Privacy Notice
Version 0.16-beta, effective 11 Nov 2026
This notice explains how Kakorri uses personal data when you use the Kakorri app and website, and, in sections 3 and 6, when you receive royalties under the Payout Terms (as a release owner, a member of a split or a person invited to a split).
1. Who is responsible
Kakorri AS, organisation number 933521818, c/o Leander Kolloen Amb, Fürstveien 83, 1367 Snarøya, Norway, is the controller for the personal data described here. Contact: [email protected]. Where another company decides itself how it uses your data, we say so in section 8.
2. Using Kakorri: what we collect and why
| What | Why | Legal basis |
|---|---|---|
| Account: name, email address, artist name, login data (password hash or sign-in method), two-factor authentication data, and your declaration that you are 18 or older | To create and run your account and keep it secure | Our contract with you (GDPR art. 6(1)(b)) |
| Sign in with Apple (if you use it): the ID Apple gives you for Kakorri, the email address Apple shares (your own or an Apple relay address), your name the first time you sign in, and a sign-in token from Apple, which we store encrypted | To let you sign in with Apple, and to tell Apple to end the sign-in when you remove the link or delete your account | Our contract with you (art. 6(1)(b)) |
| Plan and payments: your plan, price, currency, order and renewal dates, withdrawal and refund records, and payment details from our payment provider (Stripe; we never see your full card number) | To sell and run your plan, handle withdrawal and refunds, and keep accounts | Contract (art. 6(1)(b)) and bookkeeping law (art. 6(1)(c)) |
| Early-access invitation: who invited you, when you were invited and accepted, and the end date of your free year | To give personally invited artists the Artist plan free for 12 months and remind you before it ends | Contract (art. 6(1)(b)) |
| Sign-up and terms acceptance records: document version, date and time, IP address and sign-in method | To document what you agreed to; never used for profiling or marketing | Our legitimate interest in proving the agreement (art. 6(1)(f)) |
| Uploads and releases: audio, artwork, metadata, credits and contributor names, and your confirmation at each upload that no one under 18 performs on the release or created part of it, and that any recognisable person under 18 in the artwork is shown with their parents’ or guardian’s agreement | To deliver your release: we send it to our distribution partner and on to music stores and streaming services | Our contract with you (art. 6(1)(b)); for the under-18 confirmation also our legitimate interest in distributing only releases we have the rights for (art. 6(1)(f)) |
| Approvals for covers with changes: the document you upload (it can contain the names, signatures and contact details of songwriters or publishers), and your answers and confirmations in the cover step | To document the right to release the cover, and to handle claims | Legitimate interest (art. 6(1)(f)) and our contract with you (art. 6(1)(b)) |
| Submission confirmation: your account, which confirmation you gave and when. | To document that you confirmed the release rules (Terms 8.5) and to handle takedowns and claims | Legitimate interest (GDPR art. 6(1)(f)) |
| Audio checks: we send up to three short excerpts (about 12 seconds each) of each track you upload to ACRCloud, in its EEA region (eu-west-1), which turns them into a fingerprint to check whether the track matches existing recordings; we also measure the file itself (length, loudness, silence, damage) and compare a fingerprint we make ourselves with the audio already on Kakorri. If we switch on the AI-music check (Terms 4.7), the track also goes to ACRCloud’s detection service in the EEA, which deletes its copy as soon as it has answered. The AI-music check is an automated check that never decides alone: a person reviews every flag (Terms 4.7) | To prevent infringement and duplicates, keep releases within the stores’ rules and protect releases we can’t distribute | Legitimate interest (art. 6(1)(f)) |
| Lyrics checks: an automatic transcription of the vocals of each track you upload, and what we work out from it: a score against the stores’ content rules, and whether the track is instrumental | To check lyrics against the stores’ rules, to tell instrumental tracks apart and, if you ask for it, to suggest the lyrics for your release (Terms 4.9); and, if you ask Korri to make a draft from an audio file and confirm, to fill in the draft’s title and language. For a Korri draft, we only make the transcript after you confirm. | Our contract with you (art. 6(1)(b)) and legitimate interest (art. 6(1)(f)) |
| Korri, our helper: what you type, and the account and release context relevant to your question (section 5) | To answer your questions | Our contract with you (art. 6(1)(b)) |
| Actions you confirm through Korri: what you asked for, the card we showed you, the change, the time you confirmed it, your account and profile, IP address and browser details | To carry out the action, to show what you confirmed, and to prevent misuse | Our contract with you (art. 6(1)(b)) and our legitimate interest in documenting what was confirmed and preventing misuse (art. 6(1)(f)) |
| Genre suggestions: the genres of your earlier drafts and releases on the same artist profile | To suggest a genre for a new draft. We work it out in Kakorri; it is not sent to an AI provider, and it is only a suggestion you can change | Our contract with you (art. 6(1)(b)) |
| Links to your store pages: for each link you add, the store, the ID of your artist page and its country; and the record of your confirmation that you are this artist or are authorised to manage the page (date and time, IP address, your account and the link) | To connect your releases to your artist pages on the stores, and to show who confirmed a page if two accounts claim it | Our contract with you (art. 6(1)(b)) and our legitimate interest in preventing false claims (art. 6(1)(f)) |
| Label account and team: for a label account, the label’s name and the people on its team: their account and email address, their role (Owner, Admin or Manager), who invited them, and whether the seat is invited, active or removed | To run the label account and give each person only what their role allows | Our contract with the label owner (art. 6(1)(b)) and our legitimate interest in giving access only to the people the label chose (art. 6(1)(f)) |
| Invitations to a profile team, a label’s team or a label link: the email address typed in, the profile, label or act it concerns, the role (for a team), who invited you, when the invitation was sent and opened, and whether you accepted it with your own account | To deliver the invitation and to attach it only to the account whose confirmed email address it was sent to | Our legitimate interest in letting artists and labels bring their own people in, and in keeping an account the person’s own (art. 6(1)(f)) |
| Label link confirmations: when a label proposes to link an artist profile, the label’s confirmation, and when the artist accepts, the artist’s confirmation: the time, the version of the text that was confirmed and the account (we do not store your IP address for these confirmations) | To show who confirmed what, and when, if the link is questioned | Our legitimate interest in proving the agreement (art. 6(1)(f)); never used for profiling or marketing |
| Support cases and messages: what you write to us in the app, by email or through Korri’s “Talk to a person”, our replies, the case number and status, and, if you choose to include it, a copy of your recent chat with Korri | To answer you in our built-in support system, to sort and route cases, and to keep a record of our correspondence | Contract (art. 6(1)(b)) and legitimate interest (art. 6(1)(f)) |
| Support AI tool: the text of a support message you send us and the facts about your account that are relevant to it (never bank, tax or identity details) | To suggest a topic and a draft reply to our team. A person always reads the message and sends the answer (Terms 7.3) | Legitimate interest in answering support quickly and correctly (art. 6(1)(f)) |
| Referrals: your referral code, who joined through your link (first name shown to the friend on the invitation page), whether their first payment counts, and the discount used | To give the friend’s discount and your reward (Terms, clause 13) | Contract (art. 6(1)(b)) |
| Security logs: IP address, device and browser details, sign-in events and error logs | To keep the service secure and prevent misuse | Legitimate interest (art. 6(1)(f)) |
| Email notices: your email address and delivery status | To send service messages about your account, releases and these terms, through our email provider | Contract (art. 6(1)(b)) |
| Product news (optional): your email address | To send you news about Kakorri, only if you turn it on. It is off by default, and every email has an unsubscribe link | Consent (art. 6(1)(a)) |
| Proof that you control a release you move to Kakorri (for example a screenshot from your previous distributor’s account, or a code we ask you to place there) | To check that the release is yours to move, and to resolve a claim against it (Terms clause 9) | Contract (art. 6(1)(b)) and legitimate interest in preventing fraud and infringement (art. 6(1)(f)) |
Store profile links/IDs you add and fix requests are sent to our distribution partner and the relevant store to connect your releases to your profile. We don’t look up anything about you on the stores: we keep only what the link itself says.
Cookies. We use only strictly necessary cookies, for example to keep you signed in and secure. They don’t need your consent, so we don’t show a cookie banner. If we add analytics later, we will only use them if you opt in.
3. Royalties and payouts: what we collect and why
| What | Why | Legal basis |
|---|---|---|
| Name, email address, account ID, country of residence, payout currency | To set up and run the Payout Terms, and to pay you | Our contract with you (GDPR art. 6(1)(b)) |
| Your acceptance of the Payout Terms and of each split: date, time, document version, IP address and browser details | To show what you agreed to and that the licence was given | Our legitimate interest in proving the agreement (art. 6(1)(f)); never used for profiling or marketing |
| A label’s invitation to you: your email address, the label and the act it concerns, when the invitation was sent and opened, and whether you accepted it with your own account | To deliver the label’s proposal to you and to attach it only to the account whose confirmed email address it was sent to | Our legitimate interest in letting labels invite the artists they work with, and in keeping an artist’s account the artist’s own (art. 6(1)(f)) |
| One-time codes for split or label invite links: when you ask for a code on a split invite’s page, we store a hash of the link, a hash of the invited email address, a salted hash of the code (never the code itself), when it was sent, when it expires, when it was confirmed and used, and the number of tries. We also count wrong tries, and for 15 minutes we count requests per IP address in the server’s memory only; the IP address is not stored. | To check that the person creating the account can read the invited inbox, and to stop misuse | Our legitimate interest in paying each share only to the person it was meant for (art. 6(1)(f)) |
| Identity details you give us: legal name, date of birth, address and country (for a company: its name, organisation number and the name of the person who accepts for it) | To pay only the right person, to check that you are old enough and, from when payouts open, to screen against sanctions lists | Contract (art. 6(1)(b)), legal obligations where they apply (art. 6(1)(c)) and our legitimate interest in preventing fraud (art. 6(1)(f)) |
| Sanctions screening results (from when payouts open; no screening until then) | To make sure we don’t pay anyone covered by sanctions | Legal obligation (art. 6(1)(c)) and legitimate interest (art. 6(1)(f)) |
| Identity check result, only if we ask you to confirm who you are (not in use at the moment; if we introduce it, we update this notice first): outcome, name and date of birth on the document, document country, method, date and reference | To check your identity when something needs a closer look, for example a large or unusual payout | Legitimate interest in preventing fraud (art. 6(1)(f)) and contract (art. 6(1)(b)) |
| Bank account details | To make payouts to an account in your name | Contract (art. 6(1)(b)) and legitimate interest in preventing fraud (art. 6(1)(f)) |
| An account confirmation from your bank, if we ask you for one before your first payout to a new account | To confirm that the account is in your name | Contract (art. 6(1)(b)) and legitimate interest in preventing fraud (art. 6(1)(f)) |
| Royalties, splits, statements and payouts, including any overdue plan fee we settle against royalties we owe you | To calculate and pay what we owe you, and to keep accounts | Contract (art. 6(1)(b)) and bookkeeping law (art. 6(1)(c)) |
| Tax details: where you are resident for tax purposes (or your declaration of it, if not in Norway), whether we pay you as a private person, a sole trader or a company, your organisation number, foreign tax number and VAT registration, where they apply, and whether you created the works yourself | To meet tax and bookkeeping rules | Legal obligation (art. 6(1)(c)) |
| Norwegian fødselsnummer or D-nummer, only for Norwegian individuals whose payments we must report, and your confirmation that it is your own number | Tax reporting: each year we report what we paid you to the Norwegian Tax Administration and send you a copy | Legal obligation (art. 6(1)(c)) |
| Messages with us, and notes from security and dispute reviews | To answer you, handle disputes under the Payout Terms and keep the service secure | Contract (art. 6(1)(b)) and legitimate interest (art. 6(1)(f)) |
We do not collect more than we need for these purposes (art. 5(1)(c)). Nobody under 18 can use Kakorri or be a payee. Payouts to payees in the United Kingdom are not available yet.
4. Where the data comes from
Most of it comes from you. Some comes from others:
- Our identity-check provider (not in use at the moment; if we introduce it, we update this notice first), if we ask you to confirm who you are (section 6), sends us the result of the check.
- A sanctions-screening source, from when payouts open (no screening takes place until then), tells us whether a name matches a sanctions list (the EU, UN, Norwegian, UK and US (OFAC) lists).
- Our payment provider tells us whether a payout went through.
- A label that proposes to link your act to its label gives us your email address and the name it knows your act by. We tell you this in the invitation (art. 14). If you do not create an account or sign in with that address within 30 days, the proposal lapses and we delete your email address.
- The owner of an artist profile, or the owner of a label, who invites you to work on that profile or join that label’s team gives us your email address. We tell you this in the invitation (art. 14). If you do not sign in with that address and accept within 14 days, the invitation lapses and we delete your email address 30 days later.
- A release owner who invites you to a split gives us your email address and the proposed share. We tell you this in the invitation (art. 14). If you do not answer within 30 days after it is sent, the invitation lapses (an invitation sent before 28 October 2026 keeps the expiry date it was sent with). We delete the address 30 days after the invitation lapses, is declined or is withdrawn.
- Our distribution partner and the streaming services report the use of the releases, which is how we calculate royalties.
- Store catalogues: when you move a release or ask us to fill in details, we look up the release’s codes (ISRC, UPC) and names in the public catalogues of streaming services and music databases, for example Apple Music, Deezer and MusicBrainz.
5. Korri, our helper
Korri is a helper in the app. What you type into Korri, together with the account and release context relevant to your question, is sent to a third-party AI provider to generate the answer. Korri runs on an AI provider that processes data in the EU. Korri does not receive your payout details, bank details or the reasons for legal, sanctions, fraud or dispute reviews.
Don’t enter sensitive data (for example about health, religion or political views) into Korri. Enter other people’s details only where Korri needs them for what you asked, for example the names of the people in a split; Korri sends no invitations: you send them on the page. Names you type into Korri, for example people in a split, go to our AI provider in the EU with the rest of the conversation and are deleted with it. Korri tells you it is a helper that uses AI, and actions happen only when you press the button on Korri’s card (Terms 7.6). We keep a record of each action you confirm (section 10). Korri’s answers may be wrong, so you must check them before you rely on them. We store the conversation context for 30 days, and then delete it.
Talk to a person. If you choose “Talk to a person” in Korri, you can include your recent chat with Korri in the support case (the last 20 messages, only while you leave the switch on). It goes with the case, our team can read it, and it is deleted with the case (section 10).
Support emails and AI drafts. We use AI tools to help draft replies to support emails. Before any reply is sent, a member of our team reads and approves it, and no decisions about you are made by the AI alone. Your message and related account details are processed by AI providers we have data processing agreements with, which act as our data processors and do not use it to train their models. Where data is transferred outside the EEA, this is based on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. Support cases are deleted 24 months after they close. A case that closed before 11 Nov 2026 is still deleted 90 days after it closed. If a case becomes a dispute, we may keep it longer, for as long as we need it for the legal claim. The legal basis is our legitimate interest in providing efficient support, and performance of our contract with you.
6. Identity details and checks
Before your first payout we ask you for your legal name, date of birth, address and country (for a company: its name and registration number). We use them:
- to check that you are old enough (18 or older);
- for sanctions screening. We screen payee names against sanctions lists (EU, UN, Norway, UK, US/OFAC) before payouts open and before every payout run. Until payouts open, no screening takes place.
Before your first payout to a new account we may ask you to confirm the account is in your name, for example with an account confirmation from your bank. Any such document is deleted within 30 days.
We don’t use an electronic ID (such as BankID) for this at the moment.
If we ask you to confirm who you are. It is not in use at the moment; if we introduce it, we update this notice first. We would do this only when something needs a closer look, for example a large or unusual payout:
- Document check through our identity-check provider (not in use at the moment; if we introduce it, we update this notice first): you photograph an identity document. We do not take a selfie or use face matching, so no biometric data is used to identify you. The provider checks the document and decides how it uses the data itself (section 8). We keep only the result. We ask the provider to remove the document images and data from the check once we have recorded the result, and at the latest 30 days after the result.
Norwegian national ID number. If the law requires us to report payments to you to the Norwegian Tax Administration, we ask for your fødselsnummer or D-nummer before that payout. Until you give it, the payout is paused and what we owe you stays owed to you. The legal basis is our legal obligation to report (GDPR art. 6(1)(c); skatteforvaltningsloven § 7-10 first paragraph (g) and § 7-14). You type it in and confirm that it is your own number; we check that it is a valid number. We store it encrypted, separately from your profile, show only its last two digits, never put it in emails, links or logs, use it only for tax reporting, and never ask for national ID numbers from other countries.
No decision about you is made only by automated means. If a check or a sanctions screen flags you, a person reviews it before anything happens.
7. No marketing use of payee data
We never use payee data (sections 3 and 6) for marketing, advertising or profiling. If your account only receives royalties (for example as a member of a split), we never send you product news. Messages about your account, releases, royalties, statements and payouts are service messages.
8. Who we share data with
| Recipient | What | Role |
|---|---|---|
| Hosting and IT providers (hosting in the EU) | The data in the service | Process data for us under a data processing agreement (art. 28). |
| Our distribution partner, music stores and streaming services | Your releases: audio, artwork, metadata, credits and contributor names; store profile links and IDs you add, and fix requests. Not the approval documents you upload in the cover step: we do not send them to the distribution partner or the stores | To deliver your releases and report their use. |
| ACRCloud (EEA) | Short audio excerpts of each track you upload, which it turns into a fingerprint, and, if the AI-music check is on, the track for its detection service (section 2) | Processes it for us under a data processing agreement (art. 28). |
| Google (Vertex AI, EU region), our AI provider for transcription and support drafts (with zero data retention) | The audio of each track you upload, for the transcription of its vocals (section 2); the text of a support message and relevant account facts, for a draft reply to our team; the text of a track’s transcript, for the check of its lyrics (section 2); for a draft you ask Korri to make from an audio file, the same transcription, made once and only after you confirm | Processes it for us under a data processing agreement (art. 28). We ask it not to keep the data or use it for training. |
| Our email provider | Your email address and the content of our emails | Sends our emails for us. |
| Apple (Apple Inc., USA), if you sign in with Apple | Apple confirms who you are and shares the details in section 2. We send Apple only what the sign-in needs. When you remove the link or delete your account, we also send Apple the token so it can end the sign-in. | Apple handles your Apple Account under its own privacy policy. |
| Google (Vertex AI, EU region), our AI provider for Korri | What you type into Korri and the relevant context (section 5) | Generates Korri’s answers. |
| Stripe (card payments for plans) | Your plan, its price and currency, and the payment details for it (section 2; we never see your full card number) | Takes the card payments for plans. |
| Our payment provider (Wise) | Name, bank details, payout amount and currency, payout reference | Makes the payouts. For its own identity and anti-money-laundering checks it decides itself how it uses data. |
| Our identity-check provider (not in use at the moment; if we introduce it, we update this notice first; only if we ask you to confirm who you are) | Document images and data from the document check | Independent controller for its own purposes. Its own privacy notice explains its use and retention. We ask it to remove the data from each check on our schedule (section 6). |
| A sanctions-screening provider (applies from when payouts open; no screening until then) | Name, date of birth and country | Checks names against sanctions lists for us. |
| Release owners and the other members of a split | Your name or artist name, your share, and whether your share is accepted | So everyone can see the split they agreed to. They do not see your bank, tax or identity details or what we have paid you. |
| The label your artist profile is linked to | Your artist name and profile, the releases sent under the label (title, artwork, tracks, credits, status and the label’s review), your note to the label, the confirmations of the link, and the split of each such release (names, shares and whether each is accepted). Your earlier releases only if you choose to share them. | So the label can work on, approve and deliver those releases and propose their split. The label doesn’t see your royalties, statements or payouts, or your bank, tax or identity details. Its own statement shows only what its own share earned. |
| Your chosen auditor (Payout Terms 6(d)) | The records for your royalties only | Only if you ask for an audit. |
| The Norwegian Tax Administration (Skatteetaten) | Name, national ID number or organisation number, and the amounts paid each year | The law requires us to report payments to authors by 15 February each year (sole traders and private persons; not companies or people resident abroad). You get a copy. |
| Norges Bank | Name, amount and the reason, if we lodge an amount under the Payout Terms | Only in the cases the Payout Terms describe. |
| Courts and public authorities | What the law or a court order requires | Only when we must. |
| Our accountant and auditor | What they need to do their work | Bound by professional secrecy or a data processing agreement. |
| If a claim is made against a moved release: the streaming services, our distribution partner, your previous distributor and the person who claims the release | The release, its codes, the account name and what is needed to resolve the claim | Legitimate interest (art. 6(1)(f)) |
We do not sell your data.
9. Countries outside the EEA
We host the service in the EU. ACRCloud checks audio in its EEA region (eu-west-1). Some providers, for example our AI, email, payment or identity-check providers, and Apple if you sign in with Apple, may process data in the United States or elsewhere outside the EEA. Such transfers rely on the EU–US Data Privacy Framework or on the EU standard contractual clauses (GDPR chapter V). Transfers to Apple rely on the EU standard contractual clauses. You can ask us for a copy of the safeguards.
10. How long we keep it
| Data | How long |
|---|---|
| Account data | While your account exists |
| Sign in with Apple link (the ID Apple gives you for Kakorri, the email address Apple shared, the encrypted sign-in token) | Until you remove the link in Security or delete your account. Before we delete an account, we tell Apple to end the sign-in and then delete the token. If Apple tells us you stopped using Sign in with Apple, we delete the token at once. |
| Plan and payments | 5 years after the end of the financial year (bokføringsloven §13) |
| Early-access invitation | While your account exists |
| Sign-up and terms acceptance records (version, time, IP address, sign-in method) and a hashed copy of your sign-up email | While your account exists, and 3 years after it is deleted, to document the agreement (art. 6(1)(f) and art. 17(3)(e)). If an invitation is undone before the account was ever used, we delete the record at once |
| Store link confirmations (date and time, IP address, account and link) | While your account exists, and 3 years after it is deleted |
| Payout Terms and split acceptance records | While your account exists, and after that while you have an accepted share in a release or we owe you money, and then 5 years after the end of the financial year of the last payout to you, to document the agreement and the payouts (bokføringsloven §13; foreldelsesloven §§ 2, 3 and 10) |
| Split and label-arrangement records (who approved what and when, including the confirmations when a label link is proposed and accepted) | 5 years after the end of the financial year of the last payout to you, to document payouts and meet accounting and legal obligations, and then deleted |
| Releases and uploads | While your account exists, or until you delete the release |
| Korri conversation context | 30 days, then deleted |
| Korri action record (what you confirmed, when, from which browser and IP) | 3 years after the action. Kept even if you ask Korri to forget everything, because we may need it to show what was done |
| Invitations to join a profile team or a label | The email address is deleted 30 days after the invitation is accepted, declined, withdrawn or expires (the link works 14 days) |
| Label link proposals not taken up | The email address is deleted 30 days after the proposal lapsed (30 days after it was sent), was withdrawn or otherwise ended without the artist taking it up. It is deleted from the proposal itself too |
| Label team (who is on a label’s team, their role and status) | While the label account exists |
| Recently deleted drafts | 30 days, then purged; at once if you delete your account |
| Approvals for covers with changes (the uploaded documents, with any songwriter or publisher details, and your cover answers and confirmations) | If the release is or was available in stores: the documents are kept while the release is available, and for 3 years after the later of the date the takedown was registered and the date delivery actually stopped; we delete them only once the takedown is confirmed and the release is no longer live. This also applies if you delete your account. If it was never delivered: deleted when you delete the draft or the track, 90 days after the release was sent back or last changed without being submitted again, or when you delete your account, whichever comes first. If a claim or dispute is ongoing, until it is closed. We do not send these documents to our distribution partner or to the stores |
| Submission confirmation | Kept while the release exists and for 3 years after it is taken down or deleted. |
| Email suppression list (a keyed hash of the address, the reason and the date) | Bounces 24 months; complaints and unsubscribes until you ask us to email you again. Kept after account deletion so we don’t email you by mistake |
| Audio files you drop on Korri but don’t make a draft of | Deleted within 24 hours; no transcript is made |
| A draft Korri made that you stop before changing it | Deleted at once, with its transcript |
| Support cases (messages, drafts, a copy of your chat with Korri if you included it) | A case we have answered closes after 14 days without a reply from you. A closed case is deleted 24 months after it closed, unless we must keep it for a legal claim, a dispute or the bookkeeping law. The 24 months apply to cases that close on or after the date this version takes effect for you. A case that closed before that date is still deleted 90 days after it closed, as the earlier version said. If a case becomes a dispute, we may keep it longer to establish, exercise or defend a legal claim (art. 17(3)(e)); we record the reason |
| Lyrics transcripts and the results of the audio and lyrics checks | With the track, while your account exists |
| Audio recognition results: we keep the best match and any match you confirm for as long as the release is on your account. Other possible matches are deleted after 30 days. | |
| Referral records | While your account exists. A discount shown on an invoice is a plan and payment record (5 years after the end of the financial year) |
| Statements in the app | While you have an account, and 5 years after it closes |
| Self-billing agreement (if it applies to you) | At least 3 years and 6 months after the end of the financial year of the last statement |
| Payout and bookkeeping records, also after your account closes (what we owed you, what we paid, when, to whom, the account reference, and any amount still owed to you) | Kept for 5 years after the end of the financial year of the payout, because the bookkeeping law requires it (art. 6(1)(c)). They are not deleted when your account is deleted, and we use them only for bookkeeping, audits and to pay what we still owe you. The account reference is masked; your full bank details are deleted as described in the row below. |
| Bank details after your account closes | Until the last payout has settled, at most 12 months after closure, only to pay royalties that arrive late |
| Your email address after your account closes | Until the last payout to you has settled and our final run for late royalties is done. If we still owe you money after that, we use it only to ask for your payout details, and delete it once we have paid you. We review this every year. It may also be kept in a support case (24 months after the case closes) or while a dispute is open (art. 17(3)(e)). |
| Identity details and any identity check result | As long as the related acceptance records |
| Sanctions screening results | A check with no match: 5 years after the end of the financial year of the check. A check that could not be completed: 12 months. A possible match: until it has been reviewed and resolved, then 5 years after the end of that financial year. A confirmed match: until the freeze ends, then 5 years after the end of that financial year. |
| Account confirmation from your bank (if we ask for one) | Deleted within 30 days |
| Data from the identity-check provider’s document check (not in use at the moment; if we introduce it, we update this notice first) | Removal requested once the result is recorded, at the latest 30 days after the result. The provider’s own retention is explained in its own privacy notice |
| Norwegian national ID number | While your account exists, and 5 years after the last year we reported payments to you |
| Unaccepted split invitations | We delete the address 30 days after the invitation lapses (30 days after it is sent, or the date it was sent with if sent before 28 October 2026), is declined or is withdrawn |
| Unanswered label invitations | The email address is deleted 30 days after the invitation lapsed (30 days after it was sent) or was withdrawn |
| One-time codes for split or label invite links | Deleted within 3 days after the code is sent |
| Security logs incl. IP | 12 months, then deleted |
| Proof that you control a moved release | 30 days after our decision, or until a claim about it is settled. |
If we must keep data for a legal claim or a request from the authorities (a legal hold), we keep only that data, only as long as needed, and delete it when the hold ends, even if you have asked us to delete it. If a legal hold applies to your account, files you replace or remove while editing may be kept until the hold ends, and are then deleted. If we keep data you asked us to delete, we tell you by email unless the law forbids it.
11. Your rights
You have the right to access your data, to have it corrected (rectification) or erased, to restrict our use of it, to object to our use of it where we rely on legitimate interest, and to receive it in a machine-readable format (portability) (GDPR art. 15–21). Where we rely on consent, you can take it back at any time. Some data we must keep by law, for example bookkeeping records, even if you ask us to delete it, and we tell you when that is the case. Contact [email protected] or [email protected]. We answer within one month, free of charge, and if you ask for a copy of your data or files, we send it to your account’s email within one month.
12. Complaints
You can complain to Datatilsynet, the Norwegian Data Protection Authority (www.datatilsynet.no), or to the authority in the country where you live or work (art. 77). You can also take the matter to the courts.
13. People under 18
You must be 18 or older to use Kakorri or receive royalties, and for now we don’t accept releases on which a person under 18 performs or that a person under 18 created, wholly or partly. We don’t ask for personal data about people under 18.
If you tell us, or we learn, that a person under 18 took part in a release, we keep only what we need to take the release down and to deal with the royalties for it: the person’s name or artist name as shown on the release, the release, and what we were told. We use it only for that, under our legal obligations (art. 6(1)(c)) and our legitimate interest in handling the rights and royalties correctly (art. 6(1)(f)), and delete it when the matter is closed and any bookkeeping period has ended.
14. Changes
We tell you in the app and by email before we make changes to this notice that matter to you. If a change is to your detriment, we tell you at least 30 days before it takes effect. Before then you can close your account free of charge, and if you are on a paid plan you also get a refund, pro rata, for the unused part of the period you have paid for. A change that the law or an authority requires, or an urgent fix for security or fraud, may take effect sooner than 30 days, and we then give you the reason. A change that only benefits you may apply at once.