Privacy Policy — Haven

WORKING DRAFT FOR COUNSEL. Prepared for David Chatfield to edit and finalize. Bracketed items ([LIKE THIS]) are intentional fill-ins. Align retention, transfers, and CCPA/GDPR elections with your entity and processors before publish. Not a substitute for your professional judgment.

Last updated: [DATE]
Service: Haven — https://havenmusic.us
Operator: [COMPANY LEGAL NAME], [ADDRESS]
Contact: davidblakechatfield@gmail.com

This Privacy Policy explains what information we collect, why we collect it, how we use and share it, and choices you may have. It applies to our websites, apps, and related services (the “Service”).

1. Who we are

Haven is operated by [COMPANY LEGAL NAME] (“Haven,” “we,” “us”).
Privacy contact: davidblakechatfield@gmail.com
EU/UK representative / DPO (if applicable): [PLACEHOLDER]

2. Information we collect

A. Information you provide

• Waitlist / marketing email — email address (and optional name) if you join a waitlist or mailing list.
• Account — email, password (hashed) or auth-provider identifiers, display name, profile settings, household/profile labels where used.
• Artist / rights-holder onboarding — name, contact email, payout details (via Stripe Connect or similar), rights attestations, tax forms [PLACEHOLDER — W-9 / W-8 as required], catalog metadata.
• Support — messages you send us.
• User content — audio masters, artwork, credits, liner notes/booklets you upload.

B. Payment information

• Payments are processed by Stripe (or Apple for App Store subscriptions).
• We typically receive limited billing metadata (e.g. subscription status, last4 / brand, billing country, receipts) — not full card numbers on our servers.

C. Listening & usage data (needed for product + payouts)

• Plays, previews, pauses, skips, offline downloads/license status, device/app version, approximate timestamps.
• We use eligible listen time and related signals to allocate user-centric payouts to rights holders (product model: 70% of net subscription revenue). Aggregated or pseudonymous reporting may be shared with rights holders / distributors as required by agreements.
• Integrity / fraud signals (e.g. bot-like patterns) for abuse prevention.

D. Technical & cookies

• IP address, device type, browser, OS, referrer, approximate location derived from IP.
• Cookies / local storage / similar technologies for session auth, preferences, security, and (if enabled) analytics.
• Cookie categories: [Essential / Preferences / Analytics — counsel to finalize; provide opt-out where required].

E. Information from third parties

• Auth providers (if you sign in with Apple/Google/etc.).
• Payment platforms (Stripe, Apple).
• Distributors / labels if catalog is delivered via partner pipelines (e.g. DDEX) — metadata and delivery logs.

We do not intentionally collect special-category data for consumer listening. Do not upload sensitive personal data in liner notes beyond what is needed for credits.

3. Why we use information (purposes)

Marketing emails: opt-in where required; unsubscribe link in messages.

AI: Haven’s product stance is no generative AI training on licensed/uploaded catalog. Counsel should confirm processing language matches final product and rider. Analytics/ML used only for [fraud / ops — specify] if any.

4. How we share information

We do not sell personal information for money in the traditional sense. [CCPA “sell”/“share” definitions — counsel to assess advertising cookies if added.]

We share with:

• Processors / service providers: e.g. Vercel (hosting), Stripe (payments / Connect), object storage / Blob providers, email delivery, error monitoring, [analytics vendor if any].
• Rights holders & distributors: usage reports and payout-related data as needed to pay and account for streams (may include aggregated or account-level listening allocation data per agreements).
• App platforms: Apple when you use TestFlight / App Store billing.
• Legal / safety: if required by law, valid legal process, or to protect rights, safety, and integrity of the Service.
• Business transfers: successor entities in a merger/acquisition, with notice where required.

5. Retention

• Account data: while account is active, then deleted or anonymized within [X months/years] after closure, unless longer retention is required (tax, disputes, fraud).
• Listening/usage logs: retained as needed for payouts, audits, and fraud prevention for [X months/years], then aggregated or deleted.
• Waitlist emails: until you unsubscribe or we shut down the list, or [X months] of inactivity.
• Uploads / masters: retained per rights-holder agreement; takedown/removal per contract and law.
• Payment records: per tax and accounting requirements [PLACEHOLDER].

Exact schedules: [counsel + ops to finalize].

6. Security

We use industry-reasonable measures (encryption in transit, access controls, hashed passwords). No method of transmission or storage is 100% secure. Report suspected incidents to davidblakechatfield@gmail.com.

7. Your rights

Depending on where you live, you may have rights to:

• Access / know what we hold about you
• Correct inaccurate data
• Delete (subject to legal/payout retention)
• Export / portability
• Opt out of marketing
• Restrict / object to certain processing
• Withdraw consent where processing is consent-based
• Appeal a denial (where required, e.g. some US state laws)

CCPA/CPRA-style (California) placeholders: right to know, delete, correct, opt out of sale/share, limit use of sensitive personal information, non-discrimination.
GDPR/UK GDPR placeholders: rights above plus complaint to a supervisory authority; international transfer mechanism [SCCs / DPF — PLACEHOLDER].

To exercise rights: email davidblakechatfield@gmail.com with the subject “Privacy request.” We may need to verify your identity. Authorized agent: [PLACEHOLDER process].

8. Children’s privacy

The Service is not directed to children under [13 / age counsel sets]. We do not knowingly collect personal information from children under that age. If you believe we have, contact us and we will delete it as required by COPPA and similar laws.

9. International transfers

If you access Haven from outside the United States, your information may be processed in the U.S. and other countries where we or our processors operate. [Transfer safeguards — PLACEHOLDER.]

10. Do Not Track / Global Privacy Control

[PLACEHOLDER — how we respond to DNT/GPC signals.]

11. Changes

We may update this Policy. We will post the new version and update “Last updated.” Material changes may require additional notice where required by law.

12. Contact

Email: davidblakechatfield@gmail.com
Web: https://havenmusic.us
Mail: [COMPANY LEGAL NAME], [ADDRESS]

End of working draft — edit and adopt as counsel.