Privacy Policy — Haven

Last updated: September 15, 2026
Service: Haven — https://havenmusic.us
Operator: Haven Music LLC, 8834 Reseda Blvd. #2051, Northridge, CA 91324
Contact: contact@havenmusic.us

This Privacy Policy explains what information we collect, why we collect it, how we use and share it, and choices you may have. It applies to our websites, apps, and related services (the “Service”).

1. Who we are

Haven is operated by Haven Music LLC (“Haven,” “we,” “us”).
Privacy contact: contact@havenmusic.us
EU/UK representative / DPO: Not appointed at this time. Privacy requests still go to contact@havenmusic.us.

2. Information we collect

A. Information you provide

• Waitlist / marketing email — email address (and optional name) if you join a waitlist or mailing list.
• Account — email, password (hashed) or auth-provider identifiers, display name, profile settings, household/profile labels where used.
• Artist / rights-holder onboarding — name, contact email, payout details (via Stripe Connect or similar), rights attestations, tax forms (W-9 / W-8 as required), catalog metadata.
• Support — messages you send us.
• User content — audio masters, artwork, credits, liner notes/booklets you upload.

B. Payment information

• Payments are processed by Stripe (or Apple for App Store subscriptions).
• We typically receive limited billing metadata (e.g. subscription status, last4 / brand, billing country, receipts) — not full card numbers on our servers.

C. Listening & usage data (needed for product + payouts)

• Plays, previews, pauses, skips, offline downloads/license status, device/app version, approximate timestamps.
• We use eligible listen time and related signals to allocate user-centric payouts to rights holders (product model: 70% of net subscription revenue). Aggregated or pseudonymous reporting may be shared with rights holders / distributors as required by agreements.
• Integrity / fraud signals (e.g. bot-like patterns) for abuse prevention.

D. Technical & cookies

• IP address, device type, browser, OS, referrer, approximate location derived from IP.
• Cookies / local storage / similar technologies for session auth, preferences, and security.
• Cookie categories currently used: Essential (sign-in, security, load balancing) and Preferences (e.g. player settings). We do not currently use advertising cookies. If we add Analytics cookies, we will update this Policy and provide opt-out where required.

E. Information from third parties

• Auth providers (if you sign in with Apple/Google/etc.).
• Payment platforms (Stripe, Apple).
• Distributors / labels if catalog is delivered via partner pipelines (e.g. DDEX) — metadata and delivery logs.

We do not intentionally collect special-category data for consumer listening. Do not upload sensitive personal data in liner notes beyond what is needed for credits.

3. Why we use information (purposes)

Marketing emails: opt-in where required; unsubscribe link in messages.

AI: Haven does not train generative models on licensed or uploaded catalog. Any automated processing is limited to fraud, abuse, operations, and payout integrity — not generative audio or “in the style of” features.

4. How we share information

We do not sell personal information for money. We do not “share” personal information for cross-context behavioral advertising as those terms are used in the CCPA/CPRA, because we do not currently run that advertising. If that changes, we will update this Policy and offer required opt-outs.

We share with:

• Processors / service providers: e.g. Vercel (hosting), Stripe (payments / Connect), object storage / Blob providers, email delivery, error monitoring, and analytics vendors if enabled.
• Rights holders & distributors: usage reports and payout-related data as needed to pay and account for streams (may include aggregated or account-level listening allocation data per agreements).
• App platforms: Apple when you use TestFlight / App Store billing.
• Legal / safety: if required by law, valid legal process, or to protect rights, safety, and integrity of the Service.
• Business transfers: successor entities in a merger/acquisition, with notice where required.

5. Retention

Unless a legal hold, dispute, tax rule, or fraud investigation requires longer:

• Account data: life of the account, then deleted or anonymized within 90 days after you close it.
• Listening / eligible-play logs: 24 months, then aggregated or deleted (needed for payouts and integrity).
• Waitlist emails: until you unsubscribe, or 24 months of inactivity.
• Support mail: 3 years.
• Payment / tax records: 7 years.
• Artist Agreement acceptances and related records: duration of the relationship plus 4 years.
• Uploads / masters: retained per the Artist Agreement; takedown/removal per contract and law.
• Cookies: session cookies expire when you close the browser; preference cookies typically up to 13 months.

Legal holds override these schedules.

6. Security

We use industry-reasonable measures (encryption in transit, access controls, hashed passwords). No method of transmission or storage is 100% secure. Report suspected incidents to contact@havenmusic.us.

7. Your rights

Depending on where you live, you may have rights to:

• Access / know what we hold about you
• Correct inaccurate data
• Delete (subject to legal/payout retention)
• Export / portability
• Opt out of marketing
• Restrict / object to certain processing
• Withdraw consent where processing is consent-based
• Appeal a denial (where required, e.g. some US state laws)

California (CCPA/CPRA). You have rights to know, delete, correct, opt out of sale/share, limit use of sensitive personal information, and non-discrimination. As noted above, we do not currently sell or share personal information for cross-context behavioral advertising.

GDPR / UK GDPR. You may also complain to a supervisory authority. For international transfers of EEA/UK personal data to the United States, we rely on Standard Contractual Clauses (SCCs) (and the UK equivalent) with our processors where required.

To exercise rights: email contact@havenmusic.us with the subject “Privacy request.” We may need to verify your identity. Authorized agents: email the same address with a signed authorization from the consumer and enough information for us to verify both you and the consumer.

8. Children’s privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have, contact us and we will delete it as required by COPPA and similar laws.

9. International transfers

If you access Haven from outside the United States, your information may be processed in the U.S. and other countries where we or our processors operate. For EEA/UK personal data, see the SCC language in Section 7.

10. Do Not Track / Global Privacy Control

We honor Global Privacy Control (GPC) signals as a request to opt out of “sale” or “sharing” of personal information under California law. We do not currently respond to older generic Do Not Track browser headers, which lack a common standard.

11. Changes

We may update this Policy. We will post the new version and update “Last updated.” Material changes may require additional notice where required by law.

12. Contact

Email: contact@havenmusic.us
Web: https://havenmusic.us
Mail: Haven Music LLC, 8834 Reseda Blvd. #2051, Northridge, CA 91324

Adopted September 15, 2026.