Trackstack Music Limited · Last updated: 2 July 2026
Introduction
This Privacy Notice explains how Trackstack Music Limited (Trackstack, we, us or our) collects, uses, shares and protects personal data when you use the Trackstack platform, website at https://www.trackstack.app/ and our mobile application (together, the Platform), and when you otherwise deal with us. It should be read together with our Terms of Service, which use several of the same defined terms.
Trackstack Music Limited is the controller of the personal data described in this notice, except where this notice says another party is the controller. We are a company registered in England and Wales (company number 13284579) with our registered office at 20-22 Wenlock Road, London, England, N1 7GU.
If you have any questions about this notice or how we handle your data, or you wish to exercise your rights, contact us at support@trackstack.app or by post at the address above.
You have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk, though we would appreciate the chance to resolve any concern first.
Definitions
Capitalised terms used but not defined in this notice (including Artist, Receiver, Curator, Studio Owner, Studio Member, Professional, User, Content, Track, Inbox module, Studio module and Elevate Store) have the meanings given in our Terms of Service. In addition:
“Data Protection Legislation” means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and all other applicable data protection and privacy laws, as amended from time to time.
“personal data” means any information relating to an identified or identifiable living individual; and the terms “controller”, “processor”, “processing” and “special category data” have the meanings given in the Data Protection Legislation.
“Online Payment Partner” means our payment processor, currently Stripe, including its Stripe Connect service, as described in the Terms of Service.
The personal data we collect
1 CATEGORIES OF DATA
Depending on how you use the Platform, we collect:
(a) Account and profile data — your email address, first and last name, username, profile picture, and (where you provide them) company name and details, billing, postal and physical addresses and mobile phone number.
(b) Authentication data — we sign you in using your email address and a one-time passcode. We do not use or store account passwords, and we do not offer third-party or social-media sign-in.
(c) Content and activity data — the Tracks, audio, images, comments, submissions, messages, listings, Studio content and other Content you upload or exchange, and your activity on the Platform (submissions, shortlisting/support and decline decisions, reviews, feedback and interactions).
(d) Transaction data — records of your purchases, subscriptions and sales, amounts, dates and the parties involved. Card and bank details are collected and processed by the Online Payment Partner, not stored by us (see the Payments and marketplace section).
(e) Communications and support data — messages you send us or other Users, and support requests.
(f) Marketing data — your marketing preferences and consents.
(g) Technical and usage data — IP address, device and browser information, cookies and similar technologies, and logs of your use of the Platform.
(h) Google Calendar data — where an Elevate Store owner connects their Google Calendar, the calendar data needed to enable scheduling (see the Google Calendar integration section).
2.1 We collect this data from you directly, from your use of the Platform, and from other Users where you transact or interact with them (for example, a Receiver receives an Artist’s contact details when a Track is submitted).
2.2 We do not intentionally collect special category data. Please do not submit special category data through free-text fields or Content unless necessary; where you do, you are responsible for it.
How and why we use your data
1 PURPOSES AND LAWFUL BASES
We use personal data for the following purposes, relying on the lawful basis shown:
(a) To provide, operate and maintain the Platform and your Account — performance of our contract with you (our Terms of Service).
(b) To enable and process transactions in the Studio module and Elevate Store, including via the Online Payment Partner — performance of contract, and our legitimate interests in operating a marketplace.
(c) To enable Users to interact — for example, making an Artist’s contact details available to a Receiver on submission of a Track — performance of contract and legitimate interests (see the Payments and marketplace section).
(d) To operate, analyse, secure and improve the Platform, including internal product features — legitimate interests (see Automated processing and AI).
(e) To communicate with you about your Account, transactions, service messages and support — performance of contract and legitimate interests.
(f) To send marketing about our own services — consent, or legitimate interests where permitted, in each case in accordance with PECR; you can opt out at any time.
(g) To prevent fraud and abuse and keep the Platform secure — legitimate interests and legal obligation.
(h) To keep records and comply with law (including tax, accounting and responding to lawful requests) — legal obligation and legitimate interests.
(i) To establish, exercise or defend legal claims, and in connection with a re-organisation, merger or sale of our business — legitimate interests.
Automated processing and AI
1.1 We use automated processing to operate and improve the Platform, including features such as search, recommendations, tagging, content organisation and moderation. This may involve analysing your Content and usage data.
1.2 We do not use your Content to train generative AI models, and we do not licence or otherwise make your Content available to any third party for the purpose of training that third party’s AI models, without your separate consent.
1.3 We do not make decisions producing legal or similarly significant effects about you based solely on automated processing without a lawful basis and appropriate safeguards.
Payments and the marketplace
1.1 Payments are processed by the Online Payment Partner using its Stripe Connect service. We do not collect or store your full card or bank details; these are handled by the Online Payment Partner under its own terms and privacy policy.
1.2 The Studio module and Elevate Store are marketplaces. When you buy from, sell to, or otherwise transact or interact with another User, personal data is shared between you and that User so the transaction or interaction can take place.
1.3 Independent controllers. A Studio Owner, a Professional, or a Receiver who receives your data for their own purposes acts as an independent controller of that data, not as our processor. They are responsible for their own compliance with Data Protection Legislation, including providing their own privacy notice, establishing a lawful basis, responding to your rights requests, and handling any breach. We are not responsible for how they use your data. Under Stripe Connect, the selling User is the merchant of record and customer and transaction data is processed by the Online Payment Partner and made available to that seller.
1.4 Where you sell through the Platform, you must comply with Data Protection Legislation in respect of the customer and transaction data you receive, as set out in the Terms of Service.
Google Calendar integration (Elevate Store)
1.1 If you are an Elevate Store owner, you can choose to connect your Google account so that Trackstack can access your Google Calendar to help you manage availability and bookings for your Professional Services. This is an optional feature and is not used to sign in to the Platform.
1.2 When you connect Google Calendar, we access only the Google account data needed for that feature (such as your calendar events and availability), and only with the permissions (scopes) you grant during connection.
1.3 Trackstack’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide and improve the calendar-connected booking feature, do not sell it, and do not use it for advertising.
1.4 You can disconnect Google Calendar and revoke our access at any time in your Platform settings or via your Google account permissions. On disconnection we stop accessing your calendar data and delete or de-identify any calendar data we no longer need.
Who we share your data with
1.1 We share personal data with:
(a) Service providers (processors) who process data on our behalf and under our instructions, including for payments, cloud hosting and infrastructure, audio/video streaming and delivery, email and notifications, analytics, and customer support.
(b) Other Users, where you transact or interact with them, as independent controllers (see Payments and the marketplace).
(c) The Online Payment Partner and, where you connect it, Google, as described above.
(d) Professional advisers, and authorities or other parties where required by law or to protect our or others’ rights.
(e) A buyer or successor in connection with a merger, acquisition or re-organisation of our business.
1.2 We do not sell your personal data.
1.3 Our current processors and sub-processors are:
- [Online Payment Partner — Stripe — payments]
- [Cloud hosting / infrastructure — e.g. Amazon Web Services]
- [Audio / video streaming and delivery — e.g. Mux]
- [Email and notifications — provider]
- [Analytics — provider]
- [Google — Calendar API, where connected by Elevate Store owners]
International transfers
1.1 Some of our processors are located outside the UK (for example, in the United States). Where we transfer personal data outside the UK, we ensure it is protected by an appropriate safeguard, namely: transfer to a country covered by UK adequacy regulations; the UK International Data Transfer Agreement (or the EU Standard Contractual Clauses with the UK Addendum); or another lawful transfer mechanism.
1.2 You can ask us for details of the safeguards that apply to a particular transfer using the contact details above.
How long we keep your data
1.1 We keep personal data only as long as necessary for the purposes above, then delete or anonymise it. In particular: Account and profile data are kept while your Account is active and for a reasonable period afterwards; a Declined Track is deleted from our servers after 30 days; and transaction records are kept for the periods required by tax and accounting law.
1.2 We may keep some data longer where needed to comply with law, resolve disputes or enforce our agreements.
Your rights
1.1 Subject to conditions and exemptions in the Data Protection Legislation, you have the right to: be informed about our processing; access your personal data; have inaccurate data corrected; have data erased; restrict processing; data portability; object to processing (including to direct marketing at any time); not be subject to solely automated decisions with legal or similarly significant effects; and, where we rely on consent, withdraw that consent at any time (without affecting prior processing).
1.2 To exercise any right, contact us using the details in the Introduction. We will respond within the statutory time limit (usually one month). Exercising these rights is free in most cases.
1.3 Where another User is the controller of your data (see Payments and the marketplace), you may need to exercise these rights against that User; we will help you identify and reach the relevant User where we reasonably can.
Cookies and similar technologies
1.1 We use cookies and similar technologies for essential Platform functionality, to remember your preferences, to keep the Platform secure, and (with your consent where required) for analytics.
1.2 You can control non-essential cookies through our cookie banner or settings and through your browser. Blocking some cookies may affect how the Platform works.
Security
1.1 We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, including where our processors store or process data on our behalf. No system is completely secure, and you are responsible for keeping access to your email account secure, as that is how you sign in.
Children
1.1 The Platform is intended for users aged 18 and over, consistent with our Terms of Service. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
Changes to this notice
1.1 We may update this notice from time to time. We will post the updated notice on the Platform and, where changes are material, take reasonable steps to notify you. The date below shows when it was last updated.
Last updated: 2 July 2026
Contact us
1.1 For any privacy question or to exercise your rights: email support@trackstack.app, or write to Trackstack Music Limited, 20-22 Wenlock Road, London, England, N1 7GU. You can also complain to the ICO at ico.org.uk.