We don't sell your personal information. Davincii's products are ad-free — we never share your data with advertisers.
Section 1. What We Collect
We only collect what we need to run your publishing administration — nothing more.
1.1 Account Information. Signup collects your name, your email address, and either a password (which we store only as a bcrypt hash) or a Google or Apple sign-in. You can also add an artist or stage name and pick your Spotify artist page from a search box, both optional. We do not ask for a phone number, a date of birth, or an address to create an account.
1.2 Profile, Identity, and Tax Information. Collected later, when you complete your profile or set up payouts, not at signup: legal name, date of birth, country, mailing address, PRO membership and IPI number. Before your first payout you complete a W-9 (US persons) or W-8BEN (everyone else). You fill in and sign that form inside DocuSign, and your taxpayer identification number (SSN or ITIN, or a foreign TIN) is typed directly into DocuSign rather than into Davincii. What comes back to us is which form you signed, whether it is complete, the country you selected, and the resulting withholding rate. We never collect or store your taxpayer identification number ourselves. The form itself is required by law so we can report royalty payments to tax authorities.
1.3 Catalog and Rights Data. Song titles, writer splits, co-writer details, ISRC / ISWC codes, release dates, masters ownership, and any documentation you upload. Used to register your catalog with PROs and collection societies.
1.4 Payment Information. Whichever payout method you set up: a bank account connected through Stripe, or a PayPal address. We hold the Stripe Connect identifier and your PayPal address. Your bank details and payment credentials live with the processor (Stripe or PayPal), not on Davincii servers.
1.5 Royalty and Earnings Data. Income received on your behalf from PROs, mechanical agencies, and collection societies, including statements, splits, and payment history.
1.6 Authentication Data. If you sign in with Google, we receive a Google-issued identifier and your email. If you use Sign in with Apple, we receive an Apple-issued identifier and your email, which is a private relay address if you chose "Hide My Email"; Apple sends your name only on the first authorization. If you use a passkey, we hold a WebAuthn public key. We never receive your Google or Apple password. If you turn on two-factor authentication, we record which method you chose (email code or authenticator app) and, for the app method, the shared secret needed to check your codes.
1.7 Usage and Device Data. IP address, browser type, device identifiers, session cookies, timestamps, and pages viewed. Used for security, fraud prevention, and improving the product.
Section 2. How We Use Your Information
We use your information only for the following purposes:
- Registering your songs with PROs, mechanical agencies, and collection societies.
- Collecting royalties on your behalf and paying you your share.
- Producing monthly statements and tax reporting (1099 / 1042-S).
- Operating, maintaining, and improving the Davincii platform.
- Communicating with you about your account, registrations, payouts, and service updates.
- Detecting and preventing fraud, abuse, and unauthorized access.
- Complying with legal obligations (tax, anti-money-laundering, subpoenas, court orders).
We do not use your information for advertising, profiling, or automated decision-making that produces legal effects.
Section 3. How We Share Data
We do not sell your personal information.
We share your information only with parties that are required to deliver the service to you, or as legally required:
3.1 Collection Societies and PROs. ASCAP, BMI, SOCAN, SACEM, The MLC, SoundExchange (only where you have opted in to digital performance collection under section 1.3 of our
Terms of Service), and foreign sub-publishers receive the song metadata and rights information they need to register and distribute your royalties.
3.2 Payment Processors. Stripe and PayPal receive the minimum details required to deliver payouts. Bank transfers run through Stripe; your bank details are held by Stripe, not by us.
3.3 E-Signature. DocuSign hosts the W-9 and W-8BEN signing session described in section 1.2, and receives the name, address, and taxpayer identification number you type into that form. DocuSign is an e-signature provider here, not an identity verification vendor: we do not run identity checks on you, and we use no identity verification service.
3.4 Infrastructure and Service Providers. These vendors process data solely to run the platform on our behalf: Render (application hosting), Supabase (the Postgres database), Cloudflare (network delivery, security, and the Turnstile bot-protection check on our public forms), Resend (transactional email such as verification codes, statements, and payout notices), Google LLC (Google Analytics 4, only after you accept analytics cookies, and Google sign-in if you use it), Apple (Sign in with Apple, if you use it), and Spotify (artist and catalog lookups, including artist images). Stock photography on our marketing pages is served by Pexels, which sees only the request for the image.
3.5 Legal Requirements. We may disclose information when required by law, subpoena, or valid government request, or to protect Davincii's rights, property, or safety — or that of our users.
3.6 Business Transfers. If Davincii is acquired, merged, or restructured, your information may transfer to the successor entity, subject to the same protections described in this policy.
Section 4. Cookies and Tracking
We use a small number of first-party cookies, plus Google Analytics 4, which loads only if you accept it in the cookie banner. We do not use advertising cookies, and we run no cross-site tracking pixels or ad-network tags. Here is the full list.
4.1 Essential Cookies. dv_token is your session: a signed token, set HttpOnly, lasting up to 7 days. Signing in with Google or Apple also sets a short-lived cookie holding a random anti-forgery value for that one sign-in attempt, and turning on two-factor authentication adds a short-lived dv_2fa cookie that only covers the step between password and code. These cannot be switched off without breaking sign-in.
4.2 Your Cookie Choice and Local Storage. dv_consent records whether you accepted or declined analytics in the banner, and lasts 6 months. Separately, your browser's localStorage holds dv_artist, a small cache of your email and stage name so the header paints without waiting on a round trip. It stays on your device, is cleared when you log out, and is never sent anywhere. Your notification and dashboard preferences are saved on your account, not in your browser.
4.3 Analytics. We use Google Analytics 4, operated by Google LLC, to see which pages people read and how they get here. It is off by default: analytics storage is set to "denied" until you choose Accept in the cookie banner, and if you Decline it stays denied and no analytics events leave your device. Advertising storage is denied at all times, we send Google no advertising signals, and IP addresses are anonymized. You can change your mind at any time via the "Cookie preferences" link in the site footer, which reopens the banner. Clearing the dv_consent cookie in your browser settings works too.
4.4 Attribution and Referrals. When you first arrive, we store how you got here (the site that linked you, and any campaign tags on the link) in a first-party cookie named dv_attrib that lasts 90 days. If you followed a referral link from an existing member, we store that member's referral code in a first-party HttpOnly cookie named dv_ref, also 90 days, which is how we credit them. If you go on to create an account, we save that first source on your artist record so we know how you found us. Both cookies hold only the source: no browsing history, no profile, no personal details. They never go to a third party, and each is written once rather than updated on later visits. Because these are functional measurement rather than analytics, they are set regardless of your banner choice; the banner governs Google Analytics.
Section 5. How We Protect Your Information
We treat your data the way we'd want ours treated.
- All traffic is encrypted in transit via HTTPS / TLS.
- Passwords are hashed with bcrypt — never stored in plaintext.
- Sensitive tokens (JWTs, OAuth state) are signed and bound to short-lived, HttpOnly cookies.
- Access to production data is limited to authorized personnel under signed confidentiality obligations.
- Payment credentials are held by Stripe and PayPal (PCI-DSS certified); Davincii does not store card numbers.
- We maintain regular backups and monitor for suspicious activity.
No system is perfectly secure. If a breach affects your information, we will notify you and the relevant authorities as required by law.
Section 6. How Long We Keep Data
We retain your information for as long as your account is active and for as long as needed to deliver the service — including the 12-month post-termination collection window described in our Terms of Service.
6.1 Tax and Financial Records. Retained for at least 7 years to comply with IRS and foreign tax requirements.
6.2 Registration Records. Catalog metadata and registration confirmations are retained indefinitely so we can defend your claims against third parties.
6.3 Account Deletion. You can request account deletion at any time by emailing info@davincii.co. We'll delete what we can; records we're legally required to keep will be retained in archival form only.
Section 7. Your Rights
Depending on where you live, you may have the following rights. We honor them regardless of your location.
7.1 Access. Request a copy of the personal information we hold about you.
7.2 Correction. Ask us to correct inaccurate or incomplete information — most fields can also be edited yourself in the dashboard.
7.3 Deletion. Ask us to delete your information, subject to legal retention requirements above.
7.4 Portability. Request your data in a machine-readable format.
7.5 Objection. Object to processing based on our legitimate interests.
7.6 Opt Out of Sale. We never sell your information — but you can confirm this at any time.
7.7 If You Are in the EEA or the UK. We process your information on three legal bases. Most of it is processed because we need it to perform our contract with you: creating your account, registering your works, collecting royalties, and paying you. Some is processed on our legitimate interests in running the platform safely and improving it, which covers security, fraud prevention, and the first-touch attribution described in section 4.4. Google Analytics runs on your consent alone, and you can withdraw that consent at any time without affecting anything else. Where the law requires us to keep tax and payment records, the legal basis is compliance with a legal obligation. You have the rights to access your data, to have it corrected, to have it deleted, to receive it in a portable machine-readable format, to restrict processing, and to object to processing based on our legitimate interests. You also have the right to complain to your national data protection supervisory authority, and in the UK to the Information Commissioner's Office. We would rather hear from you first, but you do not have to come to us before going to them.
7.8 If You Are in California. Under the CCPA and CPRA you have the right to know what personal information we collect and who we disclose it to (sections 1 and 3 set that out in full), the right to a copy of it, the right to have it deleted, the right to correct it, the right to limit the use of sensitive personal information, and the right not to be discriminated against for exercising any of them. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months. There is no ad-network tag, advertising cookie, or advertising identifier anywhere on this site, and Google Analytics runs with advertising storage denied, so there is nothing to opt out of.
To exercise any of these rights, email info@davincii.co from the address on your account, or tell us how else we can confirm it is you. We will respond within 30 days. You can already edit most profile fields yourself in the dashboard; self-serve export and deletion are being built, and until they ship, email is the way. An authorized agent may make a request on your behalf with written proof that you authorized them.
The data controller is Davincii LLC, Brooklyn, New York, United States. We have not appointed an EU or UK representative; write to info@davincii.co and your request reaches the people who can act on it.
Section 8. International Users
Davincii operates from the United States. If you use the service from outside the US, your information is transferred to, processed, and stored in the US and in the other countries where the providers listed in Section 3.4 operate.
If you are in the European Economic Area, the United Kingdom, or Switzerland, those transfers are covered by the European Commission’s Standard Contractual Clauses. Each provider we use publishes data protection terms that include the Clauses and that take effect when we accept that provider’s agreement, so the Clauses apply without a separate signature. The Clauses are a transfer safeguard rather than a legal basis on their own; the legal bases we rely on are set out in Section 7.7. Write to info@davincii.co if you want the current terms for any provider and we will send you the link.
Section 9. Children
Davincii is for adults. Section 5(a) of our Terms of Service requires you to have reached the age of majority where you live and to be at least 18, unless a parent or legal guardian accepts the agreement on your behalf as the contracting party. We do not knowingly open accounts for anyone younger on their own. We also never knowingly collect personal information from a child under 13, which is the floor set by the US Children's Online Privacy Protection Act. If you believe a child has given us personal information, email info@davincii.co and we will delete it promptly.
Section 10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or dashboard notice at least 30 days before they take effect. The "Effective" date above will always reflect the current version.
The August 22, 2026 update is a clarification, not a material change: it describes the vendors, cookies, and signup fields the product already uses, and adds the regional rights sections. It takes effect on the date shown. Nothing about what we collect, who we share it with, or what you can ask us to do changed with it.
Section 11. Contact
Questions, requests, or concerns about your privacy?
Email: info@davincii.co
Controller: Davincii LLC, Brooklyn, New York, United States. We do not publish our street address; ask at info@davincii.co and we will give you the postal address for written correspondence.
Davincii LLC · Brooklyn, NY · davincii.co · Privacy Policy