Legal
Privacy Policy
Last updated: 5 November 2026
This policy explains what WALDHORN AI INC collects when you use WALDHORN.AI, why we collect it, how long we keep it, and the control you have over it. Plain English comes first; the detail follows.
What this means for you
- We are the controller. You can reach us about any of this through the contact form, and if you are in the EEA or the UK you can complain to your regulator.
- Your documents are processed to answer your request. They are not sold, and not used to train models unless you explicitly opt in.
- An AI subprocessor reads the document. The call is made from our servers, never from your browser, through the Vercel AI Gateway. The AI providers do not train on your content, and the processor is listed on the Subprocessors page.
- You can take it or delete it at any time. Export or erase your account data from your profile, without asking us first.
Who we are
WALDHORN.AI is a workspace for the music business operated by WALDHORN AI INC ("WALDHORN", "we", "us"). For the purposes of the EU and UK GDPR, we are the data controller of the personal data described here. You can reach us through our contact form or at hello@waldhorn.ai.
Information we collect
Information you provide
- Account details. Your name and email address when you register, including through Google sign-in.
- Contracts and documents. The agreements you generate, upload, review, negotiate, sign, or audit, and the information you enter into intake forms.
- Catalog, lyrics and project records. The tracks, releases, splits, lyrics, release plans, tours, calendar entries and team members you add, the files you attach to them, and the details you enter about the people involved, such as collaborators you list on a split.
- Contacts you save about other people. When you save a contact, you give us that person or company’s details: names, email addresses, phone numbers, a postal address, and industry identifiers such as a collecting society or IPI number. We hold this to help you draft, send and keep track of agreements with them. We do not market to your contacts, sell them, or use them to build a profile of anyone. Email addresses, phone numbers and postal addresses on a contact are encrypted while stored. If you are in the EEA or UK and you save contacts about other people, you are responsible for having a lawful basis to do so.
- Payment information. When you buy credits or subscribe, our payment processor collects your card details. We receive confirmation and billing metadata, not your full card number.
- Support and communications. Messages you send us and enterprise enquiries.
Information we collect automatically
- Usage and device data. Basic, largely aggregate information about how the service is used, to keep it reliable and secure. With your permission, Google Analytics measures visits to our public website. We exclude private workspace pages, documents, signing links, and URL query strings and fragments. We do not enable Google advertising features. You can withdraw permission in our Cookie Policy.
- Cookies. A minimal set described in our Cookie Policy.
How we use information
- To provide the service: generate, review, negotiate, sign, and audit your contracts, and keep your catalog, releases, lyrics, tours and calendar in order.
- To process payments and manage your account and credits.
- To send transactional messages such as signing links, receipts, and notifications.
- To secure the service, prevent fraud and abuse, and debug problems.
- To improve the service and develop new features.
- To meet legal, tax, and accounting obligations.
- To write, one person at a time, to people in the music business about working with us. See If we wrote to you.
- To invite people we have met, in person or by a one-time link, to try the service. See If we invited you in person.
We do not sell your personal data, and we do not use the contents of your contracts to advertise to you.
How AI processing works
AI analysis is the core of the service. To draft an agreement, read a clause, audit a statement, or format a track's lyrics for the streaming stores, we send the relevant content, through the Vercel AI Gateway, to third-party AI model providers so they can produce the output you request. These calls are made from our servers, not from your browser.
We do not use your content to train AI models unless you explicitly opt in, and the AI providers we use do not train their models on it. Provider terms are set out in their own documentation and may change; the processor we rely on is listed on our Subprocessors page. WALDHORN.AI is a tool, not a law firm, and its output is not legal advice.
Legal bases
For users in the EU, the UK, and comparable jurisdictions, we rely on the following legal bases:
- Performance of a contract. To provide the service you sign up for.
- Legitimate interests. To secure, maintain, and improve the service, balanced against your rights.
- Consent. Where we ask for it, such as certain optional communications. You can withdraw consent at any time.
- Legal obligation. To comply with tax, accounting, and other laws.
International transfers
Our service and subprocessors operate primarily in the United States, so your information may be processed there and in other countries. Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
Data retention
We keep your account, contract and catalog data for as long as your account is active so the service works as you expect. When you delete content or your account, we delete or anonymize the associated personal data, except where we must keep certain records to meet legal, tax, or security obligations.
| Record | Kept for | Why |
|---|---|---|
| Account, contract and catalog data | While your account is active | To run the service you asked for. |
| Contacts you saved | Until you delete them, or your account | Yours to keep and yours to erase. Deleting a contact removes it and its details outright. It does not alter an executed agreement that party already signed, which is covered by the audit-trail row below. |
| Security events | 30 days | A short-lived operational signal for abuse and health. |
| Audit trail | Seven years | Evidence that a document was signed and by whom. Append-only, and a carve-out to erasure: we cannot delete the proof that a contract was executed. |
| Billing records | As tax law requires | A statutory obligation we cannot waive. |
| An address on a shared project link | Until you stop the emails, or the link is closed or deleted | An address nobody confirms is forgotten after a week. See If you asked for project updates. |
| A letter we wrote you that led nowhere | Twelve months | No click and no reply: the record of it is deleted automatically. See If we wrote to you. |
| Our do-not-contact list | For as long as we send those letters | It is what keeps an unsubscribe or a “no thanks” honoured. |
Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, export, restrict, or object to our use of your personal data, and to withdraw consent. You can export or delete your account data at any time from your profile, send us a data request, or write to us at hello@waldhorn.ai. If you are in the EEA or UK, you also have the right to complain to your local supervisory authority.
If someone else saved you as a contact
A customer of ours may hold your details in their Contacts. Those details are theirs to correct or erase, so the fastest route is to ask them directly. You can also write to us at hello@waldhorn.ai and we will pass the request on, and act on it ourselves where we are required to. One limit we state plainly: if you signed an agreement through this service, the evidence that you signed it is kept even after a contact record is deleted, because every party to that agreement needs to be able to prove it was genuinely executed.
If we wrote to you about working together
Now and then, one person at a time, WALDHORN.AI writes to music lawyers, managers, booking agents and label owners whose work involves music contracts, with up to two short follow-ups if there is no answer. Those letters use your name, your business email address and your company, taken from a public professional source such as your firm’s website or a trade directory. We do not print where we found your address in the letter. We keep it with your record: ask and we will tell you.
The legal basis is our legitimate interest in telling a business contact about a service relevant to their work (Art. 6(1)(f) GDPR). The record we keep is short: when each letter went, whether a link in it was followed (with the time and the browser that followed it), and whether you replied. Beside it we keep what we need to write to the right people: your name, your company, your job title and the city and country you work in, as we found them or as you told us, and what kind of work you do. Where we have been given them in person, or found them on your own professional pages, we may also keep other ways to reach you, such as a phone number, a website, a professional profile or a business address. Our email provider delivers the letters, and it is listed on our Subprocessors page.
A letter may carry a personal invitation to try the service. We record when it was opened and accepted and, if you accept, keep a one-way fingerprint of your address so that each person has one partner week; the account you open is then an ordinary account under this policy.
Now and then, to people whose business address we already hold, we may also send a short letter to a group about a meeting, news or an offer in their area. Each of those letters says why you are receiving it, and rests on the same legitimate interest. Where we found your address is kept with your record, and we tell you if you ask. If one invites you to an event and you answer Yes, No or Maybe, we record your answer and when you gave it, so that we can plan the event. We keep when such a letter went, whether a link in it was followed and your answer, beside your entry, and remove them when your entry is removed.
You can object at any time. Use the unsubscribe link in any letter, or reply “no thanks”, and nothing more is sent. Your address then stays on a do-not-contact list for as long as we send these letters, because that list is what keeps your “no” honoured. When you object, we delete your name, company, job title and place from our records and keep only your address on that list and a note that you asked us to stop. The record of a letter that led nowhere, and what we kept beside it, is deleted after twelve months. Your other rights, above, apply to these records too.
If we invited you in person or by a link
Now and then a member of our team shows a QR code on their phone, or sends a one-time link, to someone they have met, so that person can try WALDHORN.AI. If you follow one, you give us your first name, last name and email address, and we email you a six-digit code. Your account is opened only once you type that code, so nobody can open one on an address that is not theirs.
The gift is some credits and a few days of a higher plan, and it ends by itself. The record we keep is short: your name and email address, when you joined, which event or link you came through, and what you were offered. The person who invited you may also keep a private note about you: your city, your role in the industry, where you met, and a line of their own. The note is used to follow up with you and is kept within our team.
The legal basis for the account is providing the service you asked for, and for the note our legitimate interest in following up with someone we invited (Art. 6(1)(f) GDPR). We also keep a one-way fingerprint of your address so that each person is given one gift, however they come to us. You can ask us at any time to delete your notes, and your other rights, above, apply to these records too. The account you open is an ordinary account under this policy.
If you asked for updates on a shared project
A WALDHORN.AI customer can share a project’s release plan by link. Anyone with that link can enter an email address to receive updates about the project. If that was you, or if someone entered your address, this is what happens. We email you once, only to ask you to confirm, and that email carries nothing the customer wrote. Nothing else is sent unless you confirm, and a request nobody confirms is forgotten after a week.
Once you confirm, we email you when a release day, a pre-order, an exclusive or a store changes, when a release is added or taken out, or when the release team answers a suggestion made through the link, at most one email a day. Every email carries a link that stops them, and stopping removes your address. The customer who shared the project can see the addresses on their link and whether each has confirmed, and can remove them. Closing or deleting the link removes its addresses, and a link holds at most five.
What we keep is short: your email address, when it was first entered, when we asked you to confirm and how many times, and when you confirmed. It is kept encrypted with the link. The legal basis is your consent, given by confirming (Art. 6(1)(a) GDPR), and you can withdraw it at any time with the stop link. Our email provider delivers these emails and is listed on our Subprocessors page. Your other rights, above, apply to these records too.
Security
We protect your data with encryption in transit (HTTPS and HSTS), role-based access on a least-privilege basis, and an incident-response process. No system is perfectly secure, but we treat the confidentiality of your contracts as central to the product. See our Trust center for more.
Children
WALDHORN.AI is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us information, contact us and we will remove it.
Changes to this policy
We may update this policy as the service and the law evolve. When we make material changes, we will update the date above and, where appropriate, notify you.
Contact us
Questions about privacy or a request about your data can be sent through the contact form, or to hello@waldhorn.ai, addressed to WALDHORN AI INC.