Privacy Policy

Bandruption Corp, a Delaware corporation located at 8 The Green B, Dover, DE 19901, United States ("Bandruption", "we", "us", or "our"), is the data controller responsible for personal information processed under this Privacy Policy.

This Privacy Policy applies to all websites, applications, and services operated by Bandruption that link to it, including our marketing website (bandruption.com), our artist and fan platform (bandruption.fun and auth.bandruption.fun), our creator onboarding portal (create.bandruption.fun), our AI workspace (bandruption.ai), our developer documentation (docs.bandruption.fun), and the Bandruption Android application (package com.bandruption.bandruption) (collectively, the "Services").

We collect only the personal information needed to provide, secure, and improve the Services, or that you explicitly choose to share or consent to:

• Account and Identity Data: Name, display name, username/handle, email address, hashed password or passwordless magic-link tokens, profile avatar, account role (fan, artist, music industry professional, enterprise member), and third-party single sign-on identifiers when you choose to sign in via Google, Discord, X, Spotify, Apple, or Microsoft Entra ID.
• Artist, Creator, and Fan Content: Artist profiles, music tracks, audio/artwork uploads, event listings, merchandise catalogs, bounty submissions, fan Top 10 Proof of Fandom lists, comments, and public social links you publish on the platform.
• Commerce, Subscription, and BANDS Ledger Data: Order history, subscription tier and plan access state, BANDS credit purchases and usage ledger entries, event ticket and merchandise fulfillment details (such as shipping address when ordering physical goods), payout/affiliate attribution records, and tokenized payment references from PayPal, KOMOJU, Stripe, Google Play Billing, RevenueCat, or Microsoft Azure Commercial Marketplace. Bandruption does not store full raw payment card numbers.
• Bandruption AI Workspace Data (bandruption.ai & Platform AI Tools): Prompts, conversation messages, uploaded workspace files, selected agent/model settings, human-in-the-loop action approvals, and token metering records.
• Security, Operational, and Abuse-Prevention Logs: IP address, request timestamps, authentication session identifiers, rate-limit counters, and bot-verification tokens (Google reCAPTCHA Enterprise on newsletter forms and Cloudflare Turnstile on authentication endpoints) strictly necessary to defend the Services.
• Optional Consent-Gated Telemetry and Push Identifiers: Only when you explicitly opt in via our Cookie Preferences interface, we collect first-party product analytics events, Firebase Analytics / Web Vitals metrics, Bandruption AI browser RUM diagnostics, OneSignal web push subscription tokens, or X campaign conversion events.

We do not knowingly collect sensitive personal information (such as government identification numbers, biometric templates, precise GPS geolocation, health data, or racial/ethnic origin) unless strictly required by tax or payout compliance law for verified commercial sellers, in which case collection is handled directly by regulated payment processors.

We process personal information for clearly defined purposes and, where the GDPR, UK GDPR, or comparable laws apply, under the following legal bases:

When you use Bandruption AI (bandruption.ai) or agentic workflows on bandruption.fun, your prompts, uploaded files, and context are transmitted over encrypted connections to our enterprise AI inference providers (such as OpenAI, Anthropic, Google Cloud Vertex AI / Gemini, and AWS Bedrock) solely to generate responses and execute actions you request.

• No Foundation Model Training on Your Music or Chats: Bandruption does not train foundation AI models on artist audio recordings, unreleased stems, fan private data, or user AI conversations, and we configure commercial API integrations so third-party model providers are contractually prohibited from training their foundation models on Bandruption API traffic.
• Human-in-the-Loop External Actions: When an AI agent prepares an external action (such as publishing a post to a connected X account or modifying an event listing), Bandruption transmits data to that external platform only according to your workspace connections and approval settings.

Bandruption does not sell your personal information for money. We disclose personal information only to the following categories of recipients under written data-protection obligations:

• Infrastructure and Hosting Subprocessors: Cloud compute, content delivery, database, object storage, and caching providers (including Vercel, Google Firebase Hosting, OVHcloud, Microsoft Azure, PostgreSQL, MongoDB, Valkey/Redis, and AWS/Azure storage).
• Payment, Subscription, and Marketplace Processors: PayPal, KOMOJU, Stripe, Google Play Billing, RevenueCat, and Microsoft Azure Commercial Marketplace when you initiate a purchase or manage a subscription.
• AI Inference and Search Tool Providers: OpenAI, Anthropic, Google Gemini / Vertex AI, AWS Bedrock, and optional web-search providers (such as Tavily when web search is invoked in Bandruption AI).
• Authentication, Security, and Messaging Providers: OAuth/OIDC identity providers you select at sign-in, Google reCAPTCHA Enterprise, Cloudflare Turnstile, transactional email providers, and—only with Functional consent—OneSignal for web push.
• Consent-Gated Analytics and Campaign Measurement: Only when you opt in via Cookie Preferences (and subject to Global Privacy Control), Google Firebase Analytics / GTM, HyperDX RUM, and X Corp. (conversion pixel pei71 on bandruption.fun). We do not run Google AdSense, Meta Pixel, or LinkedIn Insight Tag.
• Artists, Entities, and Public Profile Viewers: Information you publish publicly (such as an artist page or public Top 10 list) is visible to visitors; when you buy an artist subscription, ticket, or merchandise item, necessary fulfillment details are shared with that artist or organizer.
• Corporate Transactions and Legal Authorities: Where required by valid legal process, court order, or statutory obligation, or in connection with a merger, acquisition, financing, or sale of assets subject to confidentiality and notice requirements.

Across all Bandruption web surfaces, non-essential cookies, localStorage identifiers, analytics SDKs, marketing pixels, and third-party media embeds are disabled by default until you make an affirmative opt-in choice in our self-hosted Cookie Preferences banner. Your consent preference is stored in a host-only first-party cookie named bandruption_consent for 180 days and is never shared across unrelated subdomains.

We honor Global Privacy Control (navigator.globalPrivacyControl === true). When your browser sends an active GPC signal, Bandruption automatically disables the Marketing & Conversion Attribution category (including the X conversion pixel and Google Consent Mode v2 ad_* signals) and treats the signal as a valid opt-out of cross-context behavioral advertising / "sharing". See our Cookie Policy (/cookies) for the complete technical inventory.

We retain personal information only for as long as necessary for the specific purpose for which it was collected, rather than applying an arbitrary blanket period:

• Active Account, Profile, and AI Workspace Data: Retained while your Bandruption account remains active so you can access your profile, music, subscriptions, purchased benefits, and conversations (subject to any shorter conversation-retention rules configured in your Bandruption AI workspace).
• Account Deletion Timeline: When you delete your account in-app or submit a verified deletion request via https://www.bandruption.fun/account-deletion or support@bandruption.fun, we delete or irreversibly anonymize your account profile and personal content from active production systems within 30 days, and from encrypted disaster-recovery backups within 90 days.
• Financial, Tax, and BANDS Ledger Records: Retained for up to 7 years (or the period mandated by applicable tax, accounting, payment-card, and marketplace audit laws).
• Security and Fraud-Prevention Logs: Retained for up to 12 months unless needed longer to investigate an active security incident.
• Consent Preference Cookie and Anonymous Receipts: The bandruption_consent browser cookie expires after 180 days; minimized, anonymous server-side consent receipts (which contain no user ID, email, IP address, or user-agent string) automatically expire after 24 months (730 days).

Bandruption is headquartered in the United States and uses infrastructure and subprocessors located in the United States, the European Union, Japan, and other jurisdictions. When personal information is transferred outside the European Economic Area (EEA), the United Kingdom, Switzerland, Japan, or the Republic of Korea to a country without a full adequacy determination, we rely on recognized legal transfer mechanisms, including the European Commission Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, certified Data Privacy Framework (DPF) participation of eligible US vendors where applicable, and contractual security safeguards.

Depending on where you live—and as a baseline privacy commitment we extend to Bandruption users globally—you have the right to:

• Access and Portability: Request confirmation of whether we process your personal information and receive a portable copy of your data.
• Correction / Rectification: Update inaccurate or incomplete personal information via your account settings or by contacting us.
• Deletion / Erasure: Delete your account and personal information via in-app Account Settings, https://www.bandruption.fun/account-deletion (support@bandruption.fun), or hello@bandruption.com.
• Withdraw Consent at Any Time: Reopen "Cookie Preferences" in the footer of any Bandruption website to withdraw optional cookie/tracker consent immediately, without affecting the lawfulness of processing prior to withdrawal.
• Restriction, Objection, and Supervisory Complaint (EEA / UK / Switzerland): Object to processing based on legitimate interests, request restricted processing, or lodge a complaint with your local data protection supervisory authority.
• US State Privacy Rights (California CCPA/CPRA, Virginia, Colorado, Connecticut, Texas, Oregon, and others): Right to know categories/specific pieces of personal information, right to correct, right to delete, right to opt out of "sharing" for cross-context behavioral advertising (via Cookie Preferences or GPC), right to appeal a denied request by emailing hello@bandruption.com with subject "Privacy Appeal", and right to non-discrimination for exercising privacy rights. Authorized agents may submit requests with signed permission and identity verification.
• Japan (APPI) & Republic of Korea (PIPA) Rights: Request notification of utilization purpose, disclosure, correction, deletion, suspension of utilization or third-party/overseas provision, and review information on overseas recipients by contacting hello@bandruption.com.

To exercise any right, email hello@bandruption.com (or support@bandruption.fun for account deletion). We verify requests using your authenticated session or email confirmation without demanding unnecessary government IDs, and we respond within 30 days (or any shorter statutory period).

We protect personal information using TLS encryption in transit, encryption at rest across managed databases, HttpOnly/Secure session cookies, tenant and role-based access controls, secret redaction in observability pipelines, and least-privilege subprocessor access. No internet transmission or storage system is 100% immune from risk; if a reportable data breach occurs, we will notify affected individuals and regulators as required by law.

The Services are intended exclusively for individuals aged 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided personal information to Bandruption, contact hello@bandruption.com and we will promptly terminate the account and delete the data.

When we make material changes to this Privacy Policy, we publish a new dated version with a verifiable cryptographic content hash, preserve prior versions in our public version archive, and provide prominent notice via the Services or email where required by law.