Privacy Policy
1. Who we are
Orkaan Studio S.R.L. (registration number J2020000463214, VAT number RO43235477, registered office at Str. Nicolae Balcescu 30, 927020 Amara, Romania) operates Kallitone and is the data controller for personal data processed through the Service. References to Kallitone, we, our or us mean Orkaan Studio S.R.L.
Contact us for privacy matters at support@kallitone.com.
2. Scope of this Policy
This Policy explains how Kallitone collects, uses, shares, retains and otherwise processes personal data relating to visitors, Account holders, Creators, subscribers and other persons ("you") in connection with the Service.
Third-party services, including Stripe, Polygon, wallet providers, social networks, analytics providers and WebTorrent infrastructure, have their own privacy practices. We are not responsible for independent third-party data processing outside our control.
3. Personal data we collect
3.1 Account and identity data
When you create an Account we collect your email address, chosen username, country (used to set currency, tax, availability and legal obligations), password (stored individually salted and hashed using a modern password-hashing function; never stored in plain text), two-factor authentication method and credentials, and — where you connect a social login — the account identifier and basic profile information returned by the social provider.
If identity or KYC verification is required, we may also collect government-issued identity documents, date of birth, address, a photograph or biometric comparison result (processed only as described below), beneficial-owner information and related compliance data.
3.2 Creator and Track data
Creators submit audio files, musical compositions, artwork, stage names, biographies, credits, collaborator information, split-sheet data, ISRC and other metadata, and related content. This is described in Part II of the Terms.
3.3 Subscription and payment data
We collect the Subscription plan chosen, billing period, price, tax, currency, transaction and renewal history, and — if required for tax, refund, KYC, chargeback or dispute purposes — billing name, address, country and payment-method type. Complete card numbers, CVV and full payment credentials are processed directly by our payment provider and are not stored by Kallitone.
3.4 KLT and blockchain data
We record your KLT balance, type (Subscription or Earned), transaction log, voting reward credits, Creator allocations, donations, external wallet address you provide, gas-fee records, transfer requests and relevant KYC or sanctions-screening outcome. The Polygon blockchain is public; transactions recorded on-chain are visible according to how that network operates.
3.5 Usage and interaction data
We collect log data, including dates and times of access, features used, pages visited, Tracks voted on or listened to, vote choices, match history, skip actions, listening duration, device and browser type, operating system, language settings and rough geographic location derived from IP address. We collect Rank Data as described in the Terms.
3.6 WebTorrent and peer-to-peer network data
When you listen to a Track through WebTorrent, your browser participates in the peer-to-peer swarm. This may involve network information such as your public IP address being visible to peers, trackers, signalling providers and relay providers. Depending on browser settings and the network protocol used, a WebRTC connection establishment process may expose your IP address or network identifiers to other peers in the swarm, even when a relay (TURN server) is used. We do not guarantee that your IP address remains hidden from all peers. Kallitone may log connection events and technical data for security, abuse prevention, legal compliance and troubleshooting.
3.7 Communications data
We retain records of emails and messages you send us, including support requests, copyright notices, counter-notices, KYC documentation, dispute communications and feedback.
3.8 Verification and compliance data
Where identity verification is performed, we or our verification provider may process identity documents, photographs, biometric comparison data (used only to verify that a document matches a live photograph), address documents and related compliance records. Biometric comparison results are used for identity verification only and are not used for other profiling.
3.9 Data received from third parties
We may receive information from payment providers (fraud signals, chargeback notifications), identity-verification providers (verification outcome), sanctions-screening services (match results), social login providers (account identifier and basic profile) and, if integrated, analytics providers (aggregate usage signals).
4. How we use personal data
| Purpose | Data categories |
|---|---|
| Create and manage your Account and authenticate access | Account and identity data; usage data |
| Process Subscriptions, billing, taxes, refunds and chargebacks | Subscription and payment data; Account data |
| Operate KLT balances, rewards, allocations, donations and external transfers | KLT and blockchain data; Account data; verification data |
| Enable Track upload, conversion, torrent creation and WebTorrent distribution | Creator and Track data; usage data |
| Operate blind voting, generate rankings, display match history | Usage and interaction data; Account data |
| Enable full-track and excerpt playback through WebTorrent | Usage data; network data |
| Comply with KYC, sanctions, AML, tax, payment-compliance and regulatory obligations | Account data; verification and compliance data; KLT data; payment data |
| Prevent, detect and investigate fraud, manipulation, abuse and security threats | All categories as relevant |
| Promote Tracks and Creators (including paid advertising), subject to Creator opt-out rights | Creator and Track data; usage data |
| Send service communications, billing notices, security alerts and legal updates | Account data; Subscription data; communications data |
| Send optional marketing where you have opted in | Account data; usage data (aggregated) |
| Respond to rights notices, resolve disputes, and cooperate with courts and authorities | Creator and Track data; verification data; communications data; all relevant categories |
| Maintain and improve the Service, conduct analytics, research and testing | Usage and interaction data; Rank Data (anonymised or aggregated where practicable) |
5. Legal bases for processing (GDPR)
Kallitone relies on the following legal bases under Article 6 GDPR (and, where applicable, Article 9):
| Processing activity | Legal basis |
|---|---|
| Account management, playback, voting, ranking, KLT balances and rewards, Subscription billing | Art. 6(1)(b) — necessary to perform the contract with you |
| KYC, AML, sanctions screening, tax reporting, responding to authority requests, legal holds | Art. 6(1)(c) — necessary to comply with a legal obligation |
| Fraud and security protection, preserving ranking integrity, enforcing Terms, legitimate safety measures | Art. 6(1)(f) — legitimate interests of Kallitone and the Service's users, not overridden by your interests or rights (you may object) |
| Track promotion and Kallitone marketing to existing users (within permitted limits) | Art. 6(1)(f) — legitimate interests; you may opt out at any time |
| Optional marketing communications sent with consent | Art. 6(1)(a) — consent; you may withdraw at any time |
| Biometric comparison for identity verification (where applicable) | Art. 9(2)(a) — explicit consent; or Art. 9(2)(g) where required by law |
Where we rely on legitimate interests, we have assessed that those interests are not overridden by your interests, rights or freedoms, taking into account the nature of the data, the reasonable expectations of users and available safeguards.
6. Sharing personal data
We share personal data only in the following circumstances:
6.1 Service providers
We share data with processors and sub-processors acting on our instructions, subject to appropriate data-processing agreements, including: Stripe (payment processing); Polygon network infrastructure (blockchain processing); identity-verification and KYC providers; hosting, CDN, database and infrastructure providers; WebTorrent signalling and relay providers; analytics and performance-monitoring tools; email and support-platform providers; and legal, audit and compliance advisers.
6.2 Creators and rights holders
Kallitone may share information relevant to a credible rights notice or dispute with the affected Creator (or, in the reverse, with the notifier), to the extent necessary and proportionate for the review or resolution process.
6.3 Courts and authorities
We may disclose personal data to courts, law enforcement, regulators, tax authorities and other competent authorities where required or permitted by applicable law, after assessing the validity and scope of the request. We will challenge or narrow requests where appropriate.
6.4 Blockchain
An external KLT transfer is recorded on the Polygon blockchain. Transaction data (including wallet addresses and amounts) may be publicly visible according to that network's design.
6.5 Business transfers
If we merge, are acquired, sell the Service or restructure, personal data may be transferred as part of that transaction, subject to confidentiality obligations and continued privacy protections.
6.6 With your consent
We may share data for other purposes with your explicit consent.
7. International data transfers
Personal data may be transferred to or accessed from countries outside the European Economic Area, including the United States and the United Kingdom. Where a transfer is to a country not providing an adequate level of protection under GDPR, we rely on: European Commission adequacy decisions (where applicable); Standard Contractual Clauses adopted by the European Commission (currently the 2021 SCCs); the UK International Data Transfer Agreement or UK Addendum (for transfers from the UK); and any supplementary technical or organisational measures where necessary.
You may request a copy of the relevant transfer mechanism by contacting support@kallitone.com.
8. Data retention
| Data category | Retention period |
|---|---|
| Account data for active accounts | While account is active and for a reasonable deletion period thereafter |
| Financial and transaction records (billing, Subscription, KLT) | 10 years from the transaction date (or longer if required by tax law) |
| KYC and identity-verification records | As required by applicable AML, KYC or regulatory law (typically 5–10 years from the end of the business relationship) |
| Copyright and rights-notice records, legal correspondence | Until the dispute is resolved, plus applicable limitation period (typically at least 3–5 years) |
| Security, fraud and audit logs | Up to 3 years; longer if needed for a live investigation or legal hold |
| Creator Track data for active Tracks | While the Track is active on the Service |
| Anonymised or aggregated Rank Data | Indefinitely, as it does not identify individuals |
| Marketing consent records | Until consent is withdrawn plus 3 years |
| Biometric verification results | Retained only as long as necessary for the verification purpose; typically deleted within 30 days of the verification decision, unless a longer period is required by applicable law |
We may retain data longer than the periods above where necessary for an active legal dispute, regulatory investigation, court order or legal hold obligation. Where data is retained only for legal purposes and is no longer used for the original service purpose, it will be restricted from ordinary access.
9. Your rights
Under GDPR and applicable law, you have the following rights regarding your personal data:
- Access. You may request a copy of the personal data we hold about you.
- Rectification. You may ask us to correct inaccurate or incomplete data.
- Erasure. You may ask us to delete personal data where there is no overriding legal reason to keep it.
- Restriction. You may ask us to restrict processing in certain circumstances, for example while we verify an accuracy dispute.
- Portability. Where processing is based on contract or consent and carried out automatically, you may request a structured, machine-readable copy of data you provided to us.
- Objection. You may object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds that override your interests or rights, or the processing is needed for legal claims.
- Withdraw consent. Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
- Automated decisions. Where a decision is made solely by automated means and produces a legal or similarly significant effect on you, you may request human review, express your point of view, and contest the decision.
- Complaint. You may lodge a complaint with the Romanian data protection authority (ANSPDCP, www.dataprotection.ro) or with the supervisory authority in your country of residence or work.
To exercise any right, email support@kallitone.com. We will respond within one month, with a possible extension of a further two months for complex or multiple requests. We may ask you to verify your identity before acting. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline, with an explanation.
Exercising a right will not result in a penalty, though it may affect your ability to use features that depend on the relevant data.
10. Security
We implement technical and organisational measures appropriate to the nature and risk of personal data we process, including: individually salted password hashing; two-factor authentication; encryption of data in transit (TLS) and at rest; access controls and least-privilege principles; security monitoring and logging; vendor security assessment; and internal policies covering data handling, breach response and incident management.
No security measure is absolute. If you become aware of a security concern affecting your Account, please notify us promptly at support@kallitone.com.
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay where required by law. We will notify the relevant supervisory authority within 72 hours of becoming aware of a notifiable breach.
11. Children
The Service is not directed at persons under 18 years of age. We do not knowingly collect personal data from persons under 18. If we become aware that we have collected data from a child under 18 without verified parental consent where required, we will take steps to delete that data promptly. If you believe a person under 18 has provided us with personal data, please contact support@kallitone.com.
12. Cookies and similar technologies
Kallitone uses technically essential cookies and similar storage mechanisms necessary to operate Account sessions, maintain login state, support two-factor authentication flows and remember preferences required for the Service to function.
We do not use third-party advertising-network cookies or cross-site tracking pixels. Where we use analytics tools, they are configured to anonymise or aggregate data, and any required consent is collected through a cookie notice displayed on the Service.
You can manage or delete cookies through your browser settings. Disabling essential cookies may prevent Account login and core Service features from working.
13. Automated processing and AI
Kallitone uses automated tools to: detect duplicate or suspicious Tracks (audio fingerprinting and hash matching); prevent manipulation of votes, rankings and KLT rewards; detect fraud, chargebacks and sanctions matches; and conduct analytics to improve ranking methodology.
Where an automated process makes a decision with a legal or similarly significant effect on you, you have the right to request human review, express your point of view and contest the decision under Section 9. Applicable decisions include Account suspension or KLT restriction based solely on automated fraud or manipulation detection. Kallitone will indicate when automated means contributed to a material Content or Account decision.
14. Additional information for UK and US users
United Kingdom
UK residents' personal data is processed in accordance with the UK GDPR and the Data Protection Act 2018. The rights described in Section 9 apply equivalently under UK law. The relevant supervisory authority is the Information Commissioner's Office (ico.org.uk). International transfers from the UK are subject to the UK International Data Transfer Agreement or UK Addendum as applicable.
United States — California (CCPA/CPRA)
California residents have rights under the California Consumer Privacy Act (as amended by the CPRA), including rights to know, delete, correct and opt out of certain sharing or cross-context behavioural advertising. Kallitone does not sell personal information as defined by the CCPA. To exercise CCPA rights, contact support@kallitone.com or use available Account controls. We will not discriminate against you for exercising CCPA rights.
Other US state privacy laws may provide similar or additional rights; we will respond to verified requests consistent with applicable state law.
15. Changes to this Policy
We may update this Policy to reflect changes in our practices, legal requirements or the Service. For material changes, we will provide notice through the Service interface or by email to your registered address, normally at least 30 days before the change takes effect. The effective date above indicates when the current version came into force. We encourage you to review this Policy periodically.
16. Contact and complaints
Data controller:
Orkaan Studio S.R.L.
Str. Nicolae Balcescu 30, 927020 Amara, Romania
Registration: J2020000463214 · VAT: RO43235477
Email: support@kallitone.com
For data protection enquiries, please use the subject line Privacy or Data Request.
You have the right to lodge a complaint with the Romanian data protection authority:
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
www.dataprotection.ro
If you are in the United Kingdom, you may also contact the Information Commissioner's Office at ico.org.uk.
End of document — Version 1.0 · Effective September 10, 2026
Download PDF version