Privacy Policy

1. Who is responsible for your data

Loopsbox B.V. (“Loopsbox”, “we”, “us” or “our”) is responsible for personal data processed through the Loopsbox website and general platform, unless a specific service or agreement states otherwise. Loopsbox is a Dutch music company principally providing music distribution and related catalog, rights and royalty administration, alongside record-label and music-publishing activities.

For privacy questions or requests, contact support@loopsbox.com. Our registered address is Karl Weisbardstraat 181, 3015 GM Rotterdam, the Netherlands (not a visiting address).

2. Personal data we process

The information we process depends on how you use Loopsbox. It may include:

• Access-request data: name, email address, applicant type and request status.
• Account and team data: name, email, authentication and account status, profile, Workspace membership, roles, permissions and authorised actions.
• Business and address data: organisation or label information, address, postal code, country, company details and related account administration.
• Catalog and release data: artist names, contributors, credits, metadata, identifiers, artwork, audio, ownership information and rights-related declarations.
• Support and communications: messages, requests, support history and information you choose to send us.
• Financial and payout administration: royalty, statement, transaction and payout-related information where those services are available.
• Optional Plugin Store connections: only when you choose to authorise a supported external app, provider account IDs, usernames, OAuth authorisations and tokens, connection status, playlists, videos, posts, schedules, metadata, permitted statistics and synchronisation results needed for the features used. Connecting social-media accounts is not required for music distribution.
• Verification and compliance information: information reasonably required for identity, business, payment, anti-fraud, rights or regulatory checks where applicable.
• Technical information: IP address, browser/device information, security logs, timestamps and similar technical records needed to operate and protect the service.

Most personal data comes directly from you. Contributor information may also be provided by an account holder acting for a release, and reporting or transaction data may be received from service providers or music platforms involved in a service you request.

3. Why we process personal data

Our main processing supports Loopsbox Distribution: managing release and catalog information, confirming rights and contributor details, providing requested delivery and reporting services, and administering royalties where applicable. Optional Plugin Store processing is separate and depends on the app and external account you deliberately authorise.

We process personal data only where we have a lawful basis. Depending on the context, we use data to:

• review access requests and create or administer accounts;
• provide requested platform, catalog, distribution, reporting, royalty or support services and carry out authorised external-account actions;
• perform contracts and take steps requested before entering into a contract;
• verify information, prevent fraud, protect rights and secure the platform;
• meet accounting, tax, legal, sanctions, payment or other compliance obligations where applicable;
• communicate about service operation, support, security and material changes;
• improve reliability and understand how the service is used where this is compatible with applicable privacy law.

Legal bases: we rely on contract or pre-contract steps for account administration, authorised connections and requested services; legal obligations for required finance, tax and compliance records; legitimate interests, assessed against individual rights, for proportionate security, fraud prevention and service reliability; and consent only where legally necessary, including non-essential tracking where used. Not every processing activity uses every legal basis.

The current invitation workflow does not make access decisions solely by automated processing that produces legal or similarly significant effects.

4. Music distribution, catalog, releases and contributor information

Music metadata can contain information about artists, writers, producers, performers, rights owners and other contributors. If you submit personal data about another person, you are responsible for having a valid basis to provide that information and for giving any notices required by law.

Where you ask Loopsbox to provide distribution or related services, relevant release and contributor information may be shared with distribution infrastructure providers, music services, rights-management partners or other recipients necessary to carry out the requested service.

5. Verification, financial administration and compliance

Depending on the services you use, we may need additional information to verify an individual, business, rights relationship or payment destination. We aim to collect only what is reasonably necessary for the relevant check.

Some payment, payout or identity checks may be performed by specialist providers, either on our behalf or under their own legal duties. Relevant fraud and rights-claim records may be retained where reasonably necessary for a documented investigation, review or legal claim. Not every user must provide the same verification information.

6. Technical data and cookies

Loopsbox uses necessary cookies or similar storage for session security, authentication and essential preferences. We may process security logs and records of authorised operations to diagnose failures, prevent abuse and investigate access incidents. Technical media storage may include private object storage, depending on the enabled module.

If we introduce non-essential analytics, advertising or similar tracking that requires consent, we will provide the appropriate notice and controls before using it where required by law.

7. Who we share personal data with

For Loopsbox Distribution, this primarily means sharing the information required for requested release delivery, rights administration, reporting or payments with the relevant music services and operational partners. Other sharing depends on the separate service selected. We may share personal data only where reasonably necessary with categories such as:

• hosting, object storage, security and communications providers, including private storage services where configured;
• payment, payout, accounting and verification providers;
• distribution infrastructure providers and music services when you request distribution, and connected platforms when you authorise an integration or publication;
• professional advisers, auditors or authorities where required or appropriate;
• a successor or transaction counterparty in connection with a genuine merger, financing, acquisition or sale, subject to appropriate safeguards.

Separate processing for the Optional Loopsbox Plugin Store

The Loopsbox Plugin Store offers optional account connections and additional content-management functions. Music distribution, rights administration and royalties remain Loopsbox’s principal services. You can use those services without connecting YouTube, Instagram, TikTok or Spotify. The following processing occurs only where you choose to connect an eligible account and use a supported function; it is separate from delivery of music to stores under the Distribution Agreement.

Connected Google and YouTube accounts: where authorised and enabled, Loopsbox uses YouTube API Services to access only the data permitted by the granted scopes and feature, which may include a channel identifier and name, video identifiers and metadata, permitted performance information, upload or publication status and the connection authorisation. We use this information to display and perform the specific account-management, content or scheduling functions requested, to maintain their state, and to secure and troubleshoot those operations. An authorised employee may see relevant content only within the Business Workspace and connected-account permissions available to them. When a user initiates an authorised upload or publication, the required media and metadata are transmitted to the selected provider; service providers operating Loopsbox infrastructure may process the minimum necessary data under applicable safeguards.

Our use of YouTube API Services is subject to the provider’s rules. Google separately processes information under the Google Privacy Policy. You can manage or revoke Google/YouTube API permissions in Google’s security settings. You can also request removal of your stored API-derived data through support@loopsbox.com. Provider-specific rules may require accelerated deletion of authorised API data or refreshing stored data; independent finance, rights and audit records are assessed separately and do not justify retaining provider API data beyond its permitted period. Revoking access stops future authorised API use but does not itself delete items already published on YouTube.

Connecting a provider account does not by itself authorise selling its API data, using it for unrelated targeted advertising or training general-purpose AI models. Any new processing purpose must first meet applicable provider rules, data-protection law and any additional notice or consent requirements.

Instagram/Meta and TikTok: if an eligible account is connected to a supported integration, we may handle the account or profile identifier, user-authorised media or post metadata, publishing status, permitted interactions and statistics, and OAuth connection information needed for the chosen feature. We use and share them only to provide the authorised action and necessary operation, security or support. These providers independently apply their own data practices: see Meta Privacy Policy and TikTok Privacy Policy. The exact data and actions depend on provider permission, account eligibility and which Loopsbox functions are actually enabled; no planned feature is implied to be operational.

External music and social platforms determine their own available API permissions and may independently control their processing under their privacy notices. Connecting an account does not give Loopsbox unrestricted access to it. An account disconnection does not automatically remove content previously published externally.

For our general account, security and billing administration, Loopsbox ordinarily determines the purposes of processing. In a specific customer-directed processing arrangement, our role may differ and an appropriate data processing agreement may be required. We do not assume every external provider acts as our processor.

8. International data transfers

Some service providers or music platforms may process data outside the European Economic Area. Where European data-protection law requires safeguards, we use an applicable adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism.

9. How long we keep data

We keep data only as long as necessary for its purpose and any applicable legal obligation. Our retention criteria differ by category:

• Account and team profiles: while required to operate the account, then only for unresolved requests, documented claims or mandatory records.
• Connected account credentials: while the relevant connection is authorised and needed; revocation, disconnection and deletion may be subject to provider processes and limited security records.
• Catalog, financial and royalty records: for the active contractual relationship, applicable accounting or tax obligations, statements, rights disputes and enforceable claims.
• Fraud, security and support cases: for the reasonably necessary investigation, response, appeal and legal limitation periods, with access restricted as appropriate.
• Temporary media and system logs: according to the relevant module's operational purpose, deletion lifecycle and documented security requirements.

Optional connected-platform data: Google/YouTube API data may be subject to additional provider-specific refresh, revocation and deletion deadlines, including shorter periods than those applicable to Loopsbox-created catalog or financial records. We assess API-derived data separately rather than treating every connected account as a permanently retained archive. To request disconnection or deletion, contact support@loopsbox.com, and for Google/YouTube you can also revoke access using Google third-party access settings. We review requests and apply the relevant provider deadlines and applicable law.

Specific periods depend on confirmed module operations and statutory obligations. They are not uniform across all files or accounts. Where data is no longer necessary, we delete or anonymise it unless a lawful retention reason remains. You may ask us about the criteria applicable to your records.

10. Security

We use organisational and technical measures designed to protect personal data against unauthorised access, loss, alteration or disclosure. No online service can guarantee absolute security, so users should also protect their credentials and notify us of suspected account compromise.

11. Your privacy rights

Depending on the law that applies to you, you may have rights to access, correct, erase, restrict or object to processing of your personal data, request portability, and withdraw consent where processing is based on consent.

You also have the right to lodge a complaint with a competent data-protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens. Exercising a privacy right will not affect processing that was already lawful before the request or withdrawal.

12. Children

Loopsbox is intended for professional music distribution and related business use. We do not knowingly invite children to create accounts independently where parental or guardian consent would be required by applicable law.

13. Changes to this policy

We may update this notice to reflect actual processing, provider or legal changes. The current edition and update date are shown on this page. Where a material change legally requires additional notice or consent, we will follow the applicable requirements.

14. Contact

To ask a privacy question or exercise a privacy right, email support@loopsbox.com. We may ask for information reasonably necessary to verify that a request relates to you.