Privacy policy

This Privacy Policy explains how VibeValley Records handles personal data when you browse the site, contact us, sign in, submit music, use the artist dashboard, or interact with our support and newsroom content.

VibeValley Records is the controller for the personal data described here. The business is based in Uppsala, Sweden, and can be reached at hello@vibevalleyrecords.com.

Depending on how you use the site, we may collect:

• account data such as your name, email address, profile image, and session details through Clerk
• submission and catalog data such as demo links, release metadata, uploaded files, credits, contracts, and support messages
• finance data such as recorded revenue entries, payout preferences, payout history, distribution statements and related records
• support and communication data such as messages sent through our contact form, help-center votes, and newsletter sign-up information
• connection and security data needed to operate the service, and optional visit measurements if you allow analytics

Artist, contributor and recording information can also be supplied by authorized label staff or another person preparing a release on your behalf. We may receive delivery status and revenue reports from our distribution partners. Tell us if those records are incorrect.

We use personal data only where we have a valid legal basis under the GDPR.

• Contract and requested pre-contract steps: to provide your account, review requested submissions, manage agreed releases and handle signed agreements
• Legitimate interests: to support artists, maintain accurate recording and rights records, prevent fraud and protect the service, while considering the rights of the people concerned
• Consent: for optional analytics, embedded videos and newsletter communications
• Legal obligation: to retain records required by accounting, tax or other applicable law. Establishing or defending legal claims may also require retention under a relevant legal basis.

We use service providers to run the platform. Those providers may process data on our behalf.

• Clerk for authentication and account sessions
• Supabase for database records, storage, and application data
• Formspree for contact form delivery
• Beehiiv for newsletter subscriptions
• Vercel for hosting and, only if you opt in, analytics
• Cloudflare Turnstile for anti-abuse checks on protected forms, and Resend for invitation and operational email when configured

Distribution recipients: approved releases may be shared with TooLost and selected music services, including audio, artwork, artist identities, credits, rights information and release metadata. Those services may process information under their own policies. Artist names, credits and catalog information intended for a public release will become public.

Services you choose: Spotify artist search sends your search text to Spotify to find a public artist profile. YouTube receives connection information when you enable its embedded players. An external listening link takes you to the linked service under its own privacy policy.

Some recipients may process data outside Sweden or the EEA. Such transfers require a valid GDPR transfer mechanism, such as an applicable adequacy decision or appropriate contractual safeguards. Contact us for information about the recipients, relevant locations and safeguards for your data, including how to obtain a copy where applicable.

We keep data only for as long as it is needed for the relevant purpose.

• account data and working drafts are kept while needed for your account or an ongoing release; you can request deletion of unused material
• release, contract, finance and recording-identification records may remain after account closure or release deletion where agreements, accounting duties, rights management or legal claims require it; retaining an ISRC record does not require retaining every uploaded file indefinitely
• newsletter subscriptions remain until you unsubscribe; minimal suppression records may be retained to respect that choice
• support records are kept for as long as they remain relevant to ongoing support, operations, or dispute handling

Account closure does not automatically remove a distributed release or every retained business record. Deletion requests are reviewed against the purpose and any applicable retention duties. Browser recovery data, backups and data already shared with distribution services may need separate handling.

You may have the right to access, correct, delete, restrict, object to, or export personal data, depending on the circumstances and applicable law.

To exercise those rights, email hello@vibevalleyrecords.com. We may need to verify your identity. We normally respond within one month; where the law allows an extension, we will explain it. You can withdraw consent at any time without affecting earlier lawful processing, object to processing based on legitimate interests, and unsubscribe from marketing emails.

You have the right to complain to the Swedish Authority for Privacy Protection (IMY) or the competent authority where you live or work. Contacting us first is optional.

Account and release information needed to provide a requested service must be supplied for that service to work. Newsletter signup, optional analytics and embedded videos are voluntary. We do not use the submission system to make solely automated decisions with legal or similarly significant effects about artists.

Limit personal information in uploads to what the release needs. Uploaded audio, documents and private dashboard information are available to authorized staff and relevant service providers for the purposes described above.

Essential cookies and similar storage are used to keep the site functional. Optional analytics and embedded videos stay off unless you consent to them. YouTube players load automatically after you allow embedded videos, without starting playback, and may receive connection information and use their own browser storage.

Read our Cookie Policy for the exact categories currently in use. If we materially change this policy, we will update the page and revise the effective date.