with subject line "POPIA ADM Challenge". A reviewer independent of the team that developed the model will be assigned and will issue a final, reasoned decision within 14 business days.

Cookies and Similar Technologies

SynthVerse uses cookies, local storage, IndexedDB and analogous browser-side storage ("cookies") in the following categories:

We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking identifiers. Any future introduction of such technologies will require an updated consent banner and explicit opt-in from each affected user.

Cookie preferences. Manage your cookie consent at any time from Account > Privacy > Cookie Preferences, or by clicking the "Cookie preferences" link in the footer of every page. Your consent choices are logged with a timestamp and stored for 5 years per the Information Regulator guidance on POPIA cookie records.

International Transfers of Personal Information

Your personal information is primarily stored and processed within the Republic of South Africa on infrastructure operated by South African or African-cloud regulated providers. Limited categories of information are transferred outside South Africa only where necessary, and only when adequate safeguards as required by section 72 of POPIA are in place.

Permitted transfer destinations and safeguards:

• European Economic Area (EEA) / United Kingdom. Transfer permitted under POPIA section 72(2) because the EU/EEA/UK are assessed by the Information Regulator as providing adequate levels of protection. Additional Standard Contractual Clauses (SCCs 2021/914) in place with sub-processors where required.
• United States (Stripe payment processing, via South African Stripe entity). Transfer under SCCs plus Binding Corporate Rules of the payment processor; Stripe is certified under the EU-US Data Privacy Framework for incidental onward transfers to US vendors. No South African personal information is stored long-term on US infrastructure by SynthVerse itself.
• Other destinations. Transfers to any other jurisdiction require prior approval of the DPO and an individual Transfer Impact Assessment. Approved transfers are listed in the Transfers Register available on request.

You have the right to receive the details of the appropriate safeguards used for any international transfer affecting your information by writing to the DPO.

Children and Guardian Consent

SynthVerse is not directed to children under the age of 13. Users between the ages of 13 and 17 may register a SynthVerse Fan account only with the written consent of a parent or legal guardian, who must accept these Terms and this Privacy Policy on the child's behalf.

Creator accounts (and therefore paid subscriptions, royalty-bearing activities and payout facilities) are not available to users under 18 years of age; a creator account opened by or on behalf of a minor must be managed by the minor's legal guardian until the age of majority.

If we become aware that we have collected personal information of a child without the required guardian consent, we will take immediate steps to delete that information. If you believe we may have collected such information inappropriately, please contact the DPO without delay.

Data Breach Notification

In line with section 19 of POPIA and the POPIA Regulations on Compulsory Notification of Data Breaches, SynthVerse maintains a documented data-breach response plan. A compromise of the security, confidentiality or integrity of personal information — including reasonable belief that such compromise has occurred — will be:

1. Documented in the SynthVerse Breach Register with date/time of discovery, scope, affected categories, risk assessment, and containment steps;
2. Notified in writing to the Information Regulator (South Africa) within 72 hours of discovery where the breach is reasonably likely to result in a risk to the rights and freedoms of data subjects;
3. Communicated individually to affected data subjects without unreasonable delay, where a high degree of risk is likely, unless the Information Regulator agrees that public notice is sufficient;
4. Subject to a post-incident root-cause review by the DPO within 30 calendar days, with corrective actions tracked and closed.

Breach notices to data subjects will include: nature of the breach, likely consequences, affected data categories, measures SynthVerse has taken to contain and mitigate, and steps you can take to protect yourself (including password rotation advice where relevant).

Complaints to the Information Regulator

If you are dissatisfied with SynthVerse's response to a data subject request, or if you believe we have processed your personal information in breach of POPIA, you have the right to lodge a complaint directly with the Information Regulator of South Africa.

• Information Regulator of South Africa. Inyanda House, 54 Leyds Street, Sunnyside, Pretoria, 0001.
• Telephone: +27 (0)10 023 5200
• Complaints portal: justice.gov.za/inforeg/Complaints
• Email: complaints.IR@justice.gov.za

We request that you first give us the opportunity to resolve your concern directly via the DPO before escalating to the Regulator, but this is not a pre-condition of your statutory right to complain.

Changes to this Privacy Policy

SynthVerse may amend this Privacy Policy from time to time to reflect changes in processing practices, new products, legal amendments or regulator guidance.

Material changes. Where a change materially alters your rights or our obligations, we will notify you: (a) by email to your primary registered address at least 30 days before the effective date, (b) by an in-app banner displayed for no fewer than 30 days, and (c) by updating the "Effective" date at the top of this page. Material changes that reduce data subject rights will never be applied retroactively to personal information already collected without fresh explicit consent where required by POPIA.

Version history. The six most recent versions of this Privacy Policy are archived. To request a historical copy, email the DPO with the approximate date range of interest.