Privacy policy

Last updated 20 October 2026

This policy explains what personal data [Your registered business name] (“Tunelaxy”) collects, why, and your rights, including under India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

Who is responsible

For artists’ and labels’ accounts, Tunelaxy decides how the data is used.
For fans’ contact details collected on an artist’s page, the artist or label decides how to use them (they’re the data fiduciary). We store and process the details for them.

What we collect

Account details: name, email, a hashed password, artist profiles, and the pages and files you create.
Payment settings: your Razorpay or Stripe API keys, stored encrypted. We never see buyers’ card or UPI details; Razorpay or Stripe handle them.
Fans’ details, when a fan chooses to give them: email and/or WhatsApp number, city (tour alerts), the exact consent text they agreed to, and the time and IP address of that consent.
Buyers’ details: email, amount paid, payment ID and download count.
Spotify connections: when a fan pre-saves or uses future save, an encrypted Spotify token that lets us save music to their library. Nothing else from their Spotify account.
Visit stats: page views and clicks with approximate country, device type and the referring site, plus a random visitor ID stored in the browser. We don’t build profiles of individual visitors.
Messages you send through the Contact page.

Why we use it

To run the service: show your pages, find your releases, save pre-saves, deliver purchases.
To show you stats about your pages.
To keep the service secure and prevent abuse.
To reply to you and send important account notices.
To meet legal obligations, such as tax records.

We don’t sell personal data, and we don’t use fans’ contact details for our own marketing.

Who we share it with

Only the providers we need to run the service: hosting and database (for example MongoDB Atlas), Spotify (when a fan connects), Musicfetch (release lookups; no personal data), Razorpay or Stripe (payments, under the seller’s own account), and ad pixels that artists add to their pages (Meta, Google, TikTok), which follow those companies’ policies. We may also share data when the law requires it.

How long we keep it

Account data, for as long as your account is open, and up to 90 days after you close it. Fans’ details, until the artist deletes them or the fan asks us to. Visit stats, up to 25 months. Payment records, as long as tax law requires.

Your rights

You can ask to see, correct or delete your personal data, withdraw consent, or name someone to act for you. Fans can ask the artist directly, or write to us and we’ll pass the request on and help. Write to support@tunelaxy.com. If you’re not satisfied, contact our grievance officer, [Grievance officer name] (grievance@tunelaxy.com), and after that the Data Protection Board of India.

Security

Passwords are hashed; API keys and Spotify tokens are encrypted; connections use HTTPS. No system is perfectly secure, so if a breach affects you we’ll tell you and the authorities as the law requires.

Children

Tunelaxy isn’t meant for children under 18 without a parent’s or guardian’s consent, and we don’t knowingly collect their data.

Cookies

See our cookie policy.

Changes

We’ll post any changes here and update the date at the top. For important changes we’ll tell account holders by email.