Back to Dashboard

This Privacy Policy explains how Mighty Maverick Music, Inc. ("RoyaltyCoPilot," "RCP," "we," "us," or "our") collects, uses, protects, and shares information about you when you use the RoyaltyCoPilot.ai websites, applications, and related services (the "Services"). It is incorporated into our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

1. Who We Are

RCP is a royalty audit and registration service for songwriters and rights holders. We connect to rights organizations (currently The MLC, with others planned) to find missing royalties, fix registrations, and prepare ownership claims that you approve. Contact: privacy@royaltycopilot.ai.

2. Information We Collect

Information you provide.

• Account information: name, email address, password, and payment information (card details are collected and stored by our payment processor, Stripe, not by us).
• Catalog metadata: song and recording titles, writers, splits, ISRCs, ISWCs, publisher information, and related data about your musical works and sound recordings.
• Rights organization credentials: login credentials you provide so we can access your rights organization accounts, or the delegated user configuration you approve. Credentials are encrypted at rest as described in Section 8.
• Royalty statements and account data: statements, registration records, claim status, and payment data retrieved from your connected rights organization accounts with your authorization.
• Communications: messages you send to support and responses to surveys.

Information collected automatically.

• Usage data: pages viewed, features used, actions taken in the Services, and similar interaction data.
• Device and log data: IP address, browser type, operating system, and timestamps.
• Evidence records: screenshots and logs of actions the Services perform on your connected rights organization accounts, captured so you can verify exactly what we did (see Section 8).
• Cookies: as described in Section 12.

Information from third parties. Data retrieved from rights organizations you connect, and limited data from service providers such as payment status from Stripe.

3. How We Use Information

We use information to:

• Provide the Services: scanning for missing royalties, computing estimates, maintaining registrations, preparing claims, and (on applicable plans) collecting and remitting royalties.
• Act under your authorization. You grant RoyaltyCoPilot ongoing authority to prepare, submit, correct, update, and maintain registrations for your musical works and sound recordings with the Rights Organizations you have connected, without a separate approval for each individual registration change. Claims are treated differently. A claim is a legal assertion of ownership. RoyaltyCoPilot prepares claims for you, but we will never submit a claim to a Rights Organization without your explicit approval of that specific claim. (This is the same authorization disclosed in Section 7 of our Terms of Service; the two documents intentionally match.)
• Process payments and manage subscriptions.
• Send transactional notifications (connection status, claim approvals, statements, security alerts) and, with your consent where required, product news you can opt out of at any time.
• Provide the in-app assistant, which may process your questions and relevant portions of your own catalog and royalty data to answer you (see Section 5 regarding LLM providers).
• Secure the Services, prevent fraud and abuse, and audit access to data.
• Comply with legal obligations.

4. What We Do Not Do

• We do not sell your personal data. Not to advertisers, not to data brokers, not to anyone.
• We do not use one user's catalog data to benefit another user. Your splits, statements, and claim history are yours. We do not surface them to other users, use them to tune another user's claims, or pool them into shared insights that reveal your data.
• We do not let LLM providers train on your data. Data sent to AI model providers for the in-app assistant is used only to answer your request and is not used to train those providers' models.
• We do not expose credentials or billing data through the MCP connector. The connector is read-only (plus a rate-limited sync trigger) and is scoped to your own data.

5. How We Share Information

We share personal information only:

• With service providers who process it on our behalf, under contracts limiting use to our instructions. Current categories: hosting and infrastructure (Amazon Web Services, US region), payment processing (Stripe), email delivery (Resend), support chat (Crisp), application platform (Base44), and LLM providers for the in-app assistant (subject to the no-training commitment in Section 4).
• With rights organizations, as needed to maintain your registrations and file claims you have approved. This is the point of the Services.
• With your consent or at your direction, for example if you connect an AI assistant through the MCP connector or invite a collaborator.
• For legal reasons, if required by law, subpoena, or legal process, or to protect the rights, safety, or property of RCP, our users, or the public. Where lawful, we will notify you before disclosing your data in response to legal process.
• In a corporate transaction (merger, acquisition, or asset sale), in which case we will notify you and the successor must honor this Policy, including the funds obligations described in the Terms of Service.

We may share aggregated or de-identified information that cannot reasonably identify you.

6. Delegated Access and Credentials

When you connect a rights organization, either you provide credentials or you approve a clearly named, disclosed "RoyaltyCoPilot" delegated user added through the rights organization's own invite flow with limited roles (for The MLC, Finance and Copyright roles, never Super User). We never hide our identity on your account. Every action taken on your connected accounts is user-scoped, audited, and captured with evidence records. Credential protection details are in Section 8 and on our public Security Page.

7. Data Retention Schedule

We keep data only as long as needed for the purposes described here, on the following schedule:

• Rights organization credentials: Automated cleanup begins immediately when you disconnect; all copies, including residual encrypted copies and backups, deleted within 30 days of disconnect.
• Account data (profile, catalog metadata, statements, claim history): Deleted within 90 days after account deletion, except where a legal hold or legal obligation requires longer retention.
• Evidence screenshots of account actions: 13 months from capture.
• Audit logs of data access and account activity: 24 months from creation.
• Payment records: As required by tax and accounting law, held by our payment processor and in our financial records.

When you disconnect a rights organization or close your account, the Exit Protocol in Section 17 of the Terms of Service also applies: delegated user removed within 7 days, credentials deleted within 30 days, and completion confirmed to you by email.

8. How We Protect Information

Stored rights organization credentials are encrypted with envelope encryption using managed keys (AWS KMS, with a unique data key per stored blob) and are encrypted at rest and in transit. Delegated users have their own multi-factor authentication. All API access to our backend is signed. Every access to your data is scoped to your user and recorded in audit logs. Claim filings require your explicit per-claim approval, support a dry-run preview, and are covered by an emergency stop. Infrastructure runs on AWS in the us-east-1 region. Our public Security Page describes these measures in plain language.

Breach notification. If we confirm a security breach affecting your personal data or stored credentials, we will notify you by email without undue delay, and in any event within 72 hours of confirming the breach, describing what happened, what data was involved, and what we are doing about it. This mirrors Section 15 of the Terms of Service.

No internet service can guarantee perfect security, but these commitments are ones we design and operate against.

9. Your Rights and Choices

• Access, correction, deletion: You can access and update most of your data in the Services. You may request a copy of your data, correction of inaccuracies, or deletion of your account and data by emailing privacy@royaltycopilot.ai.
• Deletion SLA: We complete verified deletion requests within 30 days of verifying the request, subject to the retention schedule in Section 7 and any legal holds. We will confirm completion by email.
• Marketing opt-out: Unsubscribe links appear in every marketing email. Transactional messages (statements, security notices, claim approvals) continue while you have an account.
• Connector revocation: You can revoke MCP connector access at any time in your settings.
• Disconnect: You can disconnect any rights organization at any time, which triggers the Exit Protocol described in Section 7 above and in Section 17 of the Terms of Service.

We will not discriminate against you for exercising any privacy right.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know the categories and specific pieces of personal information we collect, the right to delete, the right to correct, the right to non-discrimination, and the right to opt out of sale or sharing. We do not sell or share personal information as those terms are defined under California law, and we do not use or disclose sensitive personal information for purposes requiring a right to limit. Categories collected in the last 12 months: identifiers, commercial information, internet activity, professional information (catalog and royalty data), and inferences limited to service functionality. To exercise rights, email privacy@royaltycopilot.ai; we will verify your identity and respond within the timelines required by law. (Additional CCPA and CPRA disclosures, including request metrics and authorized-agent procedures, will be added following our legal review.)

11. European and UK Data Rights (GDPR)

If you are in the EEA, UK, or Switzerland, RCP acts as the controller of your personal data. Our legal bases are: performance of our contract with you (providing the Services, including the authorization described in Section 3), legitimate interests (securing and improving the Services), consent (where required, revocable at any time), and legal obligation. You have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority. Data is processed in the United States; where required, we rely on appropriate safeguards such as standard contractual clauses. (Our EU and UK representative appointment and detailed transfer-mechanism disclosures will be added following our legal review.) To exercise rights, email privacy@royaltycopilot.ai.

12. Cookies

We use essential cookies (login sessions, security), functional cookies (preferences), and analytics cookies (understanding how the Services are used, in aggregate). We also use browser local storage for login sessions and preferences; the same commitments apply to it. Our support chat provider (Crisp) sets its own functional cookies when the chat widget loads. We do not use cookies for third-party advertising, and we do not use advertising pixels or cross-site trackers. You can control cookies through your browser settings; disabling essential cookies may prevent the Services from working. Where required by law, we request consent for non-essential cookies.

13. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. Account holders must be at least 18 as described in the Terms of Service. If we learn we have collected information from a child under 13, we will delete it promptly.

14. Changes to This Policy

We may update this Policy. For material changes, we will notify you by email and in the Services at least 30 days before the change takes effect, and we will update the date at the top. Your continued use after the effective date constitutes acceptance.

15. Contact

Privacy questions and requests: privacy@royaltycopilot.ai

Security reports: security@royaltycopilot.ai