Privacy Policy
Effective August 5, 2026
Vivus Tech LLC, a California limited liability company operating the Release Ledger platform ("Vivus," "Release Ledger," "we," "our," or "us"), provides software for music workflow, fan engagement, finance operations, analytics, automation, and related business workflows. This Privacy Policy explains how Vivus collects, uses, discloses, retains, and deletes personal data.
Scope and roles
Vivus has different privacy roles depending on the data population. Where Vivus acts only as a processor or service provider, the artist or workspace administrator normally controls the campaign purpose, audience, and marketing choices. Vivus hosts the tools, processes data on the artist's instructions, and supports rights-request routing.
| Workflow | Vivus role | Artist role | Meaning |
|---|---|---|---|
| Artist account, workspace, billing, finance, support, and security data | Controller | User or customer | Vivus decides why and how this data is processed to provide and secure the service. |
| Fan data entered on public artist pages or imported into an artist workspace | Processor/service provider, except for security, compliance, or legal uses | Controller/business | The artist decides the campaign purpose and audience. Vivus processes on the artist's instructions. |
| Outbound fan email, SMS, and similar communications | Processor/service provider; operational co-sender where Vivus infrastructure sends or records messages | Controller/business and message sponsor | The artist chooses message content and recipients. Vivus sends, logs consent, and manages unsubscribe evidence. |
| Fraud, abuse, security, legal holds, sanctions, tax/accounting, and incident response | Controller for Vivus compliance uses | Controller for artist instructions where applicable | Vivus may retain or process limited data independently where law, safety, or platform integrity requires it. |
Information we collect
- Account and identity data: email address, name, login identifiers, sessions, workspace membership, roles, and permissions.
- Pre-account waitlist data: email address, signup timing, invitation status, and optional artist context such as Spotify artist URLs or Instagram handles.
- Artist workspace data: releases, campaigns, uploads, labels, submissions, contracts, tour records, CRM contacts, notes, tasks, analytics, and workflow content.
- Fan data: fan names, email addresses, phone numbers, signup source, consent evidence, attribution, public-page interactions, pre-save/add-to-library actions, and artist-defined fields.
- Communications data: SMS/email opt-in records, confirmation state, STOP/HELP unsubscribe events where available, delivery logs, message IDs, message content, and support communications.
- Plaid and finance data: linked financial account metadata, institution identity, balances, transactions, categories, rules, reconciliation records, and encrypted token material needed for sync. Vivus does not receive or store the banking credentials entered into Plaid Link.
- Billing data: subscription status, billing contact information, invoices, tax/accounting metadata, and Stripe payment metadata.
- Integration data: OAuth tokens and data returned from artist-authorized services such as Google/YouTube/Calendar/Ads, Spotify, Apple, Meta, TikTok, X, Shopify, and similar platforms, limited to the feature enabled.
- AI and automation inputs: prompts, generated drafts, uploaded audio, transcripts, campaign or contract fields, contextual workspace data, and the contents of documents you upload to an AI feature for extraction — including collaboration, featured-artist, and similar agreements, and finance statements and receipts. An uploaded document may contain personal data about people other than you, such as a counterparty, collaborator, or their representatives, and may contain confidential commercial terms.
- Technical, analytics, and security data: device/browser metadata, cookie choices, IP-derived diagnostics, usage events, audit logs, error telemetry, and fraud/abuse signals.
How we use information
- Provide, maintain, and improve the service.
- Authenticate users and enforce workspace access controls.
- Host artist public pages and process fan signups.
- Send artist-directed communications and record consent/unsubscribe evidence.
- Sync, categorize, and report finance records.
- Connect artist-authorized integrations, attempt provider revocation, and delete locally stored tokens on disconnect.
- Provide AI-assisted draft, analysis, transcription, and workflow features where enabled.
- Detect abuse, fraud, sanctions risk, security issues, and service failures.
- Process billing, tax, accounting, legal, support, compliance, DSR, deletion, and incident obligations.
GDPR and UK GDPR legal bases
Where GDPR or UK GDPR applies and Vivus acts as controller, Vivus relies on the legal bases below. Where Vivus acts as processor for an artist, the artist determines the controller legal basis and Vivus processes under the artist's instructions.
| Purpose | Primary legal basis |
|---|---|
| Account creation, login, workspace operation, support, and core service delivery | Contract performance; legitimate interests for service administration. |
| Billing, subscriptions, tax, accounting, sanctions screening, and legal records | Contract performance; legal obligation; legitimate interests for fraud prevention and claims. |
| Artist-directed fan page hosting and fan CRM processing | Processor on artist instructions; where Vivus acts as controller for security/compliance, legitimate interests or legal obligation. |
| Fan marketing email/SMS and double-opt-in flows | Consent or other lawful marketing basis determined by the artist; Vivus processes as service provider/processor and keeps consent evidence. |
| Plaid bank connection and finance sync | Contract performance and user consent; legal obligation and legitimate interests for audit, security, and fraud controls. |
| Product analytics and non-essential cookies | Consent where required; legitimate interests for essential diagnostics and security. |
| Google, social, and other OAuth integrations | Contract performance and user consent for the enabled integration. |
| AI-assisted drafting, analysis, and transcription | Contract performance for enabled features; legitimate interests for quality/security controls, subject to data minimization and provider restrictions. |
| Security monitoring, incident response, abuse prevention, and audit logging | Legitimate interests; legal obligation where required. |
| DSR, deletion, retention, legal holds, and dispute handling | Legal obligation; legitimate interests for claims, security, and compliance evidence. |
Sharing, subprocessors, and AI providers
Vivus shares personal data with service providers that help operate the service, subject to contractual, technical, and organizational controls. Current named subprocessors and service providers include Supabase, Vercel, OpenRouter and downstream model providers, OpenAI, Stripe, Plaid, Twilio, Resend, and PostHog. See the Subprocessors page for roles, regions, and status notes.
AI provider processing remains subject to active compliance gates. Request-side controls such as zero-data-retention routing are technical controls, not proof of a fully executed DPA chain. Customer-data-bearing AI paths must remain limited until provider DPA, ZDR, or modified-abuse-monitoring evidence is approved where required.
Where you upload a document to an AI extraction feature — for example a collaboration or featured-artist agreement, or a finance statement or receipt — the text of that document is sent to OpenRouter and to the downstream model provider that serves the request. These requests are routed with zero-data-retention and no-data-collection settings, and the routing fails rather than falling back to a provider outside that policy. Extraction only proposes values for your review: the resulting agreement, split, or ledger records are written when you confirm them, not by the AI step. You can decline to upload a document and enter the same information manually.
Vivus does not sell personal information and does not share SMS opt-in data for third-party marketing.
Financial Privacy Notice
When you connect a bank account, Vivus receives account and transaction information through Plaid. This financial information may include nonpublic personal information, depending on the feature you use and the law that applies. We use it only to provide finance tools you request, such as sync, categorization, reconciliation, and reporting.
- What Plaid handles. Plaid collects the banking credentials you enter in Plaid Link and sends Vivus only the financial-account data you authorize Plaid to share.
- How we share financial data. We share financial data with service providers only as needed to operate, secure, support, or comply with legal obligations for the service. We do not sell financial data and do not share it for third-party marketing.
- Your control. You can disconnect linked bank accounts in finance settings. After disconnection, we delete the Plaid connection token and retain or delete related records according to our Data Retention & Deletion Policy.
- Safeguards posture. We treat bank-account and transaction data as sensitive financial data and apply administrative, technical, and physical safeguards. If the FTC Safeguards Rule applies and a notification event involves unencrypted customer information for at least 500 consumers, our incident process includes assessment of the FTC notice deadline of no later than 30 days after discovery.
Google API Services and Limited Use
Release Ledger accesses Google user data only when you choose a Google integration or select a file through the Google Drive picker. Each integration requests its permission in context and uses it only for the user-facing feature described below. The table identifies the primary categories of Google data Release Ledger receives or retains, including the fields used by these features.
| Feature and Google permission | Raw or direct Google data | Google-supplied aggregate data | How Release Ledger uses it |
|---|---|---|---|
Tour calendar creation — calendar.app.created | Encrypted OAuth access and refresh tokens and the identifier of the dedicated secondary calendar Release Ledger creates. | None. | Create the dedicated Release Ledger tour calendar. We do not read your existing calendars or your Google Account email. |
YouTube channel and analytics — youtube.readonly and yt-analytics.readonly | Encrypted OAuth tokens; channel ID, title, and handle; upload-playlist and video IDs; and video titles, publish dates, and thumbnail URLs. | Subscriber count; video view, like, and comment counts; and Google-supplied daily views, estimated minutes watched, and subscribers gained or lost. | Identify the connected channel and show its content and performance inside the authorizing workspace. |
YouTube comments and replies — youtube.force-ssl | Comment and thread IDs, text, timestamps, author display name, author channel and profile image, and reply text you choose to send. | None. | Show the unified comments inbox and publish replies you direct. We do not use this permission to delete YouTube videos, ratings, comments, or captions. |
YouTube publishing — youtube.upload | The video and title, description, tags, category, audience, visibility, embedding, license, and subscriber-notification settings you provide, plus the YouTube video ID returned after upload. | None. | Upload the video you select to the connected channel using the visibility and other settings you approve. |
Google Drive picker — drive.file | A transient browser-memory access token and, only for files you select, the file name, ID, provider URL, preview and icon URLs, MIME type, service ID, and file type. Release Ledger does not copy the selected file contents. | None. | Save a provider-owned file reference in your Asset Library. |
Google Ads metrics — adwords | Encrypted OAuth tokens and Google Ads customer and campaign IDs, campaign names, status, and reporting dates. | Google-supplied daily impressions, clicks, conversions, and spend. | Sync and display performance for the Google Ads campaigns you connect. |
We do not request full Calendar, full Drive, or monetary YouTube analytics permissions. Google supplies the aggregate analytics and statistics identified above. Release Ledger does not combine raw or aggregate Google user data across customer workspaces and does not create or share anonymized cross-user datasets derived from Google user data.
Vivus's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, our use of information received from Google Workspace APIs adheres to that policy's Limited Use requirements. We use Google user data only to provide or improve the user-facing features described above. We do not use it for targeted advertising, lending, surveillance, or any other unrelated purpose, and we do not use raw or derived Google user data to develop, improve, or train generalized AI or machine-learning models.
Unless you explicitly direct Release Ledger to publish or share it—for example, by displaying a connected YouTube profile link on a public Fan Hub—Google user data is visible only within the authorizing Release Ledger workspace and to members that the authorizing user permits to access that workspace. We transfer it only to Google to perform actions you direct, to destinations or public pages you explicitly select, and to infrastructure processors that host, store, or secure Release Ledger on our behalf, or when required for security or applicable law. We do not sell it; transfer it to advertisers, data brokers, or third-party AI or machine-learning services; or allow those parties to use it for their own purposes. Human access is limited to cases where you give affirmative consent, access is necessary for security or abuse investigation, or access is required by law.
We protect Google user data with TLS encryption in transit, encryption at rest for persistent OAuth tokens, scoped authorization, tenant isolation and database row-level controls, provider access controls, audit logging, and backup safeguards. The Drive picker access token is transient and stays in browser memory; Release Ledger does not store it on our servers.
Google data retention and deletion
- Persistent Google Calendar, YouTube, and Google Ads OAuth tokens are retained for active connections. An in-product disconnect or an accepted self-service account-deletion request immediately removes the active access and refresh tokens from use and sends a revocation request to Google. If Google is temporarily unavailable, Release Ledger may retain one or more encrypted, revocation-only tokens solely to retry those requests; they are never used to access Google data and are deleted after Google acknowledges revocation. A reactivated account must reconnect those integrations.
- While YouTube remains connected, Release Ledger refreshes authorized channel and content data on scheduled provider reads. Cached data not successfully refreshed for 30 days, and historical analytics, snapshots, comments, and raw response samples older than 30 days, are deleted or cleared from active stores. If provider reads keep failing, cached channel identity is cleared when its last successful refresh reaches 30 days.
- Disconnecting Google Calendar also deletes the stored identifier for the app-created calendar. It does not delete that calendar or its contents from Google Calendar.
- Disconnecting YouTube also deletes cached YouTube channel, video, analytics, comment, and commenter data from active Release Ledger stores. It does not delete videos or replies already stored by YouTube.
- The Drive picker token is not retained. A saved Drive reference remains until you delete it or the workspace is deleted. Deleting a reference hides it from active use immediately and marks it eligible for permanent deletion after a 30-day recovery period. Deleting the reference does not delete the source file in Drive.
- Other Google-sourced workspace records, including Google Ads metrics, are retained while the related workspace records remain in use and are deleted through the applicable record or account-deletion flow.
- Deleted data may remain in encrypted backups until backup rotation expires, but it is not restored to active use.
Disconnecting Release Ledger does not itself delete content already stored by Google, such as an app-created calendar, a YouTube upload, or a YouTube reply. You can review or revoke Release Ledger's access from your Google Account connections or Google security permissions. Our use of YouTube API Services is also governed by the YouTube Terms of Service and Google's Privacy Policy.
SMS messaging program
Artists can offer fans optional SMS updates. A fan may opt in two ways: enter a phone number and check the unchecked opt-in box on an artist's Fan Hub web signup page (which may be reached by scanning a QR code that opens that web page); or text a published keyword to the artist's number, in which case the fan receives a confirmation message and must reply YES to confirm — the fan is not subscribed until they reply YES. Consent is recorded with timestamp and source evidence. Messages may include new release, tour, ticket, or similar artist updates. Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe or HELP for help where the carrier supports those commands.
SMS consent is not a condition of purchase or access to a fan page. No mobile information — including phone numbers and SMS opt-in or consent data — is sold or shared with third parties or affiliates for their own marketing or promotional purposes. Mobile information may be shared only with the artist whose program you joined and with subprocessors (such as Twilio) strictly to deliver the messages you requested. SMS opt-in consent is never shared for any other purpose.
Retention and deletion
Vivus retains personal data only as long as needed for service delivery, security, legal obligations, dispute handling, support, billing/tax/accounting, backup rotation, and audit evidence.
| Data class | Default retention | Deletion approach |
|---|---|---|
| Account identity and workspace data | Account lifetime plus a 30-day reactivation window after closure. | Delete or irreversibly anonymize eligible records after the window. |
| Pre-account waitlist signups | Pending unconverted rows are pruned after 24 months without new interaction; approved unprovisioned rows after 12 months; converted rows after 30 days; closed, rejected, expired, or unsubscribed rows after 90 days. | Delete the waitlist row, including optional Spotify artist URL and Instagram handle fields, through the waitlist prune job or a verified DSR/deletion request. |
| Fan signup and CRM data | Artist workspace lifetime or until deleted, subject to legal holds. | Delete/anonymize from primary stores; route fan DSRs to the artist controller where needed. |
| Consent and unsubscribe evidence | As long as needed to prove consent/unsubscribe and comply with messaging laws. | Preserve minimum evidence even when marketing data is removed. |
| Finance and billing records | Account lifetime plus tax/accounting/audit needs, commonly up to 7 years depending on law. | Delete non-required records; retain limited records where legally required. |
| Cached YouTube API data | Rolling 30-day freshness window while connected. | Refresh current authorized data on scheduled provider reads; delete or clear data that is more than 30 days stale, and delete active-store caches on disconnect. |
| Plaid and OAuth tokens | While the connection is active; encrypted revocation-only tokens may remain during a transient provider outage. | Remove active credentials immediately, retry provider revocation where supported, and delete revocation-only tokens after provider acknowledgment. |
| Operational/security logs | Rolling retention based on system criticality, generally 30-365 days. | Rolling purge or archive deletion. |
Verified deletion requests are handled without undue delay, within 30 days where GDPR applies and within 45 days where California privacy law applies, unless a permitted extension or legal exception applies. Deleted data may remain in encrypted backups until backup rotation expires.
Your choices and rights
Depending on your location and the type of data, you may have the rights below. For fan data controlled by an artist, Vivus may need to route or coordinate the request with the artist controller.
| Right / request | Applies to | Vivus handling target |
|---|---|---|
| Access / know | Receive a copy or description of personal data processed about you. | Verify identity and respond within 30 days where GDPR applies or 45 days where California law applies, unless extended by law. |
| Correction | Correct inaccurate personal data. | Verify identity and correct eligible account/workspace data; route fan-data requests to the artist controller where needed. |
| Deletion | Delete eligible personal data. | Apply deletion workflow, subject to legal holds, security, tax/accounting, claims, backup, and consent-evidence exceptions. |
| Portability / export | Receive data in a portable format where required. | Export eligible account/workspace data; full tenant exports use controlled GDPR export tooling. |
| Restriction / objection | Restrict or object to certain processing. | Evaluate under applicable law and feature needs; honor where required. |
| Withdraw consent | Withdraw marketing, cookie, or optional integration consent. | Stop future consent-based processing where feasible; preserve withdrawal evidence where required. |
| Opt out of sale/share or targeted advertising | California and similar state privacy rights. | Vivus does not sell personal data; optional advertising cookies/pixels require consent and can be declined or withdrawn. |
| Appeal / complaint | Challenge a rights decision or contact a regulator where available. | Provide appeal path where required by applicable state law and preserve evidence of the request. |
Vivus targets the same response posture across verified rights requests, not only access and deletion: without undue delay; within 30 days where GDPR or UK GDPR applies; within 45 days where California privacy law applies; with any permitted extension or legal exception applied only after notice within the initial response period. Where an artist is the controller of fan data, Vivus routes or coordinates the request with that artist controller.
To make a request, email privacy@releaseledger.com. Mailing address: Vivus Tech LLC, 2108 N St #15874, Sacramento, CA 95816.
Children and minors
Vivus services are not directed to children under 13. Public fan pages and artist marketing tools are not intended to knowingly collect data from children under 13 or from minors where a higher local digital-consent age applies without appropriate authorization.
For the UK, EU, and similar child-privacy regimes, Vivus treats child-directed or minor-focused fan capture as a gated use case requiring additional review. If Vivus learns that it has collected personal data from a child in a way not permitted by law, Vivus will delete or disable the data as required.
Security and breach notification
Vivus uses safeguards including authentication, scoped authorization, tenant isolation, encryption in transit, encryption at rest for sensitive tokens, audit logging, backup controls, and provider access controls.
If Vivus becomes aware of a security incident involving personal data, Vivus will investigate, mitigate, preserve evidence, and notify affected controllers, users, regulators, or individuals where required by law. Where GDPR applies and Vivus is a processor, Vivus will notify the relevant controller without undue delay after becoming aware of a personal-data breach.
Vivus maintains a written incident-response runbook covering severity classification, evidence preservation, reversible containment, and jurisdiction-specific notification timelines (including GDPR 72-hour supervisory notice, US state breach laws, Australia NDB, FTC Safeguards, and contractual vendor obligations). Notification decisions require counsel and senior management review before any external communication is made.
International transfers
Vivus and its providers may process data in countries different from your residence. Where required, Vivus relies on safeguards such as standard contractual clauses, data-processing agreements, regional configuration, and transfer-impact review. EU/UK launch remains subject to provider-region and transfer-mechanism confirmation.
Contact and changes
Questions about this policy: privacy@releaseledger.com. Mailing address: Vivus Tech LLC, 2108 N St #15874, Sacramento, CA 95816.
Vivus may update this policy periodically and will provide notice where required.