Mercury Music Systems ("Mercury", "we", "us") builds infrastructure for independent artists, producers, and labels. This policy explains what data we collect, why we collect it, how we store it, and the rights you have over it.
1. Scope
This policy covers the Mercury web application, marketing site, and any files or metadata you upload while signed in. It does not cover third-party services you connect (such as your streaming distributor), which have their own privacy terms.
2. Data we collect
Account data
- Name, email address, and hashed password (or OAuth identifier if you sign in with Google/Apple).
- Profile details you choose to add: artist name, role, city, links.
Product data
- Music metadata you upload (titles, credits, BPM, genre, ISRC/UPC, artwork).
- Royalty CSV reports you import from DSPs and the normalised rows we generate from them.
- Split sheets, contracts, licences, and other documents produced inside Mercury.
- Collaborator invitations, signatures, and audit-trail timestamps.
Technical data
- Standard request logs (IP, user agent, timestamps) retained for 30 days for abuse prevention.
- Privacy-preserving product analytics (which pages/features are used) — no cross-site tracking.
3. How we use it
- To operate the product features you use.
- To secure your account and prevent fraud.
- To email you about your account, releases, or product changes (marketing emails are opt-in and unsubscribable).
- To improve the product in aggregate — never to build a profile that is sold or shared.
4. What we never do
- Sell your data to any third party.
- Share your earnings, splits, contracts, or fan email lists.
- Take ownership of your masters, compositions, or publishing rights.
- Use your content to train third-party AI models.
5. Where your data lives
Data is stored per-user with row-level security in an isolated database. Only you and the specific collaborators you invite can read a given row. Backups are encrypted at rest. Files are stored in region-scoped object storage.
6. Retention
We retain your data for as long as your account is active. When you delete your account, we hard-delete personal data within 30 days, except where retention is required by law (invoices, tax records).
7. Your rights
- Access: export everything you have added as CSV, PDF, or JSON.
- Correction: edit or overwrite any profile field at any time.
- Deletion: delete individual items or your entire account from settings.
- Portability: everything you put in comes back out in an open format.
- Objection: opt out of marketing emails and product analytics from settings.
8. Sub-processors
We use a small number of well-known infrastructure providers (hosting, database, email, analytics). We keep the list short and public — email us if you need the current version for a compliance review.
9. Children
Mercury is not directed to anyone under 16. Do not create an account if you are below the age of digital consent in your jurisdiction.
10. Changes to this policy
Material changes are announced by email at least 30 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.
11. Contact
Questions or requests: privacy@mercury.fm.