Privacy policy.

The controller of your data is Chiado Music Group EOOD, a company registered in Bulgaria that operates Distroline. We apply the GDPR and the Bulgarian Personal Data Protection Act. If you left your email on a pre-save page, read the clause on fans of pre-save pages. For any data protection question, or to exercise your rights, write to privacidade@distroline.com.

Account data

email, display name, optional first and last name, phone number if you give one, country, the country of your connection when you signed up, language, plan and verification status.

Purchase data

the plans and token packs you buy and the billing details you enter at Stripe: name, address and, if you give one, your tax ID. Card and bank account details stay with Stripe and never pass through Distroline.

Payout data

to pay you royalties: legal name, whether you are an individual or a company, address, country of tax residence, tax and VAT numbers, tax status, the IBAN or PayPal email we pay to, your wallet balance and movements, your acceptance of the self-billing agreement, and the royalty invoices.

Release data

the audio, artwork, ISRC/UPC codes, credits and collaborator names you add to a release, and the email of the collaborators you invite to a royalty split. The content is yours; we process it to deliver it to the Stores you choose.

Communication data

support messages and emails you send us, and what you write in the contact form (name, email, topic and message) and the IP address you send it from, to stop abuse, even without an account.

Technical data

IP address (used for rate limiting and abuse prevention), your browser, error reports and request times.

Security and anti-fraud data

every time you sign up or sign in: the IP address and the country of the connection, a device identifier kept in a cookie, a fingerprint of your browser (a SHA-256 summary of the screen size, timezone, languages, operating system, hardware and how the browser draws a test image and 3D graphic), the readable part of that fingerprint (screen, timezone, language and system) and the browser identification (user agent). When you pay, Stripe also gives us a fingerprint of the card, never its number, so that each person has only one free trial. We use these data to detect fraud and to stop a suspended account from coming back as another.

Product analytics

only if you accept it: which pages and features you use and how the app behaves, to fix bugs and improve the product. Navigation recordings need a separate permission and mask text and form fields. Account, settings, wallet, payment, invoice and support pages are left out. It is linked only to your account identifier and is never sold or used for advertising.

Public Spotify data

to import your catalogue and show your releases’ plays, we read public data about your artist profile and your releases from Spotify, such as names, titles, artwork and play counts. Here Spotify is a source of public data, not a processor.

Provide the service

distribute your releases, keep the royalty accounts, bill your plan and process payouts.

Communicate

operational notices such as release status, payment receipts and security alerts.

Comply with the law

keep the records that tax, accounting and anti-fraud rules require.

Improve the product

diagnose bugs, measure what gets used and decide what to build next.

Prevent abuse

rate-limit requests, detect fraud, stop a suspended account from coming back as another and protect every catalogue from impersonation.

Contract · Art. 6(1)(b)

running your account, delivering releases, royalty accounting and payouts. Necessary to provide the service.

Legal obligation · Art. 6(1)(c)

tax and accounting records, including invoices, and identity checks where required.

Legitimate interests · Art. 6(1)(f)

security, fraud prevention and error monitoring, always weighed against your rights.

Consent · Art. 6(1)(a)

product analytics, navigation recordings, the emails to fans of pre-save pages and anything optional, such as marketing should we ever add it. You can withdraw consent whenever you like, without affecting earlier lawful processing.

Account data

for the life of your account, plus a short window after closure to settle final payouts and any disputes.

Release data

while the release is live in any Store, plus a short period after takedown.

Billing and tax records

for the period required by the applicable accounting and tax law.

Support messages

for the life of your account, so we can follow up on earlier requests.

Contact form

for as long as we need to reply and follow the conversation. If you ask, we delete your message.

Technical logs

for as long as security and error diagnosis require.

Security and anti-fraud data

one year from each sign-up or sign-in. If an account is suspended for fraud or abuse, the device identifiers and browser fingerprints it used stay on a block list until lifted, and the IP addresses it used in the 30 days before are blocked for 90 days.

Product analytics

for the retention period set in PostHog, while you keep your consent.

Advertising measurement

for the retention period set by Google Ads, while you keep your consent.

Pre-save fans

the periods are in the clause on fans of pre-save pages.

We share the minimum data needed. The providers that process data on our behalf (processors) do so under data processing agreements that meet GDPR Art. 28. The Stores, Stripe and PayPal for their own payment obligations, Google and Apple for sign-in, and Spotify act as independent controllers, under their own terms.

Stores

Spotify, Apple Music, YouTube Music, Deezer, Tidal, Amazon Music and the others you choose receive your release’s metadata, audio and artwork so they can list it, under each Store’s own agreement.

Distribution partner

Our distribution partner carries your releases to the Stores on our behalf: it receives each release’s metadata, audio, artwork and artist names, and sends us back the royalty reports.

Payments

Stripe processes payments for plans and token packs, by card, SEPA Direct Debit, MB WAY, Pix, Apple Pay, Google Pay and Link, and generates their invoices. It receives your name, email, billing address, your tax ID if you give one, and your payment details.

Royalty payouts

if you choose to be paid by PayPal, PayPal receives your PayPal email and the amount of each payout. If you choose SEPA, the bank we use for the transfer receives your name and IBAN.

Copyright check

ACRCloud compares a fingerprint of the audio you upload against existing copyrighted content, before the release goes to the Stores.

Cover reading

when you upload cover art, we send a reduced copy to OpenRouter, which passes it to a Z.ai vision model, to read the artist names written on it and warn you if any is missing from the credits. Only the image is sent, with no data about your account.

Catalogue import

when you import your catalogue, an audio import provider, through RapidAPI, receives the public Spotify link of each track so it can return the audio to us. It receives no data from your account.

Email

Bird (MessageBird B.V., the Netherlands, EU region) sends transactional email and the emails to fans who asked to be told on a pre-save page. Account emails (sign-in codes, replies to help requests, notices) carry an open pixel that tells us whether the email was opened; you accept this when you create an account. Emails to fans carry no pixel. No email carries tracked links. Zoho (EU region) receives the emails you write to support, and the Distroline team signs in with Zoho.

Addresses

Geoapify receives the text you type in the address field of the payout and billing forms, to suggest addresses.

Network and security

Cloudflare serves the site through its network (CDN), protects it against abuse and DDoS attacks, and runs the Turnstile bot check at sign-up, at sign-in, on pre-save pages and on the site’s forms when a submission looks suspicious. To do this it handles technical data such as your IP address and browser.

Google and Apple

if you choose to sign in with Google or Apple, we receive your name, email and account ID from the account you use, under each one’s own terms.

Infrastructure

the provider of the server the platform runs on, and Cloudflare R2, where the audio, artwork and attachments you upload are stored.

Analytics and monitoring

PostHog for product analytics, only with your consent, and Sentry for error monitoring, both in the EU region and configured with privacy in mind.

Advertising

Google Ads, only with your consent, to measure whether our Google ads bring new accounts. We do not use ad personalisation.

Internal alerts

Discord, a US company, hosts the private channels where the team receives alerts: release titles, artist names, account identifiers and operational events.

Advisers and authorities

advisers bound by confidentiality, and public authorities only when the law requires it. We tell you, unless the law forbids it.

We do not sell your personal data, we do not share it with advertising networks, and we do not run cross-site behavioural advertising.

This clause is for anyone who leaves their email on a pre-save page on dline.fm. Chiado Music Group EOOD is the controller of this list and sends the emails on the artist’s behalf.

What we keep

your email, the country of your connection, the source of the link you used when the page records one, the dates you signed up and confirmed, and whether you asked to hear about the artist’s next releases. When you sign up, Cloudflare runs the Turnstile bot check.

What for

one email straight away, to confirm it is you, and, once you confirm, one email on release day with the link. We only count and only write to people who confirm. The basis is your consent, which you give by pressing Yes.

How we send

the confirmation email and the release-day email go out through Bird, one email per fan, with no open pixel and no tracked links. Bird keeps the addresses that ask for no more email, so it never writes to them again.

What the artist sees

numbers: how many fans signed up, from which countries and through which links. The artist does not receive your email, unless you ask to hear about their next releases.

Next releases

if you tick that option, the artist can download your email, country, source and sign-up date, on a premium page, to tell you about their next releases, and becomes responsible for that use. Unsubscribing takes you out of later downloads, but does not delete a copy the artist already has; for that, contact the artist.

How long

we delete an unconfirmed sign-up after 30 days. If you only wanted the release-day email, we delete your email 30 days after release. If you asked to hear about the next releases, we delete it one year after release.

Unsubscribe and delete

every email carries an unsubscribe link. The link in the confirmation email leads to a page where you can also delete your email from the list. For any other request, write to privacidade@distroline.com.

We use the EU region where the provider offers it and we have set it up: Bird, Zoho, PostHog and Sentry process your data in the EU. Other recipients, such as Cloudflare, Discord, Google, Apple, OpenRouter and Z.ai, the payment providers and some Stores, may process data outside the EEA. In those cases the transfer relies on an adequacy decision of the European Commission or on the European Commission’s Standard Contractual Clauses, and the data travels encrypted.

Access

get a copy of the personal data we hold about you.

Rectification

correct anything that is inaccurate.

Erasure

ask us to delete your data, subject to the records we are required to keep.

Restriction

pause the processing while a dispute is resolved.

Portability

receive your data in a structured, machine-readable format.

Objection

object to processing based on our legitimate interests.

Withdraw consent

for anything processed on the basis of your consent.

Request access to your data or the deletion of your account in Settings → Account, or write to privacidade@distroline.com. We reply without undue delay, normally within one calendar month. If the complexity or number of requests calls for an extension, we explain why within the first month; the extension can be of up to two further months. You can also lodge a complaint with a supervisory authority: the one in the country where you live, where you work or where the alleged infringement took place.

We use a small set of strictly necessary cookies to keep you signed in and secure (session, CSRF token, authentication refresh, and a device identifier that lasts 400 days and is used to prevent fraud), plus your language choice and your privacy choices, stored locally in your browser. Cloudflare, which protects the site, may set technical security cookies, including those of the Turnstile bot check at sign-up, at sign-in, on pre-save pages and on the site’s forms when a submission looks suspicious.

Product analytics (PostHog, in the EU region) only loads if you accept it, and keeps its identifier in your browser’s local storage. Navigation recordings need a separate permission. The Google Ads tag only loads if you accept Advertising: it may set Google cookies to tell whether an ad led to an account being created, without ad personalisation. Without that permission, there are no advertising pixels. You can change these choices whenever you like in Privacy preferences, on this page, or in Settings → Account. If we add anything else that needs your consent, you will see a clear notice before it loads, and this section will list it with its purpose and retention period.

Encryption

TLS in transit and encryption at rest; uploads use presigned URLs so files do not pass through our API.

Authentication

passwords protected with a modern algorithm, and HttpOnly refresh cookies.

Access control

role-based access inside the company, with sensitive actions logged.

Breach notification

where required, within 72 hours to the supervisory authority and, when the risk is high, to you.

Distroline is not intended for anyone under 18. We do not knowingly collect data from anyone under that age; if you think a minor has given us data, contact us and we will remove it.

We update this page when our practices change and revise the "Updated" date above. Material changes (new categories of recipient, new purposes or longer retention periods) trigger an email to active accounts at least 14 days in advance.

For any privacy question, including access or erasure requests:

Chiado Music Group EOOD
17A Vrabcha St, fl. 1, ap. 3, 1000 Sofia, Bulgaria
UIC 208642770
privacidade@distroline.com