Privacy Policy

Effective from 20 September 2026 — staging validation value.

Who is responsible

MAYA LABS, Not published in this test environment; contact the operator by email., registered under RCS Paris 106 090 699, is the controller of the personal data described here. Contact: contact@maya-labs.xyz.

What we collect

Account. Your email address, the date you joined, and the public part of the passkey credential your device creates. We never receive your biometric data — your device keeps it and only tells us that it verified you.

Account activity. The time you last signed in and the time you were last active, which we record at most about once an hour while you use the service. We keep these only to administer accounts: for example, to tell a dormant account from an abandoned sign-up, or to investigate abuse. Operators see your last activity to the day only. When an operator opens your account record, or suspends or closes your account, we log who did it, when, and (for a restriction) the reason category. That log never contains the operator's free-text notes.

Optional email address for notices. You can add an email address in Settings so that we also send you the platform notices that are shown in the app (for example a change to the terms, or a statement of reasons when an operator acts on your account). Your account does not need an email address; this one is optional, is used only for those notices and never for marketing, and receives nothing until you confirm it from a link we send to it. It is never used to sign in or to recover your account. Because your account is linked to your wallet, adding an address connects it, in our records only, to your account and so to your wallet's on-chain activity. We never publish it or put it on-chain, operators do not see it in the account directory, and removing it deletes it. You can turn off the optional categories (policy, incident, moderation and refund notices), change the address or remove it at any time. Terms and account notices are always sent to a confirmed address, and you can remove the address if you do not want them by email. We keep a log of the notice emails sent to you (category, status and dates, not the text) for 180 days to run delivery and fix problems. If your mail provider reports the address as bounced or as a complaint, we stop sending to it and tell you in the app.

Wallet. Your smart account address and the on-chain activity associated with it. See "What we cannot delete" below, because this is the part that is permanent.

What you do on Resonate. Playback, skips, saves, artist follows, playlists, searches, recommendations shown and chosen, purchases, pledges, collects, uploads, generations and remix sessions. Every such event records a privacy tier, and events in the personal and sensitive tiers must also record the legal basis they were collected under — the system rejects them otherwise. Events in the pseudonymous tier may not carry one, and lineage references are recorded where the emitting system supplies them rather than always.

Behaviour events are keyed to a pseudonymous actor identifier, derived with a secret salt, rather than to your email. Artists see aggregate audience figures; they never see your identifier or your raw activity.

Optional pledge city demand. If you choose to share a city when pledging and agree to the current usage-measurement wording, we keep that city and country for aggregate artist demand insights. We do not infer your location from your IP address, wallet or the campaign’s city. The declaration is kept separately from payment history, expires after 28 days, is included in your personal-data export, and is deleted when you refuse usage measurement or erase your account. Artists receive only totals above the audience threshold.

Content you create. Uploads, community posts and messages, disputes you raise, and the metadata attached to them.

Payments and settlement. Amounts, assets, counterparties, settlement status and the transaction references needed to prove that money moved correctly.

Support. Whatever you send us when you contact us.

We do not store prompts, notification bodies, payment proofs, private wallet material, exact IP addresses, or user-agent strings in analytics.

Why, and on what basis

⚖ Jurisdiction-specific. The lawful-basis framing below is European. The standard for valid consent, and whether any of this processing needs consent at all, is set by the operator's own law.

Where we rely on consent you can withdraw it at any time, and doing so is as easy as giving it. Withdrawing consent does not affect processing that already happened, and it does not switch off the operational, security, payment and rights events we must keep.

Optional product analytics are collected only after an explicit choice. No answer is treated as refusal. The browser suppresses optional events before sending them and the authenticated ingest routes independently refuse them unless the current consent version is granted. You can change the choice at any time in Settings under Privacy; turning it off stops future optional collection and applies the withdrawal policy to previously consented events.

Your controls

Your rights do not depend on a button existing. Whatever the product offers at any moment, you can exercise every right below by writing to contact@maya-labs.xyz.

As of 20 September 2026 — staging validation value:

Each row must be re-checked against the product on the day this ships and whenever a control becomes available. A privacy policy that claims a control the product does not have is a false statement, not an aspiration.

How long we keep things

⚖ Jurisdiction-specific. The retention of financial, rights and tax records is set by the operator's accounting and tax obligations. The software makes these configurable; the numbers below are the reference deployment's defaults, not a legal floor that transfers.

Account data is kept while your account exists, then deleted as described below.

When you delete

A deletion request writes a record that the deletion was asked for, and then removes or redacts the analytics rows linked to the identifier it is given. Financial and audit records are redacted rather than deleted, as described below.

When you ask us to delete your account, we resolve you to every identifier your data is held under — not just your account id, but the wallet addresses, the artist profile and the pseudonymous identifier your activity is recorded against — and record the request. Nothing happens for 30 days, and signing in during that time cancels it.

After that we remove or redact your data across the primary store, the analytics warehouse and the facts derived from it, keep aggregates only where they remain anonymous, and read the deletion record on every later rebuild so deleted rows do not come back. Your account id is replaced, because for a wallet account that id is your wallet address. If you released music, it stops streaming; people who bought something from you keep it.

Financial and audit records are redacted rather than deleted. We keep what accounting, rights and tax law require us to keep — the fact, the date, the amount, the status — with personal fields minimised.

What we cannot delete

Two parts of Resonate are permanent and public, and no request to us can change that:

• The blockchain. Transactions on Base — pledges, purchases, settlements, mints — are public, permanent, and outside anyone's control, including ours. Your wallet address and its history stay visible.
• IPFS. Content published to IPFS is addressed by its contents and may be stored by anyone. We can stop serving it; we cannot make other people forget it.

Consider this before publishing anything you may later want withdrawn.

Who else processes your data

We use service providers who process data on our instructions. At publication this list will name each provider, what it does, and where it processes: cloud infrastructure and the data warehouse, AI generation and analysis, the account-abstraction bundler and smart-account infrastructure, IPFS storage, human-verification, audio processing, and observability tooling.

Some are established outside the European Economic Area. Where that is so, transfers rely on the European Commission's standard contractual clauses or another lawful mechanism, and the list will say which.

Artists receive aggregate statistics about their own catalogue and audience. They do not receive your identity or your raw activity.

Your rights

You have the right to ask us for access to your data, correction, erasure, restriction and portability, and to object to processing based on legitimate interests. You can withdraw consent at any time. Write to contact@maya-labs.xyz. Where a self-service control exists you can also use it — see the table above for which ones are live.

You can also complain to your data protection authority. In the operator's jurisdiction that is CNIL.

Automated decisions

Recommendations, discovery ranking and AI DJ selections are automated. They decide what you are offered, not anything with a legal or similarly significant effect on you.

Taste memory controls — resetting it, hiding individual signals — are partly available today, and social taste matching stays off unless you turn it on. Turning off product analytics stops future optional analytics collection; it does not remove operational records or independently chosen taste settings.

Children

Resonate is not for people under 18 — staging validation value. We are obliged to delete data we hold about someone below that age. Reports can be sent to contact@maya-labs.xyz.

Changes

Changes are posted here with a new effective date. An operator must not make a change that legally requires direct notice until it has a channel capable of delivering that notice.