Privacy Policy

Who we are

Music Idol AI is operated by Piña Tropical LLC ("we," "us"), a New Mexico limited liability company. For privacy matters, including data access, correction, and deletion requests, write to rules@musicidol.ai, or:

What we collect

We collect three categories of data:

• Account data. Email address, display name, optional profile fields, and the authentication token from Google sign-in if you use it. We use Better Auth for authentication and never store raw passwords.
• Submission data. Audio file, title, artist handle and name, optional cover art, optional genre, and the duration we read from the file. The audio is stored on Cloudflare R2.
• Voting and operational data. Each vote is associated with a salted hash (a fingerprint) derived from your IP, browser user-agent, and the round identifier (not your raw IP or user-agent), plus your account ID if you're signed in. We also keep standard server logs (IP, user-agent, timestamps) for security and abuse prevention.

How we use it

• To operate the competition. Authenticate you, host your music, count votes, settle rounds, score finalists, and disburse prizes.
• For fraud prevention. Vote fingerprints, IP rate-limiting, and server logs help us detect botnets, brigading, and account-creation fraud. The fingerprint is a one-way hash; we cannot reverse it back to your raw IP.
• For marketing and editorial. Public artist and song metadata appears on the platform, in season recaps, podium reveals, and other content covered by the license you grant when submitting (see /rules §6). We do not surface your email address publicly.
• For AI model training and evaluation. Submitted audio, cover art, and metadata may be used to train, fine-tune, evaluate, and benchmark AI/ML models, including generative-audio models, AI judging models, audio-classification models, and music-information-retrieval systems, operated by us, our affiliates, or third-party partners. Model outputs are the property of the model developer and are not your track. The full grant is in /rules §6.1.
• For tax and legal compliance. If you win a prize, we collect the tax forms required by U.S. law (W-9 for U.S. winners; W-8BEN for foreign winners) and report the prize on the appropriate IRS form (1099-MISC or 1042-S). Bank details collected for wire payment are used solely to disburse the prize.

Legal bases (GDPR / UK GDPR)

If you are in the EU, the UK, or another GDPR-aligned jurisdiction:

• Performance of a contract (Art. 6(1)(b)): the competition itself: submissions, voting, judging, prize disbursement.
• Legitimate interests (Art. 6(1)(f)): security, fraud prevention, server logs, anti-brigading measures, and AI model training and evaluation.
• Consent (Art. 6(1)(a)): optional marketing emails where applicable. Consent can be withdrawn at any time.

Who we share with

We share data only with vendors and service providers operating on our behalf under confidentiality obligations: Cloudflare (hosting, R2 audio storage, CDN), Neon (Postgres database), Google (sign-in), Modal (judge pipeline compute), and the AI services that analyse your audio (currently ACRCloud for recording identification, ElevenLabs for transcription, and Google Gemini for judge inference). We do not sell your personal information. We will share data with law enforcement only where legally required.

How long we keep it

• Account data: while your account exists; deleted on request (subject to legal retention requirements).
• Submitted tracks and metadata: indefinitely, for season-archive and historical purposes (see /rules §6.2).
• Vote fingerprints: hashed and retained for the duration of the active competition, then deleted within thirty (30) days of the season's Finale, unless a fraud investigation requires retention. See /rules §12.2.
• Server logs: rotated on a 90-day window unless an incident requires longer retention.
• Tax records: retained for the period required by applicable tax law (typically seven years in the U.S.).

Cookies and similar technologies

We use minimal cookies, primarily for authentication (the Better Auth session cookie) and optional preferences. We do not use third-party advertising or behavioural-tracking cookies.

Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict the processing of, or port your personal data, and to object to processing based on legitimate interests. To exercise any of these rights, write to rules@musicidol.ai. We respond to substantive requests within 30 days. EU/UK residents also have the right to lodge a complaint with their local supervisory authority. California residents have equivalent rights under the CCPA/CPRA, including the right to know, the right to delete, and the right to opt out of "sale or sharing." We do not sell or share personal information for cross-context behavioural advertising.

International transfers

Our infrastructure runs primarily in U.S. AWS regions (via Neon) and on Cloudflare's global edge. If you submit from outside the U.S., your data is transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses and equivalent transfer mechanisms with our processors.

Children

Music Idol AI is not directed at, and not intended for, anyone under 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, write to rules@musicidol.ai and we will delete it.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the latest revision. Material changes will be announced on the platform.