1. Scope
This policy covers borealmusicgroup.com, the music submission form, the newsletter, job applications sent through our Careers page, and the emails we exchange with artists and applicants. It is provided by Elias Gustavo Gonçalves de Araújo, an individual based in Brazil, who operates Boreal Music Group and is responsible for your data.
2. What We Collect
- Submission form: artist name, email address, track link, genre, track type, an optional message, your age confirmation, and your choices on the form's checkboxes, with the date and time you submitted.
- If your track is selected: details we ask for by email to publish it, such as social links, information about AI use, the artwork or photos you approve, and whether your distributor allowlisted our channel.
- Copyright complaints and removal requests: the details you send us.
- Newsletter: the email address you give us on the website or on the submission form, with the date you signed up and confirmed.
- Job applications: your name, email address, location, the links you share (portfolio, CV, social profiles), your answers to the role's questions, your message, and your consent, with the date and time you applied.
- Technical data: our hosting provider processes your IP address and browser information to deliver the pages and run the form.
- Content from other services: our home page loads a cover image from YouTube (img.youtube.com) and album information from Spotify (open.spotify.com). When it does, your browser sends your IP address to those services, under their own privacy policies. Links to Instagram, YouTube, SoundCloud, TikTok and X send nothing until you click them.
We do not use analytics, advertising or tracking cookies. The site keeps one setting in your browser's session storage so the intro animation plays only once per visit; it holds no personal data and is cleared when you close the tab.
3. Why We Use It, and Our Legal Basis
- Reviewing your submission and replying, including the confirmation email — performing the Submission Terms you accept (LGPD Art. 7, V; GDPR Art. 6(1)(b)).
- Publishing a selected track and showing your name and artwork — performing the Submission Terms (LGPD Art. 7, V; GDPR Art. 6(1)(b)).
- Handling copyright claims and complaints, and keeping proof that you accepted the terms — exercising rights in legal proceedings and legitimate interests (LGPD Art. 7, VI and IX; GDPR Art. 6(1)(f)).
- Reviewing your job application and contacting you about it — steps you ask us to take before a possible engagement (LGPD Art. 7, V; GDPR Art. 6(1)(b)); keeping it to consider you for future roles — your consent (LGPD Art. 7, I; GDPR Art. 6(1)(a)).
- Listing you on our website — your consent (LGPD Art. 7, I and Art. 8; GDPR Art. 6(1)(a)).
- Sending the newsletter with Boreal news and invitations to projects — your consent (LGPD Art. 7, I and Art. 8; GDPR Art. 6(1)(a)).
- Keeping the site and form secure and free of spam — legitimate interests (LGPD Art. 7, IX; GDPR Art. 6(1)(f)).
- Meeting legal obligations — legal obligation (LGPD Art. 7, II; GDPR Art. 6(1)(c)).
The required form fields are needed to review your track; without them we cannot consider it. Website listing and the newsletter are optional and separate: saying no to either does not affect your submission.
4. Who Receives Your Information
- Resend (United States) sends the submission email to us, the confirmation emails to you, our replies, and the newsletter.
- Supabase hosts the database where we keep submissions and job applications for our team to review.
- Cloudflare (United States) manages our domain and forwards emails sent to our addresses to our inbox at Google (Gmail, United States), where submissions are kept.
- Netlify (United States) hosts the website and runs the form.
- YouTube (Google) receives your track and the public details shown in the video when we publish it, and your channel details if we add you as a collaborator.
- Authorities or courts, when the law requires it.
We do not sell your information and do not use it for advertising.
5. International Transfers
The providers above process data in the United States. For submissions and publication, the transfer is necessary to do what you ask us to do (LGPD Art. 33, IX; GDPR Art. 49(1)(b)). For the newsletter, it is based on your specific consent, given on the form after you are told that your email will be stored in the United States (LGPD Art. 33, VIII; GDPR Art. 49(1)(a)). You can ask us for more information about these transfers at any time.
6. How Long We Keep It
- Submissions: 12 months after our last reply, then deleted, unless the track was published.
- Published tracks: while the video is published, and afterwards for as long as needed to handle copyright claims.
- Copyright complaints: as long as needed to resolve them and defend legal claims.
- Job applications: up to 12 months after you apply, then deleted. You can ask us to delete yours earlier.
- Newsletter: until you unsubscribe.
- Website listing: until you withdraw consent or the listing is removed.
- Technical logs: for the period set by our hosting provider.
7. Your Rights
Under Brazil's LGPD (Art. 18) you can ask us to: confirm whether we process your data; give you access; correct it; anonymize, block or delete data that is unnecessary, excessive or unlawfully processed; port it; delete data processed on consent; tell you who we share it with; tell you what happens if you refuse consent; and withdraw consent.
If the GDPR or UK GDPR applies to you, you also have the rights to restriction and to object to processing based on legitimate interests.
To use any right, email contact@borealmusicgroup.com. We may ask you to confirm your identity. Under the LGPD we answer a simple confirmation immediately and give a complete statement within 15 days (Art. 19). Under the GDPR and UK GDPR we answer within one month, extendable by two months for complex requests.
You can also complain to Brazil's data protection authority (ANPD), to the authority in your EU country, or to the UK Information Commissioner's Office.
8. Withdrawing Consent
You can withdraw consent for the website listing or the newsletter at any time, free of charge, by emailing us or using the unsubscribe link in any newsletter. Withdrawal does not affect what we did before it, and does not affect your submission.
9. Security
Only the Boreal team can access submissions and job applications, and our providers encrypt data in transit. No system is completely secure; if an incident puts you at risk, we will notify you and the authorities as the law requires.
10. Age
You must be at least 16 to submit music. If you are 16 or 17, your parent or legal guardian must also agree to our Submission Terms and this policy, and we handle your data in your best interest.
11. Changes
We may update this policy and will show the new date on this page. If a change affects how we use data you gave us on the basis of consent, we will ask again.