Privacy Policy

The Cur8 Group Corp and its affiliates (“CreateBase,” “Company,” “we,” “us,” or “our”) are committed to protecting your privacy while operating our platform for music-catalog diligence and valuation and for royalty collection. CreateBase serves institutional clients — funds, publishers, advisors, and counsel — as well as artists, managers, and other creators. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access our website or software platform, or otherwise interact with our services (collectively, the “Services”).

By using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy, our Terms of Service, and our End User License Agreement. If you do not agree with these terms, you must discontinue use of the Services immediately.

1. Information We Collect

1.1 Information You Provide Directly

Account and Profile Information: Name, email address, username, password, billing address, phone number, organization or entity details, professional credentials, role (e.g., fund, publisher, advisor, counsel, artist, or manager), and any profile information you choose to provide.

Payment and Financial Information: Credit card details, bank account information, tax identification numbers, and payment preferences, processed through secure third-party payment processors who maintain PCI DSS compliance. If you connect a bank account, you sign in to your bank through our bank-connection provider, Plaid, and we receive the account details needed to pay you. We do not receive your bank password.

Uploaded Catalog Data and Diligence Materials: Documents and data you submit for analysis, including royalty statements, contracts and agreements, ownership and splits metadata, chain-of-title documentation, and links to digital service providers (“DSP links”). These materials may contain personal information about you and about third parties — for example, co-writers, producers, counterparties, heirs, or other rightsholders named in your documents. By submitting such materials, you represent and warrant that you have the authority and any necessary consents to provide them to us, and you authorize us to process them to deliver the Services. We process this third-party personal information solely as a service provider acting on your instructions to produce the diligence and valuation outputs you request.

Royalty Platform Access Information: Login credentials, account numbers, security questions, access tokens, and other authentication information for third-party royalty platforms (performing rights organizations, distributors, streaming services) that you authorize us to access on your behalf as your authorized agent under our EULA and Letters of Direction.

Tax Information: To pay royalties and meet tax reporting requirements, we collect tax forms (such as Form W-9 or W-8) and the information on them, including your legal name, address, tax classification, and taxpayer identification number (such as a Social Security number or EIN). Tax forms are collected and validated through our tax-form provider, Track1099.

Past Identity Checks: We previously used a third-party identity-verification provider, Persona Identities, Inc. We have discontinued that service, and all data from it has been deleted. We do not currently collect government-issued ID documents or biometric identifiers.

Content and Intellectual Property: All music, audio files, compositions, lyrics, metadata (including song titles, writer credits, ISRCs, ISWCs, publisher information, splits, and registration data), artwork, biographical information, and related intellectual property you upload, create, or submit through our platform.

Communications: Messages, feedback, support requests, and any other communications you send to us or through our platform.

Call Bookings: When you book a call on our website, we collect your name, email address, the time you choose, and any notes you add. We use this only to schedule and prepare for the call. Booking details are stored in our Google Workspace calendar, and Google sends the calendar invitation and meeting link.

1.2 Information We Collect Automatically

Usage Information: Records of how you use the Services, such as pages and features accessed and actions taken, which may be captured in our server and application logs. We do not use third-party analytics or advertising trackers.

Technical Information: IP address, browser type and version, device identifiers, operating system, screen resolution, time zone, and referring URLs.

Performance Data: System performance metrics, error logs, crash reports, and diagnostic information necessary for platform optimization.

Location Data: General geographic location derived from your IP address. We do not collect precise location.

1.3 Voice Input

Some features let you speak instead of type. When you use voice input, your browser's built-in speech recognition converts your speech to text, and only that text is sent to CreateBase. We do not receive or store audio recordings, and we do not create voiceprints or other biometric identifiers from your voice. Your browser asks for permission before it uses your microphone. Depending on your browser, the browser maker (for example, Google for Chrome) may process the audio to perform the speech recognition, under its own privacy policy.

We do not offer a mobile app, and we do not access your camera or your device location.

1.4 Information from Third Parties

Integration Partners: Data from streaming platforms, digital service providers, social media accounts, and other music industry services you connect to our platform, including data retrieved from DSP links you provide.

Public Sources: Publicly available information about musical works, performances, registrations, and professional activities relevant to the catalogs under analysis.

Business Partners: Information from record labels, publishers, distributors, collection societies, and other industry partners as necessary for diligence, valuation, rights verification, and royalty collection.

2. How We Use Your Information

2.1 Platform Operations and Services

• Create, maintain, and secure your account
• Process payments, royalties, and financial transactions
• Provide customer support and technical assistance
• Deliver core platform functionality and features
• Ingest, organize, and analyze uploaded catalog data to produce diligence and valuation outputs
• Facilitate rights management and royalty collection

2.2 Catalog Diligence and Valuation

Where you submit catalog data for analysis, we process it to deliver our diligence and valuation Services, including:

• Automated rights check: verifying ownership, splits, and chain-of-title across your uploaded documents and DSP links
• Chain-of-title construction: assembling the sequence of ownership and transfers reflected in your materials
• Data-quality scoring: assessing completeness, consistency, and reliability of the underlying data
• Risk-clause register: identifying and cataloging contractual provisions that may affect value or rights
• Revenue-at-risk and confidence scoring: estimating exposure and our confidence in the outputs
• Discounted cash flow (DCF) valuation: modeling the projected value of the catalog

2.3 Platform Improvement and Development

• Analyze usage patterns to enhance user experience
• Develop new features and functionality
• Improve platform security and performance
• Conduct quality assurance and testing

2.4 Communications and Marketing

• Send transactional notifications and service updates
• Provide important account and security information
• Deliver promotional content and industry updates (with your consent)
• Facilitate community features and networking opportunities

2.5 Legal and Business Operations

• Enforce our Terms of Service and other agreements
• Comply with applicable laws and regulations
• Protect against fraud, abuse, and security threats
• Defend our legal rights and interests
• Facilitate business transactions and partnerships

2.6 Analytics and Research

• Generate anonymized, aggregated insights about platform usage
• Conduct market research and industry analysis
• Create statistical reports (with all personally identifiable information removed)

2.7 AI and Automated Processing

Our Services include automated processing and AI-powered “skills” that analyze the documents and data you upload to produce the diligence and valuation outputs described in Section 2.2. This includes an automated rights check and AI models that read royalty statements, contracts, ownership and splits metadata, and related materials in order to extract, classify, and assess the information they contain. We may also use commercially available AI services for operational purposes such as customer support, fraud detection, platform optimization, and content moderation.

We rely on third-party AI subprocessors, including Anthropic, to perform this analysis. These providers process your data only to return results to us for delivery to you. Subject to the limited operational exceptions described below:

• Your uploads, creative content, and personal data are never used to train, fine-tune, or improve any AI model, whether ours or a vendor's
• AI subprocessors process your data solely to provide the immediate Services and retain it only for the limited period their commercial terms allow
• We contract with AI vendors on commercial terms that prohibit training on your data, and the vendor retains it only for the limited period its commercial terms allow

Important: The distinction is simple — we USE AI models to analyze your uploads so we can give you results; we do not let your data be used to TRAIN those models. For details on how specific AI providers handle data, see Section 10.1.

3. Information Sharing and Disclosure

We do not sell your personal information. We may share information only in the following limited circumstances:

3.1 Service Providers and Business Partners

We engage carefully vetted third-party service providers who:

• Are bound by strict confidentiality agreements
• Process data solely for specified business purposes
• Maintain appropriate security standards
• Include cloud infrastructure, hosting, database, authentication, payment, bank-connection, tax-form, email delivery, scheduling, AI processing, and customer support providers

3.2 Industry Partners and Rights Organizations

With your explicit consent, we may share relevant information with:

• Performance rights organizations (ASCAP, BMI, SESAC)
• Record labels and publishers
• Streaming platforms and distributors
• Music industry databases and registries

3.3 Legal Requirements and Protection

We may disclose information when we have a good faith belief that disclosure is:

• Required by law, regulation, or legal process
• Necessary to protect our rights, property, or safety
• Needed to investigate potential violations of our terms
• Required to prevent fraud or security threats

3.4 Business Transactions

In connection with any merger, acquisition, financing, or sale of assets, we may transfer information as part of such transaction, provided the receiving party agrees to honor this Privacy Policy.

3.5 With Your Explicit Consent

We will share information with third parties only when you provide clear, informed consent for specific purposes.

4. Data Security and Protection

We implement enterprise-grade security measures including:

• Encryption: We use industry-standard safeguards, including encryption. Connections between your browser and our website and app are encrypted using TLS (HTTPS)
• Access Controls: Strict role-based access with multi-factor authentication
• Infrastructure Security: Secure cloud hosting with regular security audits
• Incident Response: Comprehensive procedures for detecting and responding to security threats
• Employee Training: Regular security awareness training for all staff

While we employ robust security measures, no system can guarantee absolute security. We continuously monitor and improve our security practices.

5. Data Breach Notification

In the unlikely event of a data breach that may affect your personal information, we will:

• Immediate Response: Contain the breach and assess the scope within 24 hours
• User Notification: Notify affected users within 72 hours via email and in-app notification
• Regulatory Reporting: Report to relevant authorities within required timeframes
• Transparency: Provide clear information about what happened, what data was affected, and steps we are taking
• Protective Measures: Offer guidance on steps you can take to protect yourself

We maintain detailed incident response procedures and regularly test our breach response capabilities.

6. Your Privacy Rights and Controls

6.1 Account Access and Management

• Access and review your personal information through your account dashboard
• Update or correct inaccurate information at any time
• Download a copy of your data in portable formats

6.2 Privacy Controls

• Communication Preferences: Control marketing and promotional communications
• Data Sharing: Manage how your information is shared with industry partners
• Privacy Settings: Adjust visibility of profile information and content

6.3 Data Subject Rights (Where Applicable)

Depending on your jurisdiction, you may have additional rights including:

• Right to Deletion: Request removal of your personal information
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Portability: Receive your data in machine-readable format (JSON, CSV)
• Right to Restriction: Limit how we process your information
• Right to Object: Opt out of certain processing activities

6.4 Third-Party Personal Information in Uploads

If you are an individual (such as a co-writer or counterparty) whose personal information appears in materials uploaded by one of our clients, we generally process that information as a service provider or processor acting on that client's instructions. In most cases the appropriate first point of contact is the client who uploaded the materials, as they determine the purposes of the processing. You may nonetheless contact us at legal@createbase.com and we will assist or route your request to the relevant client as appropriate and as required by law.

6.5 Exercising Your Rights

To exercise these rights, contact us at legal@createbase.com. We will respond within 30 days and may require identity verification to protect your information.

7. Data Retention

We retain your information for specific periods based on data type and purpose:

• Account Data: Retained for 3 years after account closure for legal and business purposes
• Uploaded Catalog Data and Diligence Materials: Retained for the duration of your engagement and for 7 years thereafter to support audit, regulatory, and dispute-resolution requirements, unless you request earlier deletion and we are not required to retain the materials by law or contract
• Diligence and Valuation Outputs: Retained for 7 years to support audit trails, reproducibility, and dispute resolution
• Creative Content and Metadata: Retained for 7 years after account closure to support ongoing rights management, royalty collection, and audit requirements. May be retained longer if required by law, ongoing royalty claims, or unresolved disputes. You may request earlier deletion subject to our legal and contractual obligations.
• Financial Records: Retained for 7 years as required by tax and accounting regulations
• Usage Information: Aggregated data retained for 2 years, individual usage records for 1 year
• Support Communications: Retained for 3 years for quality assurance and legal purposes
• Marketing Data: Retained until consent is withdrawn or 2 years of inactivity
• Royalty Data: Retained for 7 years after final payment for audit purposes

We may retain certain information longer if required by law, regulation, or legitimate business interests such as ongoing legal proceedings or unresolved royalty claims.

8. International Data Transfers and Processing

Primary Data Location: United States

Your information may be processed and stored in the United States and other countries where our service providers operate. We ensure appropriate safeguards are in place for international transfers, including:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions where available
• Other legally recognized transfer mechanisms

For detailed information about our data processing practices and international transfer safeguards, please contact us at legal@createbase.com to request our Data Processing Agreement.

9. Cookies and Tracking Technologies

Our marketing website does not set cookies. Our app uses only strictly necessary cookies and similar technologies, for signing you in, processing payments and preventing fraud (Stripe), and connecting bank accounts (Plaid). We do not use analytics cookies, advertising cookies, or tracking pixels, and we do not use Google Analytics.

Because we use only strictly necessary cookies, we do not show a cookie banner. Before we add any non-essential cookies or trackers, we will update our Cookie Policy and ask for your consent. You can also block or delete cookies in your browser settings, though the app may not work properly without them. See our Cookie Policy for details.

10. Third-Party Services and Partners

We work with carefully selected third-party service providers to deliver our platform:

10.1 Service Providers

We use service providers for cloud hosting, database and authentication, payments, bank connections, tax forms, email delivery, scheduling, and AI processing. Each provider, what it does, the types of data it handles, and where it is located are listed on our Subprocessors page, which we keep current.

Our AI subprocessor (Anthropic) is engaged on terms that prohibit using your data to train its models and retains it only for the limited period its commercial terms allow. It processes your uploaded documents and data solely to provide the analysis and outputs you request.

10.2 External Links

Our platform may contain links to external websites. We are not responsible for the privacy practices of these external services. We encourage you to review their privacy policies before providing any information.

11. Children's Privacy

Our Services are intended for users 18 years of age and older. We do not knowingly collect information from children under 18. If we discover such collection, we will promptly delete the information and terminate the account.

12. California Privacy Rights

California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

California residents have additional rights including the right to know about personal information collection and sharing, delete personal information, correct inaccurate information, and opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

12.1 Categories of Personal Information We Collect

Under the CCPA/CPRA, we collect the following categories of personal information:

• Identifiers: Name, email, phone number, IP address, device identifiers
• Financial Information: Payment details, bank account information, tax identification numbers
• Government Identifiers: Social Security numbers or other taxpayer identification numbers (for tax reporting)
• Commercial Information: Subscription history, payment records, service usage
• Internet Activity: Website usage, search history, interaction with our services
• Professional Information: Music industry credentials, organization and entity details, business relationships
• Creative Content and Catalog Data: Musical works, compositions, metadata, royalty statements, contracts, ownership and splits data, and related intellectual property — which may include personal information about third parties named in uploaded materials

12.2 Sensitive Personal Information

We collect and process the following sensitive personal information:

• Social Security Numbers or Other Taxpayer IDs: For tax reporting
• Financial Account Information: Bank account details for royalty payments

No biometric information. We do not collect biometric identifiers or biometric information, such as face geometry, facial recognition data, or voiceprints. We previously used a third-party identity-verification provider, Persona Identities, Inc. That service has been discontinued, and all data from it has been deleted. If we ever introduce a feature that uses biometric data, we will update this policy first, publish a retention and destruction schedule, and get your written consent before collecting it.

Purpose: This sensitive information is used solely for:

• Fraud prevention and account security
• Compliance with financial regulations and tax reporting requirements
• Facilitating royalty payments and distributions
• Meeting legal obligations under music industry regulations

We do not use or disclose sensitive personal information for purposes beyond those permitted under the CPRA, and we do not use it to infer characteristics about you.

12.3 Your CCPA/CPRA Rights

California residents may exercise the following rights:

• Right to Know: Request disclosure of personal information categories, sources, purposes, and third parties we share with
• Right to Delete: Request deletion of personal information (subject to legal and business exceptions)
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Opt out of sale/sharing of personal information (we do not sell or share personal information)
• Right to Limit Sensitive Information: Request limitation on use of sensitive personal information
• Right to Non-Discrimination: Not be discriminated against for exercising your privacy rights

For CCPA/CPRA requests, contact legal@createbase.com. We will respond within 45 days and may require identity verification to protect your information. You may use an authorized agent to submit requests on your behalf, subject to verification.

13. European Privacy Rights

General Data Protection Regulation (GDPR):

For EU/UK residents, we process personal data under the following legal bases:

• Contract Performance: To provide our Services, including diligence, valuation, and royalty collection
• Legitimate Interests: For platform improvement, security, and fraud prevention
• Legal Compliance: To meet regulatory, tax, and reporting requirements
• Consent: For marketing and optional features

Where you upload documents containing personal information about third parties, you act as the controller (or as a controller jointly with the relevant rightsholders) and we act as your processor, processing that data only on your documented instructions to deliver the Services. You are responsible for having an appropriate legal basis and any required consents or notices for providing that data to us.

EU/UK data subjects have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority. International transfers are safeguarded as described in Section 8, including through Standard Contractual Clauses. To exercise these rights, contact legal@createbase.com.

14. Updates to This Privacy Policy

We may update this Privacy Policy to reflect:

• Changes in our practices or services
• Legal or regulatory requirements
• Industry standards and best practices

Material changes will be communicated through:

• Email notification to registered users
• Prominent notice on our website
• In-app notifications

Continued use after the effective date constitutes acceptance of the updated policy.

15. Contact Information

Privacy Officer — The Cur8 Group Corp

13223 Black Mountain Rd. Ste #1189
San Diego, CA 92129
Email: legal@createbase.com

For privacy-related inquiries and data subject requests.

This Privacy Policy is effective as of the date listed above and governs your use of our Services from that date forward. For more information about your relationship with CreateBase, please review our Terms of Service and End User License Agreement.