Privacy policy

Last updated 13 October 2026

This policy explains what personal information cadential. collects, why, who we share it with and how long we keep it. We collect the minimum needed to run a licensing platform. We are not in the data business and we never sell personal information.

cadential. is operated by Jack Harrington (sole trader), ABN 78 833 817 685, Victoria, Australia. As a small business we may be exempt from the Privacy Act 1988, but we choose to handle personal information in line with the Australian Privacy Principles anyway, and this policy is how we do that.

1. What we collect

  • Checkout details: your name, email, the entity name you want on the licence, your project name, content category and where the project will be published, and any billing contact you add. Needed to issue a legally valid licence.
  • Payment data: if you pay by card, you enter your card details into a secure payment form provided by Stripe, our payment processor, and they go directly to Stripe. cadential. never sees or stores your card details. Stripe receives your payment details (including any cardholder name and billing details you enter), your email address, the amount and your licence number, and handles them under its own privacy policy. We keep a record of the payment against your licence: the amount, its status and Stripe's payment reference. If you pay an invoice by bank transfer, we record the payment and the reference you quote.
  • Licence records: every licence we issue is kept so it can be verified and re-downloaded (see section 6 for how long). The public verification page for a licence shows the track, use type and status to anyone holding the licence number. The project name, the channel or company name entered at checkout (if any) and the licensee's first name and last initial are shown only to someone who also has the verification code printed on the licence.
  • Licence requests: if you ask for a custom-quote licence, your name, email, company, project, where it will be shown, the term, territory and budget you choose, and your message. Needed to prepare a quote and to ask the artist to approve the use.
  • Abuse protection: when you check out or send a licence request, we keep a scrambled code made from your network address (a keyed hash, never the address itself) to limit repeated attempts and spam, plus the anti-bot puzzle you solved.
  • Sign-in: artists and buyers sign in with a one-time email link. We keep your email address in our sign-in system, and your browser keeps a sign-in session in local storage until you sign out.
  • Optional buyer account: you never need an account to buy. If you make one, we keep your email, anything you choose to add (name, company or channel, what you make and a website or channel link), your saved shortlist, your email preference with when, where and in what words you gave it, and a short history of account actions (signing up, saving tracks, changing preferences, linking earlier purchases made with the same email). We don't record the pages you view or what you search for.
  • Artist applications and onboarding: your name, email, links to your music and information about your catalogue. To prepare your agreement and pricing we also gather publicly available information about your music, such as streaming numbers, releases and labels.
  • Artist payout details: your legal name, address, ABN and GST status if you give them, and the account name, BSB and account number for payouts (the BSB and account number are stored encrypted). If you are paid through Stripe Connect, you give your identity and bank details to Stripe directly for its verification checks. Used only to pay you and to handle tax on your payouts.
  • Signature records: when an artist signs an agreement electronically, we record the typed name, the time, IP address, browser user-agent, the consent to sign electronically and a fingerprint of the signed text.
  • Artists we contact about joining: if we email you about listing your music, we got your name, public contact email and public profile details (for example genre, location, releases and links) from public sources such as Bandcamp, Spotify, Apple Music, MusicBrainz, triple j Unearthed and your own website or social profiles. We record where the address came from, what we sent and any reply.
  • Messages: emails you send us, and comments or change requests you leave in the artist portal or on your agreement.
  • Basic analytics: see section 4. No advertising trackers, no data brokers.

You can browse the catalogue without telling us who you are. We can't issue a licence or pay an artist anonymously, because the licence and the payout have to name a real person or business.

2. How we use it

To issue and deliver licences, take payments, pay artists, verify licences when asked, respond to support requests, contact artists about joining, and operate and secure the platform. We do not sell personal information. The artist is the licensor on your licence, so they receive your name, the entity on the licence, your project details and the licence details, for their records, their payout statements and, where your content category needs it, their review of your use. If you send a licence request, the artist also receives the project details you give us, so they can decide whether to approve it. If you make an optional account, we use your profile to understand who uses cadential. and what music suits them. We only send you marketing email if you tick the box that says "Email me new music and offers".

Automated decisions

Our pricing engine is a computer program that recommends prices without a person deciding each one. It recommends a price for each artist's songs (what the artist receives per sale), using publicly available information about the artist and their music, such as streaming numbers and release dates, published market rates, and anonymous totals of how buyers respond on cadential. These prices significantly affect what artists earn. Artists set their own prices: an artist can follow our recommendation or set their own price at any time, we never change a price the artist sets, every change to a recommended price is capped and shown in the artist portal, and an artist can ask us at any time to have a person review a recommendation. Buyers are not priced individually: every buyer sees the same price for the same track and use, and the engine does not use a buyer's personal information. The only buyer-specific change is the welcome offer described in our Terms of Service, which checks whether you have an account on our email list and have not bought a licence before. Our abuse protection also decides automatically when a network has made too many checkout or request attempts in a short time; if that blocks you, email us and a person will help.

3. Who we share it with, including overseas

The artist whose music you license or ask aboutreceives your name, the entity on the licence, your project details and the licence or request details (see section 2). Artists may live outside Australia, for example in the United States, so this information can go to the country where the artist lives.

We use these service providers to run cadential. Each only gets what it needs for its job, and several store or process data outside Australia:

  • Supabase (database, sign-in, file storage and server functions, on Amazon Web Services): all of the information above. Stored in Mumbai, India (we plan to move to Sydney); Supabase is a United States company and may access it from the US and other countries.
  • Stripe (card payments, refunds, and artist payouts through Stripe Connect, including identity checks): payment details, email, amount, licence number; for artists, identity and bank details. Australia and the United States.
  • Vercel (website hosting and cookieless web analytics): your IP address and browser details when you visit, as with any website host. United States and a global network.
  • Resend (email delivery): recipient address and the content of emails we send, such as licence confirmations and invitations. United States.
  • Google (our email mailbox, and the web fonts on this site): emails to and from us; when a page loads its fonts, Google receives your IP address. United States.
  • Music data services (Spotify, Apple, MusicBrainz): only an artist's public name, as a search query, when we research a catalogue.
  • Zernio (scheduling our own social media posts and replies to comments on them): public handles and comments on our own posts. Spain (European Union).
  • Automation and AI tools: we run email triage and reporting on an automation server operated by Urban Media (a separate business owned by our founder), and use AI assistants (Anthropic's Claude, and Kie.ai for marketing images) to help draft replies and content. These may receive the contents of emails sent to us and artist or prospect contact details. United States.

We don't give these providers permission to use your information for their own purposes, beyond what their own privacy terms allow for providing the service. We may also disclose information where the law requires it.

4. Cookies and analytics

We don't use advertising, tracking or social media cookies, so there is no cookie banner to click through. What does run:

  • Track counters: aggregate, anonymous counts of track page views, preview plays, licence clicks, checkout starts, the site a visitor came from, and search terms that led to a track. We store the date and the track only. No cookies, IP address or user id, and artists see only totals.
  • Vercel Web Analytics: cookieless page-view counts. We strip query strings and contract-signing links from what it receives.
  • Anonymous visitor counts: so we can see how many people visit and how many watch our founder video or apply, the site records page views, video progress and button clicks with the page path (no query string), a short campaign tag from the link (such as "email"), the referring site's name, your country and whether you are on a phone or computer. No cookies are used. To count unique visitors we combine your network address and browser details with a random code that changes every day and keep only the scrambled result; the daily code is deleted after 2 days, so visits on different days can't be linked to each other or to you. We never store your IP address or browser details.
  • None of these run when your browser sends Do Not Track or Global Privacy Control.
  • Essential storage only: if you sign in, your session is kept in your browser's local storage. On the checkout page, Stripe sets its own fraud-prevention cookies when you pay by card.

5. Email

We use your email to contact you about your purchase, invoicing, payment confirmation, your agreement and anything else it relates to. Every outreach or marketing email we send says who sent it and has a working unsubscribe link, and you can also just reply "unsubscribe". We act on it straight away (the law allows 5 business days) and keep your address on a suppression list so we don't email you again. Emails about something you have bought or signed still come through. Marketing emails about new music and offers go only to people who ticked the unticked "Email me new music and offers" box; you can change that in your account at any time, and unsubscribing from any email also turns it off.

6. How long we keep it

  • Licences, invoices, payment and refund records, artist payouts, and signed artist agreements with their signature records: 7 years after the sale or after the agreement ends, because tax and contract law require us to keep them. After that a buyer's personal details on a licence are anonymised.
  • Artist profile and catalogue: while you are listed on cadential., then removed, except the records above.
  • Sign-in account, waitlist, applications, licence requests, outreach records and messages: until they are no longer needed or you ask us to delete them. The scrambled network code on a licence request is cleared after 30 days.
  • Optional buyer account: your profile, shortlist, email preference and account history are kept while you have the account and deleted with it. Your licences follow the 7 year rule above.
  • Abuse protection records: deleted automatically, normally within 2 days (checkout attempts) or 1 day (anti-bot puzzles).
  • Suppression list: kept, so that we don't contact you again after you've unsubscribed or asked us to delete your details. It holds only your email address and the reason.
  • Analytics: track counter events are rolled up into daily totals within a day. Anonymous visitor counts are deleted automatically after 400 days.

7. Security and data breaches

Data is stored with our service providers using encryption in transit and at rest. Bank account numbers are additionally encrypted by us, and access is restricted to the people who run cadential. If a data breach is likely to cause serious harm to anyone, we will tell the people affected and the Office of the Australian Information Commissioner as quickly as we can, what happened, and what they can do.

8. Your rights: access, correction and deletion

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email hello@usecadential.com from the address we have for you (or tell us how else to confirm it's you). It's free, and we'll respond within 30 days. If you have an account, you can also download your account data and ask for a full copy or for deletion from your account page. A copy comes as a readable file of everything linked to your email address. When we delete your details, we keep only the records in section 6 that the law requires, and your address on the suppression list. If we can't do something you ask, we'll tell you why.

If you're not happy with how we handle a privacy request or complaint, tell us first and we'll try to fix it. You can also complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Australian law also gives individuals a right to sue for a serious invasion of privacy (a statutory tort, in the Privacy Act 1988 since June 2025). Nothing in this policy limits any right you have under it.

9. Children

cadential. is for adults and businesses. You need to be 18 or over to sign an artist agreement, and 18 or over (or have a parent's or guardian's permission) to buy a licence. We don't knowingly collect information from children; if you think we have, tell us and we'll delete it.

10. Changes

We'll update this policy when what we do changes, and show the date at the top.

Contact

Privacy questions and requests: hello@usecadential.com