Privacy Policy
Last updated: 16 October 2026
1. Who we are
VeritiMusic is operated by VERITIMUSIC LTD, a company registered in England and Wales (company number 17472125), which is the data controller for the personal data described here. The company was incorporated on 21 September 2026; for personal data held before that date the controller was the founder, trading as VeritiMusic as a sole trader, and it passed to the company on incorporation. You can contact us about privacy any time at info@veritimusic.ai.
We handle your personal data in line with the UK GDPR and the Data Protection Act 2018. This Privacy Policy explains what personal data we collect, why (our lawful bases for doing so), how we keep it secure, and the rights you have over it. It sits alongside our Terms of Service.
2. The information we collect
Account details: your email address, and any profile details you add (such as your artist name and location). If you answer it when you sign up, we also keep how you heard about us, and use it only to see which of our own promotion works.
If you apply for, or we invite you to, a Founding Artist place, we keep your name, your email address, the distributor and any link you give us, what we sent you and whether you took it up, and use them only for that place.
Data you give us: the distributor statements, streaming-dashboard exports and screenshots, audio, artwork and other materials you upload, plus any contacts, products or notes you add. Some of this may include personal data about you or others you add.
Bank statements, if you use The Books: we keep the transaction lines we read from your statement — the date, the description exactly as your bank wrote it, and the amount. We never ask for, read out or store your account number or sort code, and the statement file itself is not kept: it is read and discarded, and only the lines remain.
Payment information: handled by our payment provider, Stripe. We don’t see or store your full card details — we receive only what we need to confirm a subscription or a sale.
Upload checks: when you upload a track we read the details stored inside the file itself (such as the artist, title, publisher, copyright line and ISRC), alongside the sound fingerprint described below. If either names a different artist, we ask you to confirm who you are before the track can go any further.
Identity check (only when an upload names a different artist, and only if you agree): a photo of your passport, driving licence or ID card and a selfie, taken and checked by our payment provider, Stripe. The photos stay with Stripe; we keep the legal name and address Stripe confirms, whether the check passed, Stripe’s reference and when you agreed. If you’d rather not use a selfie, you can ask for the track to be reviewed by a person instead.
Your connected Instagram account, if you connect one to post from VeritiMusic: Instagram tells us the account’s user ID and username and gives us a sign-in so we can post what you approve. We keep that sign-in encrypted and use it only to post the picture and words you confirm, one post per press. We never read your messages, comments, followers or anything else on the account. You can disconnect at any time, which deletes the sign-in straight away — see Connected social accounts (/legal/social-connections).
Technical data: basic logs needed to run and secure the Service (for example, sign-in activity and error logs).
Activity while you’re signed in: the page you’re on and when you were last active, so we can show you platform updates, special offers and other messages from VeritiMusic while you’re using it.
A record of how you use the platform while you’re signed in: the pages you open and the buttons and links you press, with the time — never anything you type, and never your files or figures. We use it only to help when something goes wrong, so we can see what happened before a problem you report. It is kept for 90 days and then deleted automatically.
Your conversation with your personal assistant: while you’re signed in, we keep your most recent conversation with it (up to the last 40 messages) so the same conversation is there on every device you sign in on. Clearing the chat deletes it from our servers too. It is kept only to show it back to you and to carry the conversation on.
3. How and why we use it
We only use your personal data where the UK GDPR gives us a lawful basis to — the bases we rely on are set out below.
To provide the Service you’ve asked for — signing you in, turning your uploads into your dashboard, generating the tools you use, and supporting you. This is to perform our contract with you.
To take payment and run subscriptions and storefront sales. This is to perform our contract and meet our legal obligations.
To keep the Service secure, working and improving, and to communicate with you about it. This is our legitimate interest in running a safe, reliable product.
To protect artists from having their music sold by someone else: reading an upload’s own details and fingerprint is our legitimate interest in preventing piracy. The identity check uses your face matched to your ID, which is biometric data, so we only do it with your explicit consent, given each time with a tick; you can choose a review by a person instead. A track is only ever held automatically while it is checked — a decision not to allow it is always made by a person.
We do not sell your personal data, and we don’t use your data to advertise to other people.
4. Who we share it with
We use a small number of trusted providers who process data on our behalf, only to run the Service: Stripe (payments), Amazon Web Services (secure hosting and storage), our email provider (to send you sign-in and service emails), and AI providers that generate drafts (such as ad copy or pitch emails) from the data you choose to use in those tools.
Anthropic (Claude) reads the documents you upload. Where you upload a bank statement, a receipt or a document as a PDF or a photo, that file is sent to Anthropic to be read — there is no other way to get the lines off a page. Under our agreement with them, they do not train their models on it, we keep all rights to what we send and receive, and they delete it automatically within 30 days. Nobody at VeritiMusic reads your statement, and it is not shared with anyone else.
Google (Ireland and the US) describes what a track sounds like when you upload it, makes artwork when you ask for it, and looks up venues, hotels and printers when you search. For the description we send a reduced-quality copy of the track — never your master. It never receives anything from your bank.
ElevenLabs (US) is the voice your assistant speaks with. It receives only the words being spoken aloud, and never anything from your bank.
Amazon Polly (Ireland) is the other voice your assistant can speak with, on devices that cannot do it themselves. It receives only the words being spoken aloud — never anything from your bank, and never the sound of your voice. On hands-free, where your device is able to, your assistant speaks entirely on your own device and the words go nowhere at all.
Brave (US) runs the web search behind your assistant when you ask something that needs an up-to-date answer. It receives the words of that question.
AcoustID and MusicBrainz check whether a recording is already known. They receive a digital fingerprint of the sound — a short code worked out from the audio, not the audio itself — and never the recording. Where a recording is known, we may also look up the public MusicBrainz record of the artist it is credited to.
Stripe Identity (Stripe) carries out the identity check described above, only if you agree to it. It takes the photo of your ID and your selfie, checks them, and tells us the result with your legal name and address. The photos are held by Stripe under its own privacy terms; we don’t receive them.
Instagram (Meta) receives the picture and words you choose to post, and only when you press Post on VeritiMusic. What happens to a post after that is under Instagram’s own terms and privacy policy.
A CSV goes nowhere. If your bank offers a CSV export, we read it entirely on our own systems and no third party sees it at all.
We may also share data where the law requires it. We require our providers to protect your data and use it only for the purposes we set.
5. Where your data is stored
Your data is stored on secure cloud infrastructure (Amazon Web Services) in the European region (eu-west-1). It is encrypted in transit and encrypted at rest in storage. Where any data is processed outside the UK/EU by a provider, we rely on appropriate safeguards to protect it.
6. How long we keep it
We keep your data while your account is active so the Service stays accurate and useful to you. If you close your account, we delete or anonymise your personal data within a reasonable period afterwards, except where we need to keep limited records to meet legal or accounting obligations.
Upload checks and identity checks are kept with the track’s rights record — while the track is on VeritiMusic and for six years after it leaves — because they are the evidence of who uploaded it and what they confirmed, if its ownership is ever disputed.
A connected Instagram sign-in is kept only while it is connected: disconnecting deletes it at once, and so does closing your account. A sign-in Instagram stops renewing lapses on its own after 60 days.
You can ask us to delete your data sooner — see your rights below.
7. Your rights
Under the UK GDPR and the Data Protection Act 2018 you have the right to be informed about how your data is used, to access it, to have it corrected, to have it deleted (the ‘right to be forgotten’), to restrict or object to how we use it, and to data portability — a copy in a structured, commonly used format. Where we rely on your consent, you can withdraw it at any time. We don’t make decisions that significantly affect you by solely automated means.
To exercise any of these, email info@veritimusic.ai. If you’re unhappy with how we’ve handled your data, you can complain to the UK’s Information Commissioner’s Office (ico.org.uk).
8. Keeping your data secure
We use technical and organisational measures to protect your data, including access controls and encryption in transit. No system is perfectly secure, but we take protecting your data seriously and will tell you and the relevant authority about a serious breach where the law requires.
10. Children
The Service is for people aged 18 and over and is not directed at children.
11. If you’re a fan, not an artist
Some people whose details we hold aren’t our customers — they’re fans of an artist who uses VeritiMusic. This section is for you.
What we hold: your name and email address, and, if you gave them, your phone number and postal address. When you give a postcode we look up the town it’s in and store that too.
How we got it: either you ticked the box at checkout to hear from that artist, or you filled in their Join Fanbase form. Since 15 September 2026 both ask whether you want to hear about new music, shows and merch; before that, they asked about new music only, and that is all an earlier yes covers. Nobody is added who didn’t ask to be — the box is never pre-ticked, and without an explicit yes we record nothing.
If an artist puts you on the guest list for one of their shows, they give us your name and email address. We use them only to email you your ticket for that show and to put your name on that show’s door list. It doesn’t add you to the artist’s mailing list. The email comes from us on the artist’s behalf, and replying reaches the artist.
If you bought a ticket, we email you once, 30 minutes after the show’s finish time, to ask whether it went ahead. Your answer is part of how we confirm a show took place. If a show is cancelled, we email you that your refund is on its way.
Why we hold it: so the artist can tell you about what you agreed to — new music, and, if you agreed to it, their shows and merch — and, if you gave an address, so they can post you anything you buy from them. Every email the artist sends you this way carries a link to unsubscribe, which stops them all. The town from your postcode also helps that artist see where their listeners are.
Whose list it is: the artist’s. Your details go into that artist’s own address book and we store it for them. We don’t sell it, we don’t share it with other artists, and we never use it to advertise to you.
Who else sees it: to turn a postcode into a town we send the postcode on its own — nothing else — to postcodes.io, a free public service built on Ordnance Survey and ONS data. The providers in section 4 also apply.
Getting removed: ask the artist, or email us at info@veritimusic.ai. We’ll remove you, you can ask any time, and you don’t have to give a reason. The rights in section 7 apply to you too.
12. If you’re a promoter, venue or crew member on someone’s tour
Artists who use our Touring tools keep the working details of the people involved in their shows. If you booked, hosted or worked one of those shows, that may include you.
What we hold: your name, your role on the show (promoter, production, sound, venue, box office, driver, engineer and so on), and whichever of your phone number and email address the artist recorded. For crew, it may also include the day rate and per diem the artist agreed with you. For hotels, the booking name, address and reference the artist entered.
How we got it: the artist typed it in, or it came out of a document you sent them — a deal memo, a confirmation or an itinerary they imported. We don’t collect it from anywhere else, and we never buy or scrape contact details.
Why we hold it: so the artist can run their own show — ring the right person on the day, send an advance, and settle afterwards. It is working information for that tour and nothing more.
Whose record it is: the artist’s. It sits in their own account. We don’t sell it, we don’t share it with other artists, we don’t add you to any mailing list, and we never use it to advertise to you.
If you check tickets in at a show’s door, the check-in page asks your phone for its location once. If you allow it, we store where each check-in happened, to confirm the show took place. You can say no and check-in still works.
What we don’t do: we never contact you on the artist’s behalf. Advance emails are drafted on the artist’s screen for them to read, edit and send themselves from their own email address.
The tour book: an artist can produce a single document for a run — the dates, the venues and their addresses, the times, who to ring on each show, and where the party is staying — and share it with their tour party by link. If you are working that tour, your name, role and the number the artist recorded for you will be on it, because that is what the document is for. The link is unguessable rather than a simple web address, it is never indexed by search engines, and it shows only that one artist’s own tour.
Who can open it: anyone the artist gives the link to. That is a decision the artist makes, in the same way a tour manager decides who gets the printed itinerary. If you would rather not appear on it, tell the artist and they can remove you.
Getting removed: ask the artist, or email us at info@veritimusic.ai. The rights in section 7 apply to you too.
13. Changes and contact
We may update this policy as the platform grows; we’ll update the date above when we do. Questions or requests: info@veritimusic.ai.