Privacy Policy

1. Information we collect

• Account information: email address, password (stored hashed, never in plain text), display name, and profile details you provide (such as your home state).
• Performance data: gig details (venue, date, performer, setlist), evidence images you upload, and Performance Report submission history.
• Uploaded data exports: when you upload an Instagram or Facebook data export, we process the posts, captions, images, timestamps, and any location data contained in that file to detect your past performances. We only process the export you choose to upload. We do not connect to your Instagram or Facebook account, and we cannot access anything you have not uploaded.
• Automated analysis: to detect gigs, the posts and images from your uploaded export are processed by a third-party service provider (Google) using automated text-recognition and analysis (see "Third-party processors"). This processing may occur outside Australia. You review and confirm every detected gig. Nothing is submitted anywhere without your approval.
• Usage data: log files, IP address, browser type, device information, and pages visited, used to operate, secure, and improve the service.
• Cookies and similar technologies: we use session cookies to keep you signed in. Our analytics and performance monitoring (provided by Vercel) are cookieless. We do not use advertising cookies or cross-site tracking.

2. How we use your information

• To detect past gigs from your uploaded data exports and prepare APRA AMCOS Performance Reports for your review.
• To look up and verify venue addresses for your gigs.
• To create and manage your account, authenticate you, and provide customer support.
• To improve the accuracy of our gig-detection logic and overall product quality.
• To secure the service, prevent abuse, and enforce usage limits.
• To comply with legal obligations and respond to lawful requests.

We do not sell your personal information. We do not use your data for advertising or profiling, and we do not share it with third parties except as described below.

3. Third-party processors

We use the following service providers to operate Royalty Ready. Each acts as a data processor on our behalf and is bound to handle your data securely:

• Vercel: application hosting, content delivery, and cookieless analytics and performance monitoring
• Neon: database hosting and authentication (Neon Auth)
• Cloudflare R2: storage of evidence and post images
• Google: venue address lookup, and automated text-recognition and analysis of the posts and images in your uploaded data exports

Some of these providers may store data outside Australia (including in the United States and European Union). By using Royalty Ready you consent to this cross-border transfer. We take reasonable steps to ensure recipients handle your data consistently with the APPs.

4. APRA AMCOS submissions

When you use the Royalty Ready browser extension, it retrieves your prepared gig data from your Royalty Ready account and pre-fills the APRA AMCOS Performance Report form in your browser. You review and submit each report yourself. Performance Report data is sent from your browser directly to APRA AMCOS' portal. We do not submit on your behalf, act as an intermediary in the submission, or retain copies beyond the records already in your Royalty Ready account.

5. Data retention

We retain personal information for as long as your account is active. If you close your account, we delete your data within 90 days, except where retention is required by law (for example, for tax or audit purposes, in which case anonymised records may be retained for up to 7 years).

6. Your rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you (APP 12)
• Request correction of inaccurate information (APP 13)
• Request deletion of your account and associated data
• Withdraw consent for ongoing data processing
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

To exercise these rights, email us at getroyaltyready@gmail.com. We aim to respond within 30 days.

7. Data security

We use industry-standard safeguards including encryption in transit (TLS), encryption at rest for stored data, hashed passwords, and access controls. No system is perfectly secure, however, and we cannot guarantee absolute security.

8. Data breach notifications

If a data breach occurs that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner without unreasonable delay, in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth).

9. Children

Royalty Ready is intended for users aged 18 and over. We do not knowingly collect personal information from children under 18. If we learn we have collected information from a child, we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date above. Material changes will be communicated by email or in-app notice.

11. Contact

For questions about this policy or to exercise your privacy rights, email getroyaltyready@gmail.com.