Privacy Policy

What we collect

• Accounts: your name, work email, company name and country, the workspace you belong to, and a hashed password. We never store a password itself.
• Licences: what your workspace licensed, when, for what coverage, and under which version of the terms. This is the record that makes a certificate verifiable, so we keep it.
• Payments: card details go to Stripe and never reach us. We receive confirmation of the payment, the amount, and the email used — nothing else.
• Projects and briefs: what you typed about what you are making, and the tracks you saved, so a project is still there when you come back. It is visible only to your workspace.
• Artists: the account details of an artist who offers music for licensing, their rights declaration, and the recordings themselves.

Listening is not tracked

You can play any recording in full without an account, and we do not record who played what. Listening addresses are signed and short-lived so the recording cannot be hotlinked from elsewhere; that signature identifies the track and the moment, not you.

What your browser stores

Your session token, so you stay signed in, and — where an artist has metered a recording — a marker recording when a preview window started, so it cannot be restarted by reloading. Clearing your browser data removes both. No advertising cookies are set, because there is no advertising.

Who processes it for us

• Stripe — payments and checkout. Stripe is its own controller for card data under its privacy policy (stripe.com/privacy).
• Cloudflare — hosting, storage and delivery. Accounts, licences, recordings and artwork live in Cloudflare's storage, and pages are served from its edge network.
• Anthropic — reading a project brief into searchable fields. What is sent is the text you wrote about your project; no account details go with it, and if the service is unavailable the search falls back to matching in our own code.

All three operate globally, so data may be processed outside the UK and EEA under the transfer safeguards in their own terms. We use no other analytics, advertising or tracking provider.

Where the music comes from

Artist accounts, recordings, artwork and rights records are shared with the operator's artist platform, where the artists publish and choose to offer their music for commercial licensing. It is one set of records on purpose: two versions of the truth about one recording is the one thing a rights platform cannot afford. Nothing about a business customer — your account, your projects, your licences or your payments — is shared back the other way.

Why we are allowed to hold it

Accounts, licences and payment records: to perform the contract you entered when you licensed a recording, and to keep the evidence a certificate rests on. Artist accounts, declarations and uploads: to perform our agreement with the artist, and our legitimate interest in being able to show, years later, who granted what and when. Accounting records: our legal obligations.

What we never do

• We never sell or rent your personal data.
• We never build an advertising profile of you, and we run no ad network.
• We never share your brief, your projects or your customers with anyone.
• We send no marketing email you did not ask for.
• We never use anyone's music, or your data, to train an AI model.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email info@hitboo.com and we will answer within 30 days. One limit is worth stating plainly: we cannot delete the record behind an issued licence, because that record is what lets anyone verify your certificate and is evidence of a transaction we are both party to. If you are in the UK or EEA and think we have handled your data badly, you can also complain to your national data protection authority.

How long we keep it

Licence and payment records stay for as long as the licence is capable of being relied on — which, since licences are perpetual, means indefinitely — and as long as tax and accounting law requires. Rights records are append-only by design: a decision is never edited or deleted, because "who approved this, when, and on what declaration" has to be answerable years later. Accounts and projects stay until you delete them.

Children

HITBOO is a service for businesses. It is not directed at children, and we do not knowingly collect their data.

Changes

We may update this policy; material changes are posted here with a new date at the top.

Data controller & contact

The controller is HONEYDOG LIMITED (company no. 12186800), C/O Bareham & Co, 25 Cabot Square, London, United Kingdom, E14 4QZ. Questions or a data request: info@hitboo.com · other contacts · Terms