Who we are

Rhune (“Rhune”, “we”, “us”) is the controller responsible for the invite-only artist platform at rhune.co (the “Service”). We are based in the United Kingdom. If you have privacy questions or requests, email hello@rhune.co.

Data we collect

We collect the information needed to set up invites, keep accounts secure, and run the catalogue:

• Invite and account details: the artist name and Spotify link we use to create your profile, the one-time invite token, the email address you choose, and the basic login logs that show when a magic link was used.
• Artist Content: any notes, edits, or other materials you add. If we later support media uploads (photos, audio, etc.) they will fall under this policy too.
• Spotify Metadata: the public catalogue data (artwork, titles, release years, track lists) we import from Spotify to display your work.
• Technical logs: IP address, browser, device type, timestamps, error reports—so we can keep things stable and secure.
• Support messages: emails or other contact you send us.

We do not currently run third-party behavioural analytics or ad trackers. If that changes, we will update this policy and ask for consent where required.

How we use personal data

We use personal data to:

• Authenticate invited artists and keep accounts secure.
• Refresh catalogue pages with Spotify Metadata and power public artist views.
• Store and publish Artist Content, including across future fan or community features.
• Send operational emails such as login links, feature updates, or policy notices.
• Monitor security, prevent abuse, and fix technical issues.
• Comply with legal obligations and enforce our Terms.
• Plan future features, including possible advertising or subscription options.

Legal bases (UK & EU)

Where UK or EU law applies, we rely on:

• Contract – to deliver the Service you signed up for.
• Legitimate interests – to secure the Service, prevent misuse, improve features, and send essential communications.
• Consent – for optional marketing or non-essential cookies/analytics, if we introduce them.
• Legal obligation – when we have to comply with law or lawful requests.

How we share data

We share personal data with a short list of providers who help us run Rhune:

• Render (United States) for hosting and infrastructure.
• Zoho Mail for sending transactional emails.
• Other vendors we may add later, for example analytics, payments, or advertising partners. We will update this policy if the list changes materially.

Each processor is bound by a written agreement requiring them to protect personal data and only act on our instructions.

We may also disclose data if required by law, to protect people’s safety, or to defend our legal rights. We do not sell personal data.

International transfers

Because we use providers outside the UK and EU, personal data may be transferred internationally (for example to the United States). We rely on recognised safeguards such as the UK International Data Transfer Addendum and EU Standard Contractual Clauses, together with the processor agreements noted above, to protect those transfers.

Retention

Account data and Artist Content stay in our systems while your account is active. If you delete your account we remove live content and anonymise or delete associated personal data within 90 days, except where we need to keep it longer for legal, security, or backup reasons (routine backups usually cycle within 180 days). Log data is generally retained for up to 12 months.

Security

We use reasonable safeguards such as TLS encryption in transit, access controls, and least-privilege practices for staff. No system is perfect, so we encourage you to protect your own devices and email accounts too.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or restrict the use of your personal data, to object to certain processing, and to request a portable copy. You can withdraw consent for optional processing at any time. To exercise these rights, email hello@rhune.co. You also have the right to complain to the UK Information Commissioner’s Office or your local regulator.

Cookies and similar tech

Right now we only use essential cookies that keep you signed in. They are required for the Service to function. If we ever add optional cookies (analytics, ads, etc.) we will give you clear notice and obtain consent where needed.

Eligibility

Rhune is for invited artists aged 18 or older. We do not knowingly collect personal data from anyone younger. If you believe someone under 18 has provided personal data, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy when the Service evolves or the law changes. We will notify you of important updates by email, dashboard notice, or another appropriate method. We will date each version so you can see when it last changed. If you continue using the Service after an update takes effect, that means you accept the revised policy.

Contact

Privacy questions or requests? Email hello@rhune.co.