- Version: 1.0
- Effective date: October 10, 2026
- Data controller: WAMMUSIC, LLC, a limited liability company organized under the laws of the State of Florida, United States of America (“WAM”)
- Address: 7345 W Sand Lake Road, STE 210, Office 9326, Orlando, FL 32819, USA
- Privacy contact: [email protected]
1. Scope#
This Policy explains how WAM collects, uses, shares, retains and protects personal data when operating its mobile application, its web application (app.wammusic.com), its website (wammusic.com) and related services (the “Platform”). It applies to Artists, Contractors, applicants, representatives and anyone else who interacts with the Platform.
WAM operates internationally. We process data in accordance with this Policy and with the data protection laws applicable based on each person's place of residence, such as the European Union General Data Protection Regulation and its United Kingdom equivalent (GDPR), United States state privacy laws and Latin American data protection laws (for example, Uruguay's Law No. 18,331 or Argentina's Law No. 25,326). Where a local law grants greater protection than this Policy, that law prevails.
2. Controller and contact#
WAMMUSIC, LLC is the controller of the data described in this Policy. For any privacy question or request, write to [email protected]. Formal communications may also be sent to the address above.
3. Data we process#
3.1. Account and authentication#
Name, email address, password (stored only as a hash), role, language, account status, email verification date, verification and password reset codes (stored as hashes), Google or Apple sign-in identifiers when you choose that option, session tokens and creation and update dates.
We also record acceptance of the legal documents: date and time, version of the Terms and Privacy Policy accepted, IP address and user agent.
3.2. Artist profile#
Stage and legal name, profile and cover photo, biography, country, languages, artist category and type, format, genres, instruments, voice type or range, repertoire, unavailable dates, media (photos, audio and video), professional preferences and conditions, whether the Artist has a manager and the manager's contact details, average rating and number of reviews, and the visibility chosen for contact details.
To verify identity and enable contracting, we may also process: identity document number, document type, expiry date, nationality, date of birth, legal address, phone number, images of the front and back of the document and a selfie holding the document. These data are not part of the public profile.
3.3. Contractor profile#
Organization name and type, country, city, phone number, years of activity, productions, team size, the organization's legal documentation, photo or logo, and details of the authorized representative (name, title, phone, email, document type, expiry date, images of the front and back of the document and a selfie holding the document). Where the Contractor provides them, billing details (name, email, address and tax identification). Documents and representative data are not part of the public profile.
3.4. Content and activity#
Photos, videos, audio, favorites, reviews and ratings, calls for artists, applications and in-app notifications.
3.5. Communications#
Chat messages, attachments, delivery and read status, change requests and contract comments, and help or support requests (category, subject, description, status, messages, attachments and history). WAM does not use private conversations for advertising purposes.
3.6. Contracts and signatures#
Proposal and event data, generated or uploaded contracts, versions, comments, approvals, rejections, statuses, PDF files, a cryptographic hash of the contract and signature records. Signature evidence includes the signer's name, image of the handwritten stroke, date and time, role, contract version, IP address, user agent and signature hash.
3.7. Identity verification#
Verification status, submission and review dates, the administrator who decides, the reason for rejection where applicable and, for the public presence search, the information described in section 3.8. The document and selfie are used for a document and visual review carried out by authorized WAM staff. WAM does not use automated document verification or facial recognition systems.
3.8. Public professional presence search#
When an Artist or Contractor submits their profile for verification, WAM automatically runs an internet search to help the review team check that the profile corresponds to a real professional activity:
- Queries are sent to the Microsoft Bing search engine using limited profile data: stage and legal name (Artist) or organization and representative name (Contractor), country, city (Contractor), artist type, genres and instruments, or organization type.
- The public titles, links and snippets obtained are sent, together with the same limited profile data, to the DeepSeek artificial intelligence service, which classifies them and produces a summary. DeepSeek processes and stores data in the People's Republic of China (see section 8).
- WAM retains the queries made, matching sources, warnings, a summary, the date and an indicative match score.
For this search we do not send document images, selfies, document numbers, addresses, phone numbers, emails or tax data. The score does not prove identity or honesty, does not replace human review, and the absence of public results is not in itself a reason for rejection. You can provide context, ask for an incorrect match to be rectified, or object to this processing by writing to [email protected]; in that case verification will be carried out using document and human review only.
3.9. Artificial intelligence: assistant and translation#
- AI assistant: when you choose to use it, the text you write and the history of that conversation are sent to the configured AI provider to generate the response. The current provider is DeepSeek (China); WAM may alternatively use Anthropic (USA). WAM does not store the assistant history in its database.
- Biography translation: when a User views an Artist's profile in a different language, the text of the Artist's public short biography may be sent to DeepSeek to be translated automatically.
Do not enter identity documents, financial data, health information, professional secrets or third-party data that you are not entitled to share into the assistant.
3.10. Device, security and diagnostics#
IP address, user agent, device type and operating system, push notification tokens, audit and administrative action logs, server logs, technical errors and login attempts.
The app stores on your device (or in browser storage, in the web app) session tokens and preferences such as language or whether you have already seen the introduction. These data are necessary for operation and are not used for advertising.
3.11. Payment data#
In this version WAM does not process payments and does not collect card or bank account details. Payments between Artists and Contractors take place outside the Platform. If the parties include financial terms in a contract, those data are processed as part of the contract (section 3.6).
4. Sources of data#
We obtain data directly from you; from your organization or representative; from other Users during an engagement, application, review or conversation; from Google or Apple when you use federated sign-in (name, email and account identifier); automatically from your device and your use of the Platform; and from public internet sources during the professional presence search.
If you provide data about another person (for example, your manager or representative), you confirm that you are authorized to do so and have informed them of this Policy.
5. Purposes and legal bases#
| Purpose | Main data | Legal basis |
|---|---|---|
| Create, authenticate and manage accounts | Account, access and device | Performance of the contract (Terms) |
| Record acceptance of legal documents | Version, date, IP and user agent | Legal obligation and legitimate interest in evidencing consent |
| Display profiles, content and calls for artists | Profile and content | Performance of the contract |
| Facilitate applications, chats and engagements | Profile, communications and contracts | Performance of the contract and pre-contractual steps |
| Generate, version, approve and sign contracts | Contracts, signature and technical evidence | Performance of the contract, consent to electronic signature and defense of rights |
| Verify identity and authority | Email, documents, selfies and profile data | Performance of the contract and legitimate interest in preventing fraud and impersonation; consent where required by law |
| Public professional presence search | Name, organization, location, activity and public sources | Legitimate interest in preventing impersonation, with human review and right to object |
| Send operational notifications and emails | Email, push token and activity | Performance of the contract and legitimate interest |
| Protect the Platform and prevent fraud | IP, audit logs and technical signals | Legitimate interest and legal obligations |
| Handle support, complaints and rights requests | Account, communications and evidence | Performance of the contract and legal obligation |
| Detect and fix errors | Technical diagnostic data | Legitimate interest in quality and security |
| Respond through the AI assistant and translate biographies | Text sent or biography | Performance of the contract (requested feature) and legitimate interest |
Where we rely on legitimate interest, we assess its necessity and proportionality against your rights, and you can object (section 11). We do not use your data for incompatible purposes without informing you and having a legal basis.
6. Mandatory or optional data#
Fields marked as mandatory are necessary to create the account, verify the profile, publish calls for artists or enter into contracts. If you do not provide them, those features may be limited, although you can explore the Platform with an incomplete profile. Optional fields are identified as such.
7. Who we share data with#
- Other Users: your professional profile data and the content you publish are visible to other Users and may be viewed by anyone accessing your profile link; your contact details are shown according to the visibility you choose. When you apply, your profile is shared with the Contractor. In an engagement, the other party accesses the contract and signature data.
- Providers processing data on WAM's behalf:
- OVHcloud (hosting of servers, database and files; servers in the European Union, Italy).
- Google / Firebase Cloud Messaging (push notification delivery; USA) and Google Sign-In (sign-in, if you choose it).
- Apple (Sign in with Apple, if you choose it, and notifications on Apple devices).
- Resend (delivery of operational emails; USA).
- Sentry (server error diagnostics; USA).
- DeepSeek (AI assistant, biography translation and analysis for the public presence search; People's Republic of China).
- Anthropic (alternative AI assistant provider, when configured; USA).
- Microsoft Bing (search engine queried in the public presence search; USA).
- Advisers and authorities: where necessary for professional advice, audit, defense of rights or compliance with a legal obligation or valid request.
- Corporate transactions: a potential acquirer or successor of the business, subject to confidentiality and to its respecting this Policy.
WAM does not sell personal data or share it for cross-context behavioral advertising. We do not display third-party advertising.
8. International transfers#
WAMMUSIC, LLC is a United States company, its main servers are located in the European Union and some providers process data in other countries, so your data may be transferred outside your country of residence, in particular to the United States and the People's Republic of China.
Where required by applicable law, WAM uses valid transfer mechanisms, such as adequacy decisions (including the EU-US Data Privacy Framework for certified providers), standard contractual clauses or other recognized safeguards, and supplementary measures where appropriate.
Transfers to China (DeepSeek): China does not have a European Union adequacy decision nor, in general, one from Latin American authorities. The data sent to DeepSeek are limited to those described in sections 3.8 and 3.9 (assistant text, public short biography and limited profile data with public search results), never documents, selfies, identification numbers, addresses, phone numbers, emails or tax data. You can avoid sending your messages by not using the assistant, and you can object to the public presence search by writing to [email protected].
You can request information about the safeguards applied to each transfer by writing to [email protected].
9. Retention#
We retain data only for as long as necessary for the purposes described, to comply with legal obligations and to defend rights. We apply these criteria:
| Category | Retention criterion |
|---|---|
| Account and profile | While the account is active. After closure they are deleted or anonymized, except for what must be retained under the following rows |
| Identity documents, selfies and verification outcome | While the account is active and they are needed for verification and fraud prevention; deleted after account closure, unless there is a legal obligation or a pending claim |
| Public presence search | Replaced with each new verification and deleted together with the profile |
| Published content | Until you delete it or the account is closed |
| Chats and attachments | While the account and the conversation exist. Attachment files not linked to any message are automatically deleted after 24 hours |
| Contracts, versions and signature evidence | For as long as necessary to evidence the engagement and defend rights, taking applicable limitation periods into account, including after account closure |
| Legal acceptance, audit and security logs | For as long as necessary to evidence consent, investigate incidents and defend rights |
| Session tokens | Automatically deleted on expiry or 30 days after being revoked |
| Push notification tokens | Until you sign out, the token becomes invalid or the account is closed |
| Support | Until the request is resolved and for as long as necessary to handle related claims |
When the criterion is met, data are securely deleted or anonymized, unless they must be retained due to a legal obligation, litigation or investigation. Backups are purged according to their technical cycle and remain protected.
10. Security#
WAM applies technical and organizational measures proportionate to the risk, including encryption in transit (HTTPS), passwords and codes stored as hashes, role-based access control, private storage of documents, contracts, signatures and attachments with authorized access through the API, audit logs and backups.
No system is invulnerable. In the event of a security incident affecting personal data, WAM will investigate, take mitigation measures and notify affected persons and competent authorities where required by law and within the legal deadlines (for example, 72 hours to the supervisory authority under the GDPR).
11. Your rights#
Depending on the law applicable to you, you may request:
- access to your data and a copy of it;
- rectification or updating;
- erasure (deletion);
- objection to processing based on legitimate interest;
- restriction of processing;
- portability of the data you provided to us;
- withdrawal of consent, without affecting the lawfulness of prior processing; and
- not to be subject to decisions based solely on automated processing with legal or similarly significant effects (WAM does not make such decisions; see section 12).
How to exercise them: write to [email protected] from the email address associated with your account, stating the right you wish to exercise. We may ask for reasonable information to verify your identity. We will respond within the period set by applicable law (for example, one month under the GDPR, extendable in complex cases, or any shorter period set by the law of your country). Exercising these rights is free of charge, except for manifestly unfounded or excessive requests where the law allows.
Account deletion: in this version the app does not include a self-service delete button. To delete your account and data, write to [email protected] from the email address associated with the account. We will delete or anonymize your data, except for data we must retain under section 9, and confirm the deletion to you.
Complaints to authorities: if you believe your rights have not been respected, you can lodge a complaint with the data protection authority of your country of residence, place of work or place of the alleged infringement (for example, the supervisory authority of your EU Member State, the UK Information Commissioner's Office or Uruguay's Unidad Reguladora y de Control de Datos Personales). We would appreciate the chance to resolve it first if you contact us.
Additional information for residents of US states#
If you reside in a US state with a comprehensive privacy law (for example, California, Colorado, Connecticut, Virginia or Texas) and that law applies to WAM, you may have the right to know and access your data, correct it, delete it, obtain a portable copy and opt out of the sale of data, its use for targeted advertising or profiling with significant effects. WAM does not sell personal data, does not share it for cross-context behavioral advertising and does not carry out such profiling. You can exercise your rights, directly or through an authorized agent, at [email protected]; if we deny a request, you can appeal by replying to our decision. We will not discriminate against you for exercising your rights.
12. Automated decisions#
WAM sorts and filters search results and generates the indicative public presence score described in section 3.8. No account is approved, rejected or sanctioned solely by automated means: those decisions are made by a person. You can request correction of the information, provide context and challenge the assessment before a person.
Responses from the AI assistant and automatic translations may contain errors and do not replace professional advice.
13. Minors#
WAM is not directed to persons under 18, who must not create accounts or upload their data. If we learn that we are processing a minor's data, we will delete it. You can let us know by writing to [email protected].
14. Device permissions#
The app may request access to the camera, photos, files and notifications solely to upload photos, media or documents, sign, attach files and receive alerts. You can manage permissions from the operating system; some features will stop being available.
15. Website and cookies#
The public website wammusic.com and the web app app.wammusic.com do not use cookies or tracking technologies for advertising or analytics purposes. Only cookies or local storage strictly necessary for operation, security and sign-in may be used, which do not require consent. The servers log technical data of each visit (such as IP address and user agent) for security and operational purposes.
If non-essential cookies are introduced in the future, this Policy will be updated and prior consent will be requested where required by law.
16. Changes to this Policy#
WAM may update this Policy due to legal, provider or feature changes. We will give reasonable advance notice of material changes and request your consent where a new purpose requires it. The header shows the version and effective date; we keep previous versions to evidence what information each User received.
17. Contact#
For questions or to exercise your rights: [email protected]. Postal mail: WAMMUSIC, LLC, 7345 W Sand Lake Road, STE 210, Office 9326, Orlando, FL 32819, USA.
This is the same text shown inside the WAM app. Published on this site on October 7, 2026.