Privacy policy

Who we are

Hovnect ("Hovnect", "we", "us") operates the Hovnect platform: a music distribution and royalty service for labels, artists and management companies. We are the controller of the personal data described in this policy for the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. This policy explains what personal data we process when you visit our website, apply for an account or use the platform, and the choices you have.

Contact: hello@northsongs.com

What we collect

When you apply for an account: name, email address, country, the name of your label, project or company, its website, a description of your catalogue, the artists you list, the ranges you report for royalty income and catalogue size, your current distributor, whether an advance matters to you, links you provide and anything you write in the message field. We also record the IP address the application came from to limit abuse.

When you use the platform: your account details, the organisations you belong to and your role in them, the releases, tracks, artists, labels, artwork and audio you upload, the agreements you sign (including the typed name, time, IP address and browser used to sign), royalty statements and the ledger built from them, payout methods (bank account or PayPal address), support tickets, notifications and an audit trail of significant actions.

Automatically: server logs with IP address, browser and timestamps, kept for security and troubleshooting.

We do not collect payment card numbers. Invoices are settled by bank transfer or through a payment provider that handles card data under its own terms.

Why we process it and on what legal basis

• To review your application and open an account (performance of a contract, or steps taken at your request before entering into one).
• To deliver your releases to stores and other services, collect royalties, calculate what is owed and pay you (performance of a contract).
• To send you the notifications the service depends on: submission decisions, live dates, payouts, agreements, support replies (performance of a contract; our legitimate interest in running the service).
• To keep the service secure, prevent fraud and enforce our terms (legitimate interests; legal obligation).
• To keep accounting and tax records (legal obligation).
• To send product news, only if you opted in; you can opt out at any time (consent).

Who receives it

• Digital service providers and stores receive release metadata, artwork and audio so your music can be published, and return sales and usage reports.
• Our distribution partner processes deliveries and reports on our behalf under a written data processing agreement.
• Infrastructure providers host the platform, the database, uploaded files and outgoing email.
• Payment providers and banks receive what is needed to pay you.
• Authorities, courts and regulators, where the law requires it.

We do not sell personal data.

International transfers

Our providers may process data outside the United Kingdom. Where personal data leaves the UK we rely on the UK's adequacy regulations, the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, together with a transfer risk assessment.

How long we keep it

• Applications that are rejected: 12 months, then deleted.
• Account and catalogue data: for the life of the account and as long as royalties can still arrive for your releases.
• Agreements, invoices, payouts and the ledger: six years after the end of the financial year they relate to, as UK tax and company law requires.
• Server logs: 90 days.

Your rights

Under the UK GDPR you can ask us to give you access to your personal data, to correct or delete it, to restrict or object to its processing, to provide it to you in a portable form, and you can withdraw consent at any time where consent is the basis. Write to hello@northsongs.com; we answer within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), the UK supervisory authority, though we would welcome the chance to address your concern first.

Security

Passwords are hashed, sessions are short-lived and refreshed, two-factor authentication is available to every account, uploaded files are private and served through signed links, and every significant action is written to an audit log.

Changes

We will announce material changes in the platform and update the date at the top of this page.