Legal

Privacy Policy

Last updated: June 2026

Discover ("we", "us", "our") is operated by MEXA LLC, a company registered in the United States. This Privacy Policy explains how we collect, use, and protect personal data when you interact with our platform at discoverxyz.us.

By using our service, you agree to the collection and use of information as described in this policy.

---

1. Who We Are

Discover is a music marketing intelligence platform built for independent artists and record labels. We help labels connect ad spend on Meta (Facebook/Instagram) and TikTok directly to verified Spotify listener data — closing the attribution gap between ad campaigns and real streaming activity.

We are the data controller for personal data collected through this platform. Contact us at info@discoverxyz.us.

2. Data We Collect via Spotify

When you connect your Spotify account through our platform (using Spotify's official OAuth 2.0 authorization), we collect the following data with your explicit consent:

• Email address — to identify you and associate your session with a campaign
• Country — to provide geographic breakdown of listener campaigns
• Spotify account type (Free or Premium) — to segment audience quality for campaign analytics
• Spotify user ID — to deduplicate listener records and execute pre-saves on your behalf
• Recently played tracks (up to 50) — stored to attribute ad spend to real streaming activity and verify active listener behavior
• Library and following status — to execute pre-save campaigns (saving tracks to your library and following artists) when you authorize a pre-save action

We only access the Spotify data you explicitly authorize. We do not access your Spotify payment information, playlists (unless you authorize a pre-save to a specific playlist), or private listening sessions.

3. How We Use Your Data

We use the data collected to:

• Attribute advertising campaigns to verified Spotify listener conversions
• Provide artists and labels with audience analytics (countries, account types, listener counts)
• Execute pre-save campaigns on your behalf: saving tracks to your Spotify library and following artists you choose on the release date
• Send Meta (Facebook/Instagram) and TikTok conversion events using privacy-safe, hashed identifiers to improve ad targeting
• Generate aggregated, anonymized reports on campaign performance

We do not sell your personal data. We do not use your data to train AI or machine learning models. We do not share your individually identifiable data with third parties other than as described in Section 4.

4. Third Parties We Share Data With

To operate our service, we work with the following third-party platforms:

• Spotify — OAuth 2.0 authorization. Your Spotify account connection is governed by Spotify's Privacy Policy. We comply with Spotify's Developer Terms of Service.
• Meta (Facebook/Instagram) — We send hashed, anonymized conversion events to Meta's Conversions API (CAPI) to improve campaign measurement. We transmit hashed email addresses and anonymized identifiers, never raw personal data.
• TikTok — We send hashed conversion events to TikTok's Events API for the same purpose as above.
• Neon (PostgreSQL database) — Your data is stored securely in a PostgreSQL database hosted by Neon. Data is encrypted at rest and in transit.
• Vercel — Our platform is hosted on Vercel's infrastructure. Traffic passes through Vercel's servers in the United States.

4b. WhatsApp Assistant Service

We operate an opt-in WhatsApp assistant that lets registered artists and students of Discover XYZ query their own information (releases, performance) or our educational content. This is a response-only service: we never send you unsolicited or marketing messages. You are only ever contacted after you write to us first, and only if your number has been registered by our team.

• What we process: your phone number (to recognize you and scope your access) and the content of the messages you exchange with the assistant (stored to provide the service, for support, and for security/audit).
• Legal basis: performance of our contract/relationship with you (artists and enrolled students) and your act of initiating the conversation. We do not use this channel for marketing.
• Processor & transfers: messages are delivered through the WhatsApp Business Platform, operated by Meta Platforms Ireland Ltd. as our processor; data may be transferred to the United States under the EU–U.S. Data Privacy Framework and Standard Contractual Clauses.
• Opting out: reply BAJA (or STOP) at any time to stop the service and have your number removed from the assistant. You may also request deletion at info@discoverxyz.us.

4c. Artist Onboarding & Contractual Data

When an artist requests access to our platform to manage their releases (via our artist access request form), or when we onboard an artist to our roster, we collect and process the personal data that the artist provides for the purposes of identity verification, contracts, royalty payments and music distribution.

• What we process: full legal name, email address, phone number, country, and postal address, together with the artist profile(s) the person requests to manage. This information is provided voluntarily by the artist through our request form, with explicit consent.
• Why we process it: to review and verify account requests, prepare and manage recording/distribution agreements, arrange royalty payments, and communicate about releases. Requests are reviewed manually by our team; submitting a request does not create an account until it is approved.
• Legal basis: performance of a contract (or steps taken at the artist's request prior to entering into a contract), and the artist's explicit consent given when submitting the form. Consent can be withdrawn at any time by contacting us.
• Retention: we keep this data for as long as the artist relationship is active and thereafter only as required to comply with legal, tax and contractual obligations. Requests that are rejected are retained only briefly for record-keeping and then deleted.
• Your rights: you may access, correct or request deletion of this data at any time at info@discoverxyz.us, subject to our legal retention obligations.

5. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data on the following legal bases:

• Consent — you explicitly authorize Spotify OAuth when clicking "Connect with Spotify", and you explicitly consent when submitting the artist access request form. You can withdraw this consent at any time.
• Performance of a contract — onboarding data (name, contact details, address) is processed to prepare and manage contracts, distribution and royalty payments with our artists.
• Legitimate interests — aggregate, anonymized campaign analytics that do not identify individuals.

6. Data Retention

We retain your data for as long as necessary to fulfill the purposes described in this policy, or as required by law. Specifically:

• Spotify listener session data is retained for up to 12 months, to allow artists to compare listener acquisition across release campaigns within a single annual cycle.
• Pre-save records are retained until the pre-save has been executed or the campaign expires.
• You may request deletion of your data at any time by contacting us at info@discoverxyz.us.

7. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Withdraw consent to processing at any time
• Object to processing based on legitimate interests
• Lodge a complaint with a data protection authority (EU/UK users)

To exercise any of these rights, contact us at info@discoverxyz.us. We will respond within 30 days.

8. Cookies and Tracking

We use a session cookie to maintain your authentication state within the dashboard. We do not use third-party tracking cookies on our public-facing pages. UTM parameters from your arrival URL (campaign, source, medium) are stored to attribute your session to a specific ad campaign.

9. Security

We implement industry-standard security practices including HTTPS encryption for all data in transit, encrypted database storage, and JWT-based authentication for our internal dashboard. Spotify refresh tokens are stored in an encrypted-at-rest database (Neon PostgreSQL) and used solely to execute pre-save operations you have authorized.

10. Children

Our service is not directed to individuals under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, contact us immediately at info@discoverxyz.us.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact

For any questions about this Privacy Policy or your data, contact us at:

MEXA LLC — Discover
info@discoverxyz.us
discoverxyz.us