Privacy Policy

1. What we collect

Account data. Your email address, first and last name. If you have a password, it is stored only as an irreversible cryptographic hash — neither we nor anyone else can read it back.

Data from your Google account — if you sign in with Google. See section 3.

Artist and catalogue data. Stage name, details of performers and writers, release and track metadata (titles, genres, dates, ISRC, UPC), the recordings and artwork you upload, and links to your store pages.

Reporting data. Streaming and revenue statistics received from stores and aggregators, and records of payouts and commission withheld.

Technical data. IP address, browser details, request times and error logs — these arise in the operation of any website and are needed for security and diagnostics.

We do not collect health, religious or political data or any other special-category data, and we never ask you to enter card details on the platform.

2. Why we use it

To create and run your account and recognise you at sign-in. To deliver your releases to digital stores and services and support their placement. To collect streaming and revenue reports, calculate and pay your remuneration. To answer your enquiries. To meet obligations placed on us by the tax, accounting and other legislation of the Republic of Kazakhstan.

We do not sell personal data and do not share it for third-party advertising.

3. Data received from Google

When you sign in with Google we request the minimum scopes — openid, email, profile — and receive only your email address, name, profile picture and the permanent identifier of your Google account.

This information is used solely to create your account and recognise you at later sign-ins. We do not read your mail, have no access to your files, contacts or calendar, post nothing on your behalf, and do not pass Google data to third parties other than as set out in section 4.

We use Google sign-in for one reason: so that your email address is confirmed by its owner and contains no typo. You can revoke access at any time at myaccount.google.com/permissions — your account stays, but you will need another way to sign in.

4. Who we share it with

Distribution aggregators — to deliver releases to stores. Release, track, performer and writer details are passed on; your account credentials are not.

Digital stores and services (Spotify, Apple Music, Yandex Music, YouTube Music and others) — to the extent needed to publish a release. Some of it becomes public: stage name, titles, artwork, credits.

Infrastructure providers — server hosting and file storage. They act on our instructions and may not use the data for their own purposes.

Banks and payment agents — to the extent needed to pay your remuneration.

State authorities — only on a reasoned demand made in accordance with the law.

5. Cross-border transfer

Stores, aggregators and infrastructure providers are located outside the Republic of Kazakhstan, so transferring your data abroad is unavoidable — music distribution is impossible without it. We transfer data only to recipients that protect it, and only to the extent needed to provide the service.

6. How long we keep it

For as long as our agreement is in force, and for the retention periods set by Kazakhstan law for accounting and tax records. Details of releases already published in stores are kept after the agreement ends — they are needed to calculate and pay remuneration for past periods.

7. Your rights

You may: find out what data we hold about you; require inaccurate data to be corrected; withdraw your consent to processing; require deletion where no lawful ground for keeping it remains; and complain about our actions to the authorised personal-data protection body.

Some of it you can change yourself in account settings. For anything else, write to us — we will reply within the period set by law.

8. Cookies

We use only the cookies without which signing in is impossible: they hold your session and short-lived technical values during Google sign-in. There are no advertising or third-party tracking cookies on the platform. Blocking cookies in your browser makes signing in impossible.

9. Security

Connections to the platform are encrypted. Passwords are stored as irreversible hashes. Staff access is limited by role and granted only to the extent needed for work. Nobody can guarantee absolute security of data sent over the internet, but we take reasonable organisational and technical measures to protect it.

10. Children

The platform is not intended for anyone below the age at which Kazakhstan law allows a person to enter into an agreement on their own. If you find that such a person has registered, tell us and we will delete the data.

11. Changes

We may amend this Policy. The current version is always on this page, dated at the top. We will notify you of material changes in your account or by email.

12. Contact us

LLP “OZEN XO”, BIN 190440002324, Republic of Kazakhstan. For personal data matters: admin@ozen.so.